优化白名单支持对通配符路径匹配

RuoYi

2026-04-16 1002b36c0a698c794320d1544c464c13b303e53c

 ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/ValidateCodeFilter.java

@@ -9,28 +9,30 @@
import org.springframework.core.io.buffer.DataBuffer;

import org.springframework.core.io.buffer.DataBufferUtils;

import org.springframework.http.server.reactive.ServerHttpRequest;

import org.springframework.http.server.reactive.ServerHttpResponse;

import org.springframework.stereotype.Component;

import com.alibaba.fastjson.JSON;

import com.alibaba.fastjson.JSONObject;

import com.alibaba.fastjson2.JSON;

import com.alibaba.fastjson2.JSONObject;

import com.ruoyi.common.core.utils.ServletUtils;

import com.ruoyi.common.core.utils.StringUtils;

import com.ruoyi.common.core.web.domain.AjaxResult;

import com.ruoyi.gateway.config.properties.CaptchaProperties;

import com.ruoyi.gateway.service.ValidateCodeService;

import reactor.core.publisher.Flux;

import reactor.core.publisher.Mono;



/**

 * 验证码过滤器

 * 
 *

 * @author ruoyi

 */

@Component

public class ValidateCodeFilter extends AbstractGatewayFilterFactory<Object>

{

    private final static String AUTH_URL = "/auth/login";

    private final static String[] VALIDATE_URL = new String[] { "/auth/login", "/auth/register" };



    @Autowired

    private ValidateCodeService validateCodeService;



    @Autowired

    private CaptchaProperties captchaProperties;



    private static final String CODE = "code";



@@ -42,8 +44,8 @@
        return (exchange, chain) -> {

            ServerHttpRequest request = exchange.getRequest();



            // 非登录请求，不处理

            if (!StringUtils.containsIgnoreCase(request.getURI().getPath(), AUTH_URL))

            // 非登录/注册请求或验证码关闭，不处理

            if (!StringUtils.equalsAnyIgnoreCase(request.getURI().getPath(), VALIDATE_URL) || !captchaProperties.getEnabled())

            {

                return chain.filter(exchange);

            }

@@ -51,20 +53,18 @@
            try

            {

                String rspStr = resolveBodyFromRequest(request);

                JSONObject obj = JSONObject.parseObject(rspStr);

                validateCodeService.checkCapcha(obj.getString(CODE), obj.getString(UUID));

                JSONObject obj = JSON.parseObject(rspStr);

                validateCodeService.checkCaptcha(obj.getString(CODE), obj.getString(UUID));

            }

            catch (Exception e)

            {

                ServerHttpResponse response = exchange.getResponse();

                response.getHeaders().add("Content-Type", "application/json;charset=UTF-8");

                return exchange.getResponse().writeWith(

                        Mono.just(response.bufferFactory().wrap(JSON.toJSONBytes(AjaxResult.error(e.getMessage())))));

                return ServletUtils.webFluxResponseWriter(exchange.getResponse(), e.getMessage());

            }

            return chain.filter(exchange);

        };

    }



    @SuppressWarnings("deprecation")

    private String resolveBodyFromRequest(ServerHttpRequest serverHttpRequest)

    {

        // 获取请求体