From 93ee021b6e8a9e6b3bca12c2f35f6e3c68baef5a Mon Sep 17 00:00:00 2001
From: RuoYi <yzz_ivy@163.com>
Date: Sat, 31 Jul 2021 12:18:24 +0800
Subject: [PATCH] XSS过滤排除非json类型
---
ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java | 17 +++++++++++++++++
1 files changed, 17 insertions(+), 0 deletions(-)
diff --git a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java
index 799625f..021cf43 100644
--- a/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java
+++ b/ruoyi-gateway/src/main/java/com/ruoyi/gateway/filter/XssFilter.java
@@ -11,6 +11,7 @@
import org.springframework.core.io.buffer.NettyDataBufferFactory;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
+import org.springframework.http.MediaType;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.http.server.reactive.ServerHttpRequestDecorator;
import org.springframework.stereotype.Component;
@@ -42,6 +43,11 @@
// GET DELETE 不过滤
HttpMethod method = request.getMethod();
if (method == null || method.matches("GET") || method.matches("DELETE"))
+ {
+ return chain.filter(exchange);
+ }
+ // 非json类型，不过滤
+ if (!isJsonRequest(exchange))
{
return chain.filter(exchange);
}
@@ -95,6 +101,17 @@
return serverHttpRequestDecorator;
}
+ /**
+ * 是否是Json请求
+ *
+ * @param request
+ */
+ public boolean isJsonRequest(ServerWebExchange exchange)
+ {
+ String header = exchange.getRequest().getHeaders().getFirst(HttpHeaders.CONTENT_TYPE);
+ return StringUtils.startsWithIgnoreCase(header, MediaType.APPLICATION_JSON_VALUE);
+ }
+
@Override
public int getOrder()
{
--
Gitblit v1.9.3