From 1761a4f58856bcd65eb4e9ab29666914a2ca4d41 Mon Sep 17 00:00:00 2001
From: 若依 <yzz_ivy@163.com>
Date: Sat, 12 Feb 2022 14:02:37 +0800
Subject: [PATCH] !145 修复文档参数名错误 Merge pull request !145 from runphp/N/A
---
ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java | 29 +++++++++++++++++++++++++----
1 files changed, 25 insertions(+), 4 deletions(-)
diff --git a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java
index 799625f..773aa55 100644
--- a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java
+++ b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java
@@ -7,10 +7,13 @@
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.core.Ordered;
import org.springframework.core.io.buffer.DataBuffer;
+import org.springframework.core.io.buffer.DataBufferFactory;
import org.springframework.core.io.buffer.DataBufferUtils;
+import org.springframework.core.io.buffer.DefaultDataBufferFactory;
import org.springframework.core.io.buffer.NettyDataBufferFactory;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
+import org.springframework.http.MediaType;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.http.server.reactive.ServerHttpRequestDecorator;
import org.springframework.stereotype.Component;
@@ -45,6 +48,11 @@
{
return chain.filter(exchange);
}
+ // 非json类型，不过滤
+ if (!isJsonRequest(exchange))
+ {
+ return chain.filter(exchange);
+ }
// excludeUrls 不过滤
String url = request.getURI().getPath();
if (StringUtils.matches(url, xss.getExcludeUrls()))
@@ -64,10 +72,12 @@
public Flux<DataBuffer> getBody()
{
Flux<DataBuffer> body = super.getBody();
- return body.map(dataBuffer -> {
- byte[] content = new byte[dataBuffer.readableByteCount()];
- dataBuffer.read(content);
- DataBufferUtils.release(dataBuffer);
+ return body.buffer().map(dataBuffers -> {
+ DataBufferFactory dataBufferFactory = new DefaultDataBufferFactory();
+ DataBuffer join = dataBufferFactory.join(dataBuffers);
+ byte[] content = new byte[join.readableByteCount()];
+ join.read(content);
+ DataBufferUtils.release(join);
String bodyStr = new String(content, StandardCharsets.UTF_8);
// 防xss攻击过滤
bodyStr = EscapeUtil.clean(bodyStr);
@@ -95,6 +105,17 @@
return serverHttpRequestDecorator;
}
+ /**
+ * 是否是Json请求
+ *
+ * @param exchange HTTP请求
+ */
+ public boolean isJsonRequest(ServerWebExchange exchange)
+ {
+ String header = exchange.getRequest().getHeaders().getFirst(HttpHeaders.CONTENT_TYPE);
+ return StringUtils.startsWithIgnoreCase(header, MediaType.APPLICATION_JSON_VALUE);
+ }
+
@Override
public int getOrder()
{
--
Gitblit v1.9.3