Fix poerformance nd security

pom.xml

@@ -48,6 +48,15 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-data-jpa</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-cache</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.github.ben-manes.caffeine</groupId>
+            <artifactId>caffeine</artifactId>
+            <version>3.1.8</version>
+        </dependency>
         <dependency>
             <groupId>org.projectlombok</groupId>
             <artifactId>lombok</artifactId>

src/main/java/com/darkfantasy/config/WebConfig.java

@@ -1,6 +1,11 @@
 package com.darkfantasy.config;
 
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.web.filter.OncePerRequestFilter;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@@ -9,6 +14,8 @@ import com.darkfantasy.security.ForceChangePasswordInterceptor;
 
 import lombok.RequiredArgsConstructor;
 
+import java.io.IOException;
+
 @Configuration
 @RequiredArgsConstructor
 public class WebConfig implements WebMvcConfigurer {
@@ -24,4 +31,20 @@ public class WebConfig implements WebMvcConfigurer {
     public void addInterceptors(InterceptorRegistry registry) {
         registry.addInterceptor(interceptor);
     }
-}
+
+    @org.springframework.context.annotation.Bean
+    public OncePerRequestFilter pathTraversalFilter() {
+        return new OncePerRequestFilter() {
+            @Override
+            protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+                    throws ServletException, IOException {
+                String path = request.getRequestURI();
+                if (path.contains("..") || path.contains("./")) {
+                    response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access Denied");
+                    return;
+                }
+                filterChain.doFilter(request, response);
+            }
+        };
+    }
+}

src/main/java/com/darkfantasy/service/impl/ArticleServiceImpl.java

@@ -2,6 +2,9 @@ package com.darkfantasy.service.impl;
 
 import java.util.List;
 
+import org.springframework.cache.annotation.CacheEvict;
+import org.springframework.cache.annotation.CachePut;
+import org.springframework.cache.annotation.Cacheable;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.PageRequest;
 import org.springframework.data.domain.Pageable;
@@ -36,6 +39,7 @@ public class ArticleServiceImpl implements ArticleService {
         return ArticleResponse.fromEntity(findArticle(id));
     }
 
+    @CacheEvict(value = "articles", allEntries = true)
     @Transactional
     @Override
     public ArticleResponse createArticle(CreateArticleRequest request) {
@@ -54,6 +58,7 @@ public class ArticleServiceImpl implements ArticleService {
         return ArticleResponse.fromEntity(savedArticle);
     }
 
+    @CacheEvict(value = "articles", allEntries = true)
     @Transactional
     @Override
     public ArticleResponse updateArticle(UpdateArticleRequest request) {
@@ -85,6 +90,7 @@ public class ArticleServiceImpl implements ArticleService {
         return ArticleResponse.fromEntity(article);
     }
 
+    @CacheEvict(value = "articles", allEntries = true)
     @Transactional
     @Override
     public void deleteArticle(Long articleId) {
@@ -102,12 +108,14 @@ public class ArticleServiceImpl implements ArticleService {
                 "Xóa bài viết: " + article.getTitle());
     }
 
+    @Cacheable(value = "articles", key = "#pageable.pageNumber + '_' + #pageable.pageSize")
     @Override
     public Page<ArticleResponse> getArticlesDeletedFalse(Pageable pageable) {
         return articleRepository.findByDeletedFalseOrderByCreatedAtDesc(pageable)
                 .map(ArticleResponse::fromEntity);
     }
 
+    @Cacheable(value = "articles", key = "'latest_' + #limit")
     @Override
     public List<ArticleResponse> getLatestArticles(int limit) {
 
@@ -119,6 +127,7 @@ public class ArticleServiceImpl implements ArticleService {
                 .toList();
     }
 
+    @Cacheable(value = "articles", key = "'important'")
     @Override
     public ArticleResponse getLatestImportantArticle() {
 
@@ -136,6 +145,7 @@ public class ArticleServiceImpl implements ArticleService {
         return articleRepository.findAll(pageable).map(ArticleResponse::fromEntity);
     }
 
+    @CacheEvict(value = "articles", allEntries = true)
     @Transactional
     @Override
     public void restoreArticle(Long articleId) {

src/main/java/com/darkfantasy/service/impl/ContributorServiceImpl.java

@@ -2,6 +2,8 @@ package com.darkfantasy.service.impl;
 
 import java.util.List;
 
+import org.springframework.cache.annotation.CacheEvict;
+import org.springframework.cache.annotation.Cacheable;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.PageRequest;
 import org.springframework.data.domain.Pageable;
@@ -35,6 +37,7 @@ public class ContributorServiceImpl implements ContributorService {
         return ContributorResponse.fromEntity(findContributor(id));
     }
 
+    @CacheEvict(value = "contributors", allEntries = true)
     @Transactional
     @Override
     public ContributorResponse createContributor(CreateContributorRequest request) {
@@ -53,6 +56,7 @@ public class ContributorServiceImpl implements ContributorService {
         return ContributorResponse.fromEntity(savedContributor);
     }
 
