From a6bcebb62bebe88b256e2e42231e1bd7253f45ae Mon Sep 17 00:00:00 2001
From: 若依 <yzz_ivy@163.com>
Date: Mon, 10 Mar 2025 11:45:34 +0800
Subject: [PATCH] !397 修复actuator暴漏问题 Merge pull request !397 from 威士忌的纯度/N/A
---
ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java | 9 +++++++--
1 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java
index 773aa55..a82ee84 100644
--- a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java
+++ b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java
@@ -42,9 +42,14 @@
public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain)
{
ServerHttpRequest request = exchange.getRequest();
+ // xss开关未开启 或 通过nacos关闭，不过滤
+ if (!xss.getEnabled())
+ {
+ return chain.filter(exchange);
+ }
// GET DELETE 不过滤
HttpMethod method = request.getMethod();
- if (method == null || method.matches("GET") || method.matches("DELETE"))
+ if (method == null || method == HttpMethod.GET || method == HttpMethod.DELETE)
{
return chain.filter(exchange);
}
@@ -82,7 +87,7 @@
// 防xss攻击过滤
bodyStr = EscapeUtil.clean(bodyStr);
// 转成字节
- byte[] bytes = bodyStr.getBytes();
+ byte[] bytes = bodyStr.getBytes(StandardCharsets.UTF_8);
NettyDataBufferFactory nettyDataBufferFactory = new NettyDataBufferFactory(ByteBufAllocator.DEFAULT);
DataBuffer buffer = nettyDataBufferFactory.allocateBuffer(bytes.length);
buffer.write(bytes);
--
Gitblit v1.9.3