From 00fa1c315828ab0cc64febbd6ca80e75ecf1ab2d Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: Wed, 28 Jul 2021 13:05:18 +0800
Subject: [PATCH] 支持配置XSS跨站脚本过滤
---
ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/ValidateCodeFilter.java | 54 +++++++++++++++++++++++++++++-------------------------
1 files changed, 29 insertions(+), 25 deletions(-)
diff --git a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/ValidateCodeFilter.java b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/ValidateCodeFilter.java
index 6172c8d..1e724f0 100644
--- a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/ValidateCodeFilter.java
+++ b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/ValidateCodeFilter.java
@@ -1,16 +1,23 @@
package com.ruoyi.gateway.filter;
+import java.nio.CharBuffer;
+import java.nio.charset.StandardCharsets;
+import java.util.concurrent.atomic.AtomicReference;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.cloud.gateway.filter.GatewayFilter;
import org.springframework.cloud.gateway.filter.factory.AbstractGatewayFilterFactory;
-import org.springframework.http.HttpHeaders;
+import org.springframework.core.io.buffer.DataBuffer;
+import org.springframework.core.io.buffer.DataBufferUtils;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.stereotype.Component;
import com.alibaba.fastjson.JSON;
+import com.alibaba.fastjson.JSONObject;
import com.ruoyi.common.core.utils.StringUtils;
import com.ruoyi.common.core.web.domain.AjaxResult;
+import com.ruoyi.gateway.config.properties.CaptchaProperties;
import com.ruoyi.gateway.service.ValidateCodeService;
+import reactor.core.publisher.Flux;
import reactor.core.publisher.Mono;
/**
@@ -21,20 +28,17 @@
@Component
public class ValidateCodeFilter extends AbstractGatewayFilterFactory<Object>
{
- private final static String AUTH_URL = "/oauth/token";
+ private final static String AUTH_URL = "/auth/login";
@Autowired
private ValidateCodeService validateCodeService;
- private static final String BASIC_ = "Basic ";
+ @Autowired
+ private CaptchaProperties captchaProperties;
private static final String CODE = "code";
private static final String UUID = "uuid";
-
- private static final String GRANT_TYPE = "grant_type";
-
- private static final String REFRESH_TOKEN = "refresh_token";
@Override
public GatewayFilter apply(Object config)
@@ -42,30 +46,17 @@
return (exchange, chain) -> {
ServerHttpRequest request = exchange.getRequest();
- // 非登录请求，不处理
- if (!StringUtils.containsIgnoreCase(request.getURI().getPath(), AUTH_URL))
- {
- return chain.filter(exchange);
- }
-
- // 刷新token请求，不处理
- String grantType = request.getQueryParams().getFirst(GRANT_TYPE);
- if (StringUtils.containsIgnoreCase(request.getURI().getPath(), AUTH_URL) && StringUtils.containsIgnoreCase(grantType, REFRESH_TOKEN))
+ // 非登录请求或验证码关闭，不处理
+ if (!StringUtils.containsIgnoreCase(request.getURI().getPath(), AUTH_URL) || !captchaProperties.getEnabled())
{
return chain.filter(exchange);
}
- // 消息头存在内容，且不存在验证码参数，不处理
- String header = request.getHeaders().getFirst(HttpHeaders.AUTHORIZATION);
- if (StringUtils.isNotEmpty(header) && StringUtils.startsWith(header, BASIC_)
- && !request.getQueryParams().containsKey(CODE) && !request.getQueryParams().containsKey(UUID))
- {
- return chain.filter(exchange);
- }
try
{
- validateCodeService.checkCapcha(request.getQueryParams().getFirst(CODE),
- request.getQueryParams().getFirst(UUID));
+ String rspStr = resolveBodyFromRequest(request);
+ JSONObject obj = JSONObject.parseObject(rspStr);
+ validateCodeService.checkCapcha(obj.getString(CODE), obj.getString(UUID));
}
catch (Exception e)
{
@@ -77,4 +68,17 @@
return chain.filter(exchange);
};
}
+
+ private String resolveBodyFromRequest(ServerHttpRequest serverHttpRequest)
+ {
+ // 获取请求体
+ Flux<DataBuffer> body = serverHttpRequest.getBody();
+ AtomicReference<String> bodyRef = new AtomicReference<>();
+ body.subscribe(buffer -> {
+ CharBuffer charBuffer = StandardCharsets.UTF_8.decode(buffer.asByteBuffer());
+ DataBufferUtils.release(buffer);
+ bodyRef.set(charBuffer.toString());
+ });
+ return bodyRef.get();
+ }
}
--
Gitblit v1.9.3