+    @CacheEvict(value = "contributors", allEntries = true)
     @Transactional
     @Override
     public ContributorResponse updateContributor(UpdateContributorRequest request) {
@@ -84,6 +88,7 @@ public class ContributorServiceImpl implements ContributorService {
         return ContributorResponse.fromEntity(contributor);
     }
 
+    @CacheEvict(value = "contributors", allEntries = true)
     @Transactional
     @Override
     public void deleteContributor(Long contributorId) {
@@ -101,6 +106,7 @@ public class ContributorServiceImpl implements ContributorService {
                 "Xóa người đóng góp: " + contributor.getName());
     }
 
+    @Cacheable(value = "contributors", key = "#pageable.pageNumber + '_' + #pageable.pageSize")
     @Override
     public Page<ContributorResponse> getContributorsDeletedFalse(Pageable pageable) {
         return contributorRepository.findByDeletedFalseOrderByPriorityDesc(pageable)
@@ -115,6 +121,7 @@ public class ContributorServiceImpl implements ContributorService {
         return contributorRepository.findAll(pageable).map(ContributorResponse::fromEntity);
     }
 
+    @CacheEvict(value = "contributors", allEntries = true)
     @Transactional
     @Override
     public void restoreContributor(Long contributorId) {

src/main/java/com/darkfantasy/service/impl/FaqServiceImpl.java

@@ -2,6 +2,8 @@ package com.darkfantasy.service.impl;
 
 import java.util.List;
 
+import org.springframework.cache.annotation.CacheEvict;
+import org.springframework.cache.annotation.Cacheable;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.stereotype.Service;
@@ -41,6 +43,7 @@ public class FaqServiceImpl implements FaqService {
         return FaqResponse.fromEntity(findFaq(id));
     }
 
+    @CacheEvict(value = "faqs", allEntries = true)
     @Transactional
     @Override
     public FaqResponse createFaq(CreateFaqRequest request) {
@@ -60,6 +63,7 @@ public class FaqServiceImpl implements FaqService {
         return FaqResponse.fromEntity(faq);
     }
 
+    @CacheEvict(value = "faqs", allEntries = true)
     @Transactional
     @Override
     public FaqResponse updateFaq(UpdateFaqRequest request) {
@@ -80,6 +84,7 @@ public class FaqServiceImpl implements FaqService {
         return FaqResponse.fromEntity(faq);
     }
 
+    @CacheEvict(value = "faqs", allEntries = true)
     @Transactional
     @Override
     public void deleteFaq(Long id) {
@@ -96,6 +101,7 @@ public class FaqServiceImpl implements FaqService {
                 "Xóa FAQ: " + found.getTitle());
     }
 
+    @CacheEvict(value = "faqs", allEntries = true)
     @Transactional
     @Override
     public void restoreFaq(Long id) {
@@ -112,6 +118,7 @@ public class FaqServiceImpl implements FaqService {
                 "Khôi phục FAQ: " + found.getTitle());
     }
 
+    @Cacheable(value = "faqs", key = "'all'")
     @Override
     public List<FaqResponse> getFaqsDeletedFalse() {
         return faqRepository

src/main/java/com/darkfantasy/service/impl/GameCharacterServiceImpl.java

@@ -2,6 +2,8 @@ package com.darkfantasy.service.impl;
 
 import java.util.List;
 
+import org.springframework.cache.annotation.CacheEvict;
+import org.springframework.cache.annotation.Cacheable;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.PageRequest;
 import org.springframework.data.domain.Pageable;
@@ -36,6 +38,7 @@ public class GameCharacterServiceImpl implements GameCharacterService {
         return GameCharacterResponse.fromEntity(findGameCharacter(id));
     }
 
+    @CacheEvict(value = "characters", allEntries = true)
     @Transactional
     @Override
     public GameCharacterResponse createGameCharacter(
@@ -59,6 +62,7 @@ public class GameCharacterServiceImpl implements GameCharacterService {
                 savedCharacter);
     }
 
+    @CacheEvict(value = "characters", allEntries = true)
     @Transactional
     @Override
     public GameCharacterResponse updateGameCharacter(UpdateGameCharacterRequest request) {
@@ -85,6 +89,7 @@ public class GameCharacterServiceImpl implements GameCharacterService {
 
     }
 
+    @CacheEvict(value = "characters", allEntries = true)
     @Transactional
     @Override
     public void deleteCharacter(Long id) {
@@ -101,6 +106,7 @@ public class GameCharacterServiceImpl implements GameCharacterService {
                 "Xóa nhân vật: " + found.getName());
     }
 
+    @CacheEvict(value = "characters", allEntries = true)
     @Transactional
     @Override
     public void restoreCharacter(Long id) {
@@ -124,6 +130,7 @@ public class GameCharacterServiceImpl implements GameCharacterService {
                 .map(GameCharacterResponse::fromEntity);
     }
 
+    @Cacheable(value = "characters", key = "'limit_' + #limit")
     @Override
     public List<GameCharacterResponse> getCharactersLimit(int limit) {
         if (limit <= 0)
@@ -134,6 +141,7 @@ public class GameCharacterServiceImpl implements GameCharacterService {
                 .map(GameCharacterResponse::fromEntity).toList();
     }
 
