fix 修复 CVE-2026-2819 工作流接口通过业务id可以越级删除问题

ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/service/impl/FlwInstanceServiceImpl.java

@@ -193,13 +193,8 @@ public class FlwInstanceServiceImpl implements IFlwInstanceService {
             log.warn("未找到对应的流程实例信息，无法执行删除操作。");
             return false;
         }
-        String userId = LoginHelper.getUserIdStr();
-        for (FlowInstance instance : flowInstances) {
-            if (LoginHelper.isSuperAdmin() || instance.getCreateBy().equals(userId)) {
-                continue;
-            }
-            throw new ServiceException("权限不足，无法删除流程实例信息!");
-        }
+        // 发送事件
+        processDeleteHandler(flowInstances);
         return insService.remove(StreamUtils.toList(flowInstances, FlowInstance::getId));
     }
 
@@ -212,34 +207,13 @@ public class FlwInstanceServiceImpl implements IFlwInstanceService {
     @Transactional(rollbackFor = Exception.class)
     public boolean deleteByInstanceIds(List<Long> instanceIds) {
         // 获取实例信息
-        List<Instance> instances = insService.getByIds(instanceIds);
-        if (CollUtil.isEmpty(instances)) {
+        List<FlowInstance> flowInstances = flowInstanceMapper.selectByIds(instanceIds);
+        if (CollUtil.isEmpty(flowInstances)) {
             log.warn("未找到对应的流程实例信息，无法执行删除操作。");
             return false;
         }
-        String userId = LoginHelper.getUserIdStr();
-        for (Instance instance : instances) {
-            if (LoginHelper.isSuperAdmin() || instance.getCreateBy().equals(userId)) {
-                continue;
-            }
-            throw new ServiceException("权限不足，无法删除流程实例信息!");
-        }
-        // 获取定义信息
-        Map<Long, Definition> definitionMap = StreamUtils.toMap(
-            defService.getByIds(StreamUtils.toList(instances, Instance::getDefinitionId)),
-            Definition::getId,
-            Function.identity()
-        );
-
-        // 逐一触发删除事件
-        instances.forEach(instance -> {
-            Definition definition = definitionMap.get(instance.getDefinitionId());
-            if (ObjectUtil.isNull(definition)) {
-                log.warn("实例 ID: {} 对应的流程定义信息未找到，跳过删除事件触发。", instance.getId());
-                return;
-            }
-            flowProcessEventHandler.processDeleteHandler(definition.getFlowCode(), instance.getBusinessId());
-        });
+        // 发送事件
+        processDeleteHandler(flowInstances);
         // 删除实例
         return insService.remove(instanceIds);
     }
@@ -253,26 +227,43 @@ public class FlwInstanceServiceImpl implements IFlwInstanceService {
     @Transactional(rollbackFor = Exception.class)
     public boolean deleteHisByInstanceIds(List<Long> instanceIds) {
         // 获取实例信息
-        List<Instance> instances = insService.getByIds(instanceIds);
-        if (CollUtil.isEmpty(instances)) {
+        List<FlowInstance> flowInstances = flowInstanceMapper.selectByIds(instanceIds);
+        if (CollUtil.isEmpty(flowInstances)) {
             log.warn("未找到对应的流程实例信息，无法执行删除操作。");
             return false;
         }
+        // 发送事件
+        processDeleteHandler(flowInstances);
+        List<FlowTask> flowTaskList = flwTaskService.selectByInstIds(instanceIds);
+        if (CollUtil.isNotEmpty(flowTaskList)) {
+            FlowEngine.userService().deleteByTaskIds(StreamUtils.toList(flowTaskList, FlowTask::getId));
+        }
+        FlowEngine.taskService().deleteByInsIds(instanceIds);
+        FlowEngine.hisTaskService().deleteByInsIds(instanceIds);
+        FlowEngine.insService().removeByIds(instanceIds);
+        return true;
+    }
+
+
+    private void processDeleteHandler(List<FlowInstance> flowInstances) {
+
         String userId = LoginHelper.getUserIdStr();
-        for (Instance instance : instances) {
-            if (LoginHelper.isSuperAdmin() || instance.getCreateBy().equals(userId)) {
+        for (FlowInstance flowInstance : flowInstances) {
+            //如果创建人与当前登陆人一致或者当前登陆人为管理员才能删除
+            if (LoginHelper.isSuperAdmin() || flowInstance.getCreateBy().equals(userId)) {
                 continue;
             }
             throw new ServiceException("权限不足，无法删除流程实例信息!");
         }
         // 获取定义信息
         Map<Long, Definition> definitionMap = StreamUtils.toMap(
-            defService.getByIds(StreamUtils.toList(instances, Instance::getDefinitionId)),
+            defService.getByIds(StreamUtils.toList(flowInstances, Instance::getDefinitionId)),
             Definition::getId,
             Function.identity()
         );
+
         // 逐一触发删除事件
-        instances.forEach(instance -> {
+        flowInstances.forEach(instance -> {
             Definition definition = definitionMap.get(instance.getDefinitionId());
             if (ObjectUtil.isNull(definition)) {
                 log.warn("实例 ID: {} 对应的流程定义信息未找到，跳过删除事件触发。", instance.getId());
@@ -280,14 +271,6 @@ public class FlwInstanceServiceImpl implements IFlwInstanceService {
             }
             flowProcessEventHandler.processDeleteHandler(definition.getFlowCode(), instance.getBusinessId());
         });
-        List<FlowTask> flowTaskList = flwTaskService.selectByInstIds(instanceIds);
-        if (CollUtil.isNotEmpty(flowTaskList)) {
-            FlowEngine.userService().deleteByTaskIds(StreamUtils.toList(flowTaskList, FlowTask::getId));
-        }
-        FlowEngine.taskService().deleteByInsIds(instanceIds);
-        FlowEngine.hisTaskService().deleteByInsIds(instanceIds);
-        FlowEngine.insService().removeByIds(instanceIds);
-        return true;
     }
 
     /**