manager/my-worker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

增加参数 web.xssFilterExcludeUri

Browse Source
This commit is contained in:
thinkgem
2023-06-28 19:05:55 +08:00
parent e658f9e6f6
commit 0d24b71fe3
5 changed files with 62 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
common/src/main/java/com/jeesite/common/codec/EncodeUtils.java
View File

@@ -222,6 +222,10 @@ public class EncodeUtils {
* @author ThinkGem
*/
public static String xssFilter(String text, HttpServletRequest request) {
request = (request != null ? request : ServletUtils.getRequest());
if (request != null && StringUtils.containsAny(request.getRequestURI(), ServletUtils.XSS_FILE_EXCLUDE_URI)) {
return text;
}
String oriValue = StringUtils.trim(text);
if (text != null){
String value = oriValue;
@@ -237,8 +241,6 @@ public class EncodeUtils {
&& !StringUtils.contains(value, "id=\"FormHtml\"") // JFlow
&& !(StringUtils.startsWith(value, "{") && StringUtils.endsWith(value, "}")) // JSON Object
&& !(StringUtils.startsWith(value, "[") && StringUtils.endsWith(value, "]")) // JSON Array
&& !(StringUtils.containsAny((request != null ? request : ServletUtils.getRequest())
.getRequestURI(), "/ureport/", "/visual/")) // UReport、Visual
){
StringBuilder sb = new StringBuilder();
for (int i = 0; i < value.length(); i++) {
@@ -293,6 +295,7 @@ public class EncodeUtils {
public static String sqlFilter(String text){
return sqlFilter(text, "common");
}
/**
* SQL过滤，防止注入，传入参数输入有select相关代码，替换空。
* @author ThinkGem

9
common/src/main/java/com/jeesite/common/web/http/ServletUtils.java
View File

@@ -38,6 +38,9 @@ public class ServletUtils {
private static final String[] STATIC_FILE = StringUtils.splitComma(PROPS.getProperty("web.staticFile"));
private static final String[] STATIC_FILE_EXCLUDE_URI = StringUtils.splitComma(PROPS.getProperty("web.staticFileExcludeUri"));
// XSS 过滤器要排除的URI地址
public static final String[] XSS_FILE_EXCLUDE_URI = StringUtils.splitComma(PROPS.getProperty("web.xssFilterExcludeUri"));
// AJAX 请求参数和请求头名
public static final String AJAX_PARAM_NAME = PROPS.getProperty("web.ajaxParamName", "__ajax");
public static final String AJAX_HEADER_NAME = PROPS.getProperty("web.ajaxHeaderName", "x-ajax");
@@ -125,13 +128,9 @@ public class ServletUtils {
e.printStackTrace();
}
}
if (STATIC_FILE_EXCLUDE_URI != null){
for (String s : STATIC_FILE_EXCLUDE_URI){
if (StringUtils.contains(uri, s)){
if (StringUtils.containsAny(uri, STATIC_FILE_EXCLUDE_URI)) {
return false;
}
}
}
if (StringUtils.endsWithAny(uri, STATIC_FILE)){
return true;
}

3
modules/core/src/main/resources/config/jeesite-core.yml
View File

@@ -646,6 +646,9 @@ web:
# 严格模式（更严格的数据安全验证）
strictMode: false
# 所有请求信息将进行xss过滤，这里列出不被xss过滤的地址
xssFilterExcludeUri: /ureport/,/visual/
# 自定义正则表达式验证（主键、登录名）
validator:
id: '[a-zA-Z0-9_\-/#\u4e00-\u9fa5]{0,64}'

3
web-api/src/main/resources/config/application.yml
View File

@@ -787,6 +787,9 @@ web:
# # 严格模式（更严格的数据安全验证）
# strictMode: false
#
# # 所有请求信息将进行xss过滤，这里列出不被xss过滤的地址
# xssFilterExcludeUri: /ureport/,/visual/
#
# # 自定义正则表达式验证（主键、登录名）
# validator:
# id: '[a-zA-Z0-9_\-/#\u4e00-\u9fa5]{0,64}'

3
web/src/main/resources/config/application.yml
View File

@@ -787,6 +787,9 @@ web:
# # 严格模式（更严格的数据安全验证）
# strictMode: false
#
# # 所有请求信息将进行xss过滤，这里列出不被xss过滤的地址
# xssFilterExcