From fc72b670908bc0d9b00a8e9aa7e36499055e792d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=96=AF=E7=8B=82=E7=9A=84=E7=8B=AE=E5=AD=90Li?= <15040126243@163.com> Date: Fri, 13 Sep 2024 18:02:44 +0800 Subject: [PATCH] =?UTF-8?q?update=20=E4=BC=98=E5=8C=96=20=E5=85=A8?= =?UTF-8?q?=E5=B1=80=E5=BC=80=E5=90=AFxss=E8=BF=87=E6=BB=A4=20=E6=8F=90?= =?UTF-8?q?=E9=AB=98=E5=AE=89=E5=85=A8=E6=80=A7=20=E4=B8=8Ecloud=E7=89=88?= =?UTF-8?q?=E6=9C=AC=E4=BF=9D=E6=8C=81=E4=B8=80=E8=87=B4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ruoyi-admin/src/main/resources/application.yml | 7 ++++--- .../dromara/common/web/config/FilterConfig.java | 11 ++--------- .../web/config/properties/XssProperties.java | 16 +++++++--------- .../org/dromara/common/web/filter/XssFilter.java | 11 ++++------- 4 files changed, 17 insertions(+), 28 deletions(-) diff --git a/ruoyi-admin/src/main/resources/application.yml b/ruoyi-admin/src/main/resources/application.yml index 5d94bef93..82d0f1e50 100644 --- a/ruoyi-admin/src/main/resources/application.yml +++ b/ruoyi-admin/src/main/resources/application.yml @@ -223,9 +223,10 @@ xss: # 过滤开关 enabled: true # 排除链接（多个用逗号分隔） - excludes: /system/notice - # 匹配链接 - urlPatterns: /system/*,/monitor/*,/tool/* + excludeUrls: + - /system/notice + - /workflow/model/save + - /workflow/model/editModelXml # 全局线程池相关配置 # 如使用JDK21请直接使用虚拟线程 不要开启此配置 diff --git a/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/FilterConfig.java b/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/FilterConfig.java index 91fff76b6..bc27d6f3e 100644 --- a/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/FilterConfig.java +++ b/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/FilterConfig.java @@ -1,19 +1,15 @@ package org.dromara.common.web.config; -import org.dromara.common.core.utils.StringUtils; +import jakarta.servlet.DispatcherType; import org.dromara.common.web.config.properties.XssProperties; import org.dromara.common.web.filter.RepeatableFilter; import org.dromara.common.web.filter.XssFilter; -import jakarta.servlet.DispatcherType; import org.springframework.boot.autoconfigure.AutoConfiguration; import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.boot.web.servlet.FilterRegistrationBean; import org.springframework.context.annotation.Bean; -import java.util.HashMap; -import java.util.Map; - /** * Filter配置 * @@ -30,12 +26,9 @@ public class FilterConfig { FilterRegistrationBean registration = new FilterRegistrationBean(); registration.setDispatcherTypes(DispatcherType.REQUEST); registration.setFilter(new XssFilter()); - registration.addUrlPatterns(StringUtils.split(xssProperties.getUrlPatterns(), StringUtils.SEPARATOR)); + registration.addUrlPatterns("/*"); registration.setName("xssFilter"); registration.setOrder(FilterRegistrationBean.HIGHEST_PRECEDENCE); - Map initParameters = new HashMap<>(); - initParameters.put("excludes", xssProperties.getExcludes()); - registration.setInitParameters(initParameters); return registration; } diff --git a/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/properties/XssProperties.java b/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/properties/XssProperties.java index ecf4f33dc..bd3e59b17 100644 --- a/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/properties/XssProperties.java +++ b/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/properties/XssProperties.java @@ -3,6 +3,9 @@ package org.dromara.common.web.config.properties; import lombok.Data; import org.springframework.boot.context.properties.ConfigurationProperties; +import java.util.ArrayList; +import java.util.List; + /** * xss过滤 配置属性 * @@ -13,18 +16,13 @@ import org.springframework.boot.context.properties.ConfigurationProperties; public class XssProperties { /** - * 过滤开关 + * Xss开关 */ - private String enabled; + private Boolean enabled; /** - * 排除链接（多个用逗号分隔） + * 排除路径 */ - private String excludes; - - /** - * 匹配链接 - */ - private String urlPatterns; + private List excludeUrls = new ArrayList<>(); } diff --git a/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/filter/XssFilter.java b/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/filter/XssFilter.java index a6cbe8c58..95bcdd99a 100644 --- a/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/filter/XssFilter.java +++ b/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/filter/XssFilter.java @@ -1,6 +1,8 @@ package org.dromara.common.web.filter; +import org.dromara.common.core.utils.SpringUtils; import org.dromara.common.core.utils.StringUtils; +import org.dromara.common.web.config.properties.XssProperties; import org.springframework.http.HttpMethod; import jakarta.servlet.*; @@ -23,13 +25,8 @@ public class XssFilter implements Filter { @Override public void init(FilterConfig filterConfig) throws ServletException { - String tempExcludes = filterConfig.getInitParameter("excludes"); - if (StringUtils.isNotEmpty(tempExcludes)) { - String[] url = tempExcludes.split(StringUtils.SEPARATOR); - for (int i = 0; url != null && i < url.length; i++) { - excludes.add(url[i]); - } - } + XssProperties properties = SpringUtils.getBean(XssProperties.class); + excludes.addAll(properties.getExcludeUrls()); } @Override