From 00fa1c315828ab0cc64febbd6ca80e75ecf1ab2d Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: Wed, 28 Jul 2021 13:05:18 +0800
Subject: [PATCH] 支持配置XSS跨站脚本过滤
---
ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/ValidateCodeFilter.java | 44 ++++++++++++++++++++++++++++++--------------
1 files changed, 30 insertions(+), 14 deletions(-)
diff --git a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/ValidateCodeFilter.java b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/ValidateCodeFilter.java
index cc4d673..1e724f0 100644
--- a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/ValidateCodeFilter.java
+++ b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/ValidateCodeFilter.java
@@ -1,16 +1,23 @@
package com.ruoyi.gateway.filter;
+import java.nio.CharBuffer;
+import java.nio.charset.StandardCharsets;
+import java.util.concurrent.atomic.AtomicReference;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.cloud.gateway.filter.GatewayFilter;
import org.springframework.cloud.gateway.filter.factory.AbstractGatewayFilterFactory;
-import org.springframework.http.HttpHeaders;
+import org.springframework.core.io.buffer.DataBuffer;
+import org.springframework.core.io.buffer.DataBufferUtils;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.stereotype.Component;
import com.alibaba.fastjson.JSON;
+import com.alibaba.fastjson.JSONObject;
import com.ruoyi.common.core.utils.StringUtils;
import com.ruoyi.common.core.web.domain.AjaxResult;
+import com.ruoyi.gateway.config.properties.CaptchaProperties;
import com.ruoyi.gateway.service.ValidateCodeService;
+import reactor.core.publisher.Flux;
import reactor.core.publisher.Mono;
/**
@@ -21,12 +28,13 @@
@Component
public class ValidateCodeFilter extends AbstractGatewayFilterFactory<Object>
{
- private final static String AUTH_URL = "/oauth/token";
+ private final static String AUTH_URL = "/auth/login";
@Autowired
private ValidateCodeService validateCodeService;
- private static final String BASIC_ = "Basic ";
+ @Autowired
+ private CaptchaProperties captchaProperties;
private static final String CODE = "code";
@@ -38,31 +46,39 @@
return (exchange, chain) -> {
ServerHttpRequest request = exchange.getRequest();
- // 非登录请求，不处理
- if (!StringUtils.containsIgnoreCase(request.getURI().getPath(), AUTH_URL))
+ // 非登录请求或验证码关闭，不处理
+ if (!StringUtils.containsIgnoreCase(request.getURI().getPath(), AUTH_URL) || !captchaProperties.getEnabled())
{
return chain.filter(exchange);
}
- // 消息头存在内容，且不存在验证码参数，不处理
- String header = request.getHeaders().getFirst(HttpHeaders.AUTHORIZATION);
- if (StringUtils.isNotEmpty(header) && StringUtils.startsWith(header, BASIC_)
- && !request.getQueryParams().containsKey(CODE) && !request.getQueryParams().containsKey(UUID))
- {
- return chain.filter(exchange);
- }
try
{
- validateCodeService.checkCapcha(request.getQueryParams().getFirst(CODE),
- request.getQueryParams().getFirst(UUID));
+ String rspStr = resolveBodyFromRequest(request);
+ JSONObject obj = JSONObject.parseObject(rspStr);
+ validateCodeService.checkCapcha(obj.getString(CODE), obj.getString(UUID));
}
catch (Exception e)
{
ServerHttpResponse response = exchange.getResponse();
+ response.getHeaders().add("Content-Type", "application/json;charset=UTF-8");
return exchange.getResponse().writeWith(
Mono.just(response.bufferFactory().wrap(JSON.toJSONBytes(AjaxResult.error(e.getMessage())))));
}
return chain.filter(exchange);
};
}
+
+ private String resolveBodyFromRequest(ServerHttpRequest serverHttpRequest)
+ {
+ // 获取请求体
+ Flux<DataBuffer> body = serverHttpRequest.getBody();
+ AtomicReference<String> bodyRef = new AtomicReference<>();
+ body.subscribe(buffer -> {
+ CharBuffer charBuffer = StandardCharsets.UTF_8.decode(buffer.asByteBuffer());
+ DataBufferUtils.release(buffer);
+ bodyRef.set(charBuffer.toString());
+ });
+ return bodyRef.get();
+ }
}
--
Gitblit v1.9.3