+    @Cacheable(value = "characters", key = "'all'")
     @Override
     public List<GameCharacterResponse> getCharactersDeletedFalse() {
         return gameCharacterRepository

src/main/java/com/darkfantasy/service/impl/StoryServiceImpl.java

@@ -2,6 +2,8 @@ package com.darkfantasy.service.impl;
 
 import java.util.List;
 
+import org.springframework.cache.annotation.CacheEvict;
+import org.springframework.cache.annotation.Cacheable;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.stereotype.Service;
@@ -41,6 +43,7 @@ public class StoryServiceImpl implements StoryService {
         return StoryResponse.fromEntity(findStory(id));
     }
 
+    @CacheEvict(value = "stories", allEntries = true)
     @Transactional
     @Override
     public StoryResponse createStory(CreateStoryRequest request) {
@@ -62,6 +65,7 @@ public class StoryServiceImpl implements StoryService {
         return StoryResponse.fromEntity(savedStory);
     }
 
+    @CacheEvict(value = "stories", allEntries = true)
     @Transactional
     @Override
     public StoryResponse updateStory(UpdateStoryRequest request) {
@@ -88,6 +92,7 @@ public class StoryServiceImpl implements StoryService {
         return StoryResponse.fromEntity(story);
     }
 
+    @CacheEvict(value = "stories", allEntries = true)
     @Transactional
     @Override
     public void deleteStory(Long id) {
@@ -104,6 +109,7 @@ public class StoryServiceImpl implements StoryService {
                 "Xóa câu chuyện: " + found.getTitle());
     }
 
+    @CacheEvict(value = "stories", allEntries = true)
     @Transactional
     @Override
     public void restoreStory(Long id) {
@@ -120,6 +126,7 @@ public class StoryServiceImpl implements StoryService {
                 "Khôi phục câu chuyện: " + found.getTitle());
     }
 
+    @Cacheable(value = "stories", key = "'highest_priority'")
     @Override
     public StoryResponse getStoryDeletedFalseHighestPriority() {
         Story story = storyRepository.findTopByDeletedFalseOrderByPriorityDesc();
@@ -129,6 +136,7 @@ public class StoryServiceImpl implements StoryService {
         return StoryResponse.fromEntity(story);
     }
 
+    @Cacheable(value = "stories", key = "'all'")
     @Override
     public List<StoryResponse> getStoriesDeletedFalse() {
         return storyRepository

src/main/java/com/darkfantasy/service/impl/WorldServiceImpl.java

@@ -2,6 +2,8 @@ package com.darkfantasy.service.impl;
 
 import java.util.List;
 
+import org.springframework.cache.annotation.CacheEvict;
+import org.springframework.cache.annotation.Cacheable;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.stereotype.Service;
@@ -42,6 +44,7 @@ public class WorldServiceImpl implements WorldService {
         return WorldResponse.fromEntity(findWorld(id));
     }
 
+    @CacheEvict(value = "worlds", allEntries = true)
     @Transactional
     @Override
     public WorldResponse createWorld(CreateWorldRequest request) {
@@ -61,6 +64,7 @@ public class WorldServiceImpl implements WorldService {
         return WorldResponse.fromEntity(world);
     }
 
+    @CacheEvict(value = "worlds", allEntries = true)
     @Transactional
     @Override
     public WorldResponse updateWorld(UpdateWorldRequest request) {
@@ -85,6 +89,7 @@ public class WorldServiceImpl implements WorldService {
         return WorldResponse.fromEntity(world);
     }
 
+    @CacheEvict(value = "worlds", allEntries = true)
     @Transactional
     @Override
     public void deleteWorld(Long id) {
@@ -101,6 +106,7 @@ public class WorldServiceImpl implements WorldService {
                 "Xóa thế giới: " + found.getTitle());
     }
 
+    @CacheEvict(value = "worlds", allEntries = true)
     @Transactional
     @Override
     public void restoreWorld(Long id) {
@@ -117,6 +123,7 @@ public class WorldServiceImpl implements WorldService {
                 "Khôi phục thế giới: " + found.getTitle());
     }
 
+    @Cacheable(value = "worlds", key = "'highest_priority'")
     @Override
     public WorldResponse getWorldDeletedFalseHighestPriority() {
         World world = worldRepository
@@ -129,6 +136,7 @@ public class WorldServiceImpl implements WorldService {
         return WorldResponse.fromEntity(world);
     }
 
+    @Cacheable(value = "worlds", key = "'all'")
     @Override
     public List<WorldResponse> getWorldsDeletedFalse() {
         return worldRepository

src/main/resources/application.properties

@@ -46,4 +46,9 @@ spring.mail.properties.mail.smtp.starttls.enable=true
 server.error.include-message=never
 server.error.include-binding-errors=never
 server.error.include-stacktrace=never
-server.error.include-exception=false
+server.error.include-exception=false
+
+# Cache Configuration
+spring.cache.type=caffeine
+spring.cache.caffeine.spec=maximumSize=500,expireAfterWrite=5m
+spring.cache.cache-names=articles,characters,worlds,stories,faqs,contributors