此处修改曾导致 nacos修改xss开关时，spring容器未重启，filter仍起效。故增加参数判断，参数刷新后，xss开关正常关闭。 此处修改曾导...

ylwang

2022-11-21 bc1c1dbfa7640856d57d6538056d7e98f43d1dbc

 ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java

@@ -2,14 +2,18 @@


import java.nio.charset.StandardCharsets;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;

import org.springframework.cloud.gateway.filter.GatewayFilterChain;

import org.springframework.cloud.gateway.filter.GlobalFilter;

import org.springframework.core.Ordered;

import org.springframework.core.io.buffer.DataBuffer;

import org.springframework.core.io.buffer.DataBufferFactory;

import org.springframework.core.io.buffer.DataBufferUtils;

import org.springframework.core.io.buffer.DefaultDataBufferFactory;

import org.springframework.core.io.buffer.NettyDataBufferFactory;

import org.springframework.http.HttpHeaders;

import org.springframework.http.HttpMethod;

import org.springframework.http.MediaType;

import org.springframework.http.server.reactive.ServerHttpRequest;

import org.springframework.http.server.reactive.ServerHttpRequestDecorator;

import org.springframework.stereotype.Component;

@@ -27,6 +31,7 @@
 * @author ruoyi

 */

@Component

@ConditionalOnProperty(value = "security.xss.enabled", havingValue = "true")

public class XssFilter implements GlobalFilter, Ordered

{

    // 跨站脚本的 xss 配置，nacos自行添加

@@ -37,9 +42,18 @@
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain)

    {

        ServerHttpRequest request = exchange.getRequest();

        // xss开关未开启 或 通过nacos关闭，不过滤

        if(!xss.getEnabled()){

            return chain.filter(exchange);

        }

        // GET DELETE 不过滤

        HttpMethod method = request.getMethod();

        if (method == null || method.matches("GET") || method.matches("DELETE"))

        if (method == null || method == HttpMethod.GET || method == HttpMethod.DELETE)

        {

            return chain.filter(exchange);

        }

        // 非json类型，不过滤

        if (!isJsonRequest(exchange))

        {

            return chain.filter(exchange);

        }

@@ -62,10 +76,12 @@
            public Flux<DataBuffer> getBody()

            {

                Flux<DataBuffer> body = super.getBody();

                return body.map(dataBuffer -> {

                    byte[] content = new byte[dataBuffer.readableByteCount()];

                    dataBuffer.read(content);

                    DataBufferUtils.release(dataBuffer);

                return body.buffer().map(dataBuffers -> {

                    DataBufferFactory dataBufferFactory = new DefaultDataBufferFactory();

                    DataBuffer join = dataBufferFactory.join(dataBuffers);

                    byte[] content = new byte[join.readableByteCount()];

                    join.read(content);

                    DataBufferUtils.release(join);

                    String bodyStr = new String(content, StandardCharsets.UTF_8);

                    // 防xss攻击过滤

                    bodyStr = EscapeUtil.clean(bodyStr);

@@ -93,6 +109,17 @@
        return serverHttpRequestDecorator;

    }



    /**

     * 是否是Json请求

     * 
     * @param exchange HTTP请求

     */

    public boolean isJsonRequest(ServerWebExchange exchange)

    {

        String header = exchange.getRequest().getHeaders().getFirst(HttpHeaders.CONTENT_TYPE);

        return StringUtils.startsWithIgnoreCase(header, MediaType.APPLICATION_JSON_VALUE);

    }



    @Override

    public int getOrder()

    {