From fc72b670908bc0d9b00a8e9aa7e36499055e792d Mon Sep 17 00:00:00 2001
From: 疯狂的狮子Li <15040126243@163.com>
Date: 星期五, 13 九月 2024 18:02:44 +0800
Subject: [PATCH] update 优化 全局开启xss过滤 提高安全性 与cloud版本保持一致
---
ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/FilterConfig.java | 11 ++---------
ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/filter/XssFilter.java | 11 ++++-------
ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/properties/XssProperties.java | 16 +++++++---------
ruoyi-admin/src/main/resources/application.yml | 7 ++++---
4 files changed, 17 insertions(+), 28 deletions(-)
diff --git a/ruoyi-admin/src/main/resources/application.yml b/ruoyi-admin/src/main/resources/application.yml
index 5d94bef..82d0f1e 100644
--- a/ruoyi-admin/src/main/resources/application.yml
+++ b/ruoyi-admin/src/main/resources/application.yml
@@ -223,9 +223,10 @@
# 杩囨护寮�鍏�
enabled: true
# 鎺掗櫎閾炬帴锛堝涓敤閫楀彿鍒嗛殧锛�
- excludes: /system/notice
- # 鍖归厤閾炬帴
- urlPatterns: /system/*,/monitor/*,/tool/*
+ excludeUrls:
+ - /system/notice
+ - /workflow/model/save
+ - /workflow/model/editModelXml
# 鍏ㄥ眬绾跨▼姹犵浉鍏抽厤缃�
# 濡備娇鐢↗DK21璇风洿鎺ヤ娇鐢ㄨ櫄鎷熺嚎绋� 涓嶈寮�鍚閰嶇疆
diff --git a/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/FilterConfig.java b/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/FilterConfig.java
index 91fff76..bc27d6f 100644
--- a/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/FilterConfig.java
+++ b/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/FilterConfig.java
@@ -1,18 +1,14 @@
package org.dromara.common.web.config;
-import org.dromara.common.core.utils.StringUtils;
+import jakarta.servlet.DispatcherType;
import org.dromara.common.web.config.properties.XssProperties;
import org.dromara.common.web.filter.RepeatableFilter;
import org.dromara.common.web.filter.XssFilter;
-import jakarta.servlet.DispatcherType;
import org.springframework.boot.autoconfigure.AutoConfiguration;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
-
-import java.util.HashMap;
-import java.util.Map;
/**
* Filter閰嶇疆
@@ -30,12 +26,9 @@
FilterRegistrationBean registration = new FilterRegistrationBean();
registration.setDispatcherTypes(DispatcherType.REQUEST);
registration.setFilter(new XssFilter());
- registration.addUrlPatterns(StringUtils.split(xssProperties.getUrlPatterns(), StringUtils.SEPARATOR));
+ registration.addUrlPatterns("/*");
registration.setName("xssFilter");
registration.setOrder(FilterRegistrationBean.HIGHEST_PRECEDENCE);
- Map<String, String> initParameters = new HashMap<>();
- initParameters.put("excludes", xssProperties.getExcludes());
- registration.setInitParameters(initParameters);
return registration;
}
diff --git a/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/properties/XssProperties.java b/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/properties/XssProperties.java
index ecf4f33..bd3e59b 100644
--- a/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/properties/XssProperties.java
+++ b/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/properties/XssProperties.java
@@ -3,6 +3,9 @@
import lombok.Data;
import org.springframework.boot.context.properties.ConfigurationProperties;
+import java.util.ArrayList;
+import java.util.List;
+
/**
* xss杩囨护 閰嶇疆灞炴��
*
@@ -13,18 +16,13 @@
public class XssProperties {
/**
- * 杩囨护寮�鍏�
+ * Xss寮�鍏�
*/
- private String enabled;
+ private Boolean enabled;
/**
- * 鎺掗櫎閾炬帴锛堝涓敤閫楀彿鍒嗛殧锛�
+ * 鎺掗櫎璺緞
*/
- private String excludes;
-
- /**
- * 鍖归厤閾炬帴
- */
- private String urlPatterns;
+ private List<String> excludeUrls = new ArrayList<>();
}
diff --git a/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/filter/XssFilter.java b/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/filter/XssFilter.java
index a6cbe8c..95bcdd9 100644
--- a/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/filter/XssFilter.java
+++ b/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/filter/XssFilter.java
@@ -1,6 +1,8 @@
package org.dromara.common.web.filter;
+import org.dromara.common.core.utils.SpringUtils;
import org.dromara.common.core.utils.StringUtils;
+import org.dromara.common.web.config.properties.XssProperties;
import org.springframework.http.HttpMethod;
import jakarta.servlet.*;
@@ -23,13 +25,8 @@
@Override
public void init(FilterConfig filterConfig) throws ServletException {
- String tempExcludes = filterConfig.getInitParameter("excludes");
- if (StringUtils.isNotEmpty(tempExcludes)) {
- String[] url = tempExcludes.split(StringUtils.SEPARATOR);
- for (int i = 0; url != null && i < url.length; i++) {
- excludes.add(url[i]);
- }
- }
+ XssProperties properties = SpringUtils.getBean(XssProperties.class);
+ excludes.addAll(properties.getExcludeUrls());
}
@Override
--
Gitblit v1.9.3