package org.dromara.common.web.filter;
|
|
import cn.hutool.core.io.IoUtil;
|
import cn.hutool.core.map.MapUtil;
|
import cn.hutool.core.util.ArrayUtil;
|
import cn.hutool.core.util.StrUtil;
|
import cn.hutool.http.HtmlUtil;
|
import jakarta.servlet.ReadListener;
|
import jakarta.servlet.ServletInputStream;
|
import jakarta.servlet.http.HttpServletRequest;
|
import jakarta.servlet.http.HttpServletRequestWrapper;
|
import org.dromara.common.core.utils.StringUtils;
|
import org.springframework.http.HttpHeaders;
|
import org.springframework.http.MediaType;
|
|
import java.io.ByteArrayInputStream;
|
import java.io.IOException;
|
import java.nio.charset.StandardCharsets;
|
import java.util.HashMap;
|
import java.util.Map;
|
|
/**
|
* XSS过滤处理
|
*
|
* @author ruoyi
|
*/
|
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
|
/**
|
* @param request
|
*/
|
public XssHttpServletRequestWrapper(HttpServletRequest request) {
|
super(request);
|
}
|
|
@Override
|
public String getParameter(String name) {
|
String value = super.getParameter(name);
|
if (value == null) {
|
return null;
|
}
|
return HtmlUtil.cleanHtmlTag(value).trim();
|
}
|
|
@Override
|
public Map<String, String[]> getParameterMap() {
|
Map<String, String[]> valueMap = super.getParameterMap();
|
if (MapUtil.isEmpty(valueMap)) {
|
return valueMap;
|
}
|
// 避免某些容器不允许改参数的情况 copy一份重新改
|
Map<String, String[]> map = new HashMap<>(valueMap.size());
|
map.putAll(valueMap);
|
for (Map.Entry<String, String[]> entry : map.entrySet()) {
|
String[] values = entry.getValue();
|
if (values != null) {
|
int length = values.length;
|
String[] escapseValues = new String[length];
|
for (int i = 0; i < length; i++) {
|
// 防xss攻击和过滤前后空格
|
escapseValues[i] = HtmlUtil.cleanHtmlTag(values[i]).trim();
|
}
|
map.put(entry.getKey(), escapseValues);
|
}
|
}
|
return map;
|
}
|
|
@Override
|
public String[] getParameterValues(String name) {
|
String[] values = super.getParameterValues(name);
|
if (ArrayUtil.isEmpty(values)) {
|
return values;
|
}
|
int length = values.length;
|
String[] escapseValues = new String[length];
|
for (int i = 0; i < length; i++) {
|
// 防xss攻击和过滤前后空格
|
escapseValues[i] = HtmlUtil.cleanHtmlTag(values[i]).trim();
|
}
|
return escapseValues;
|
}
|
|
@Override
|
public ServletInputStream getInputStream() throws IOException {
|
// 非json类型，直接返回
|
if (!isJsonRequest()) {
|
return super.getInputStream();
|
}
|
|
// 为空，直接返回
|
String json = StrUtil.str(IoUtil.readBytes(super.getInputStream(), false), StandardCharsets.UTF_8);
|
if (StringUtils.isEmpty(json)) {
|
return super.getInputStream();
|
}
|
|
// xss过滤
|
json = HtmlUtil.cleanHtmlTag(json).trim();
|
byte[] jsonBytes = json.getBytes(StandardCharsets.UTF_8);
|
final ByteArrayInputStream bis = IoUtil.toStream(jsonBytes);
|
return new ServletInputStream() {
|
@Override
|
public boolean isFinished() {
|
return true;
|
}
|
|
@Override
|
public boolean isReady() {
|
return true;
|
}
|
|
@Override
|
public int available() throws IOException {
|
return jsonBytes.length;
|
}
|
|
@Override
|
public void setReadListener(ReadListener readListener) {
|
}
|
|
@Override
|
public int read() throws IOException {
|
return bis.read();
|
}
|
};
|
}
|
|
/**
|
* 是否是Json请求
|
*/
|
public boolean isJsonRequest() {
|
String header = super.getHeader(HttpHeaders.CONTENT_TYPE);
|
return StringUtils.startsWithIgnoreCase(header, MediaType.APPLICATION_JSON_VALUE);
|
}
|
}
|
