解决问题：spring-boot-starter-data-rest包有严重的安全漏洞

pom.xml

@@ -66,10 +66,6 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-data-jpa</artifactId>
         </dependency>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-data-rest</artifactId>
-        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-integration</artifactId>

src/main/java/cn/quantgroup/xyqb/config/http/HttpConfig.java

@@ -30,6 +30,8 @@ import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.convert.converter.ConverterRegistry;
+import org.springframework.format.support.DefaultFormattingConversionService;
+import org.springframework.format.support.FormattingConversionService;
 import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
 import org.springframework.web.filter.CharacterEncodingFilter;
 
@@ -78,20 +80,24 @@ public class HttpConfig {
     return builder;
   }
 
-  // hack spring mvc.
   @Bean
-  public IntegerToEnumConverterFactory getIntegerToEnumConverterFactory(
-      ConverterRegistry defaultConversionService, ConverterRegistry mvcConversionService, ConverterRegistry integrationConversionService) {
-    IntegerToEnumConverterFactory factory = new IntegerToEnumConverterFactory();
+  public ConverterRegistry defaultConversionService() {
+    FormattingConversionService conversionService = new DefaultFormattingConversionService();
+    addFormatters(conversionService);
+    return conversionService;
+  }
+  @Bean
+  public ConverterRegistry integrationConversionService() {
+    FormattingConversionService conversionService = new DefaultFormattingConversionService();
+    addFormatters(conversionService);
+    return conversionService;
+  }
 
-    defaultConversionService.removeConvertible(String.class, Enum.class);
-    mvcConversionService.removeConvertible(String.class, Enum.class);
-    integrationConversionService.removeConvertible(String.class, Enum.class);
 
-    defaultConversionService.addConverterFactory(factory);
-    mvcConversionService.addConverterFactory(factory);
-    integrationConversionService.addConverterFactory(factory);
-    return factory;
+  private void addFormatters(FormattingConversionService conversionService) {
+    IntegerToEnumConverterFactory factory = new IntegerToEnumConverterFactory();
+    conversionService.removeConvertible(String.class,Enum.class);
+    conversionService.addConverterFactory(factory);
   }
 
   @Bean(name = "httpClient")

src/main/java/cn/quantgroup/xyqb/config/http/MyWebMvcConfigurer.java

+package cn.quantgroup.xyqb.config.http;
+
+import org.springframework.format.FormatterRegistry;
+import org.springframework.stereotype.Component;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
+
+@Component
+public class MyWebMvcConfigurer extends WebMvcConfigurerAdapter {
+
+  @Override
+  public void addFormatters(FormatterRegistry registry) {
+    registry.removeConvertible(String.class,Enum.class);
+    registry.addConverterFactory(new IntegerToEnumConverterFactory());
+  }
+
+}
\ No newline at end of file