XSS过滤排除非json类型

RuoYi

2021-07-31 93ee021b6e8a9e6b3bca12c2f35f6e3c68baef5a

XSS过滤排除非json类型

 ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java

@@ -11,6 +11,7 @@
import org.springframework.core.io.buffer.NettyDataBufferFactory;

import org.springframework.http.HttpHeaders;

import org.springframework.http.HttpMethod;

import org.springframework.http.MediaType;

import org.springframework.http.server.reactive.ServerHttpRequest;

import org.springframework.http.server.reactive.ServerHttpRequestDecorator;

import org.springframework.stereotype.Component;

@@ -42,6 +43,11 @@
        // GET DELETE 不过滤

        HttpMethod method = request.getMethod();

        if (method == null || method.matches("GET") || method.matches("DELETE"))

        {

            return chain.filter(exchange);

        }

        // 非json类型，不过滤

        if (!isJsonRequest(exchange))

        {

            return chain.filter(exchange);

        }

@@ -95,6 +101,17 @@
        return serverHttpRequestDecorator;

    }



    /**

     * 是否是Json请求

     * 
     * @param request

     */

    public boolean isJsonRequest(ServerWebExchange exchange)

    {

        String header = exchange.getRequest().getHeaders().getFirst(HttpHeaders.CONTENT_TYPE);

        return StringUtils.startsWithIgnoreCase(header, MediaType.APPLICATION_JSON_VALUE);

    }



    @Override

    public int getOrder()

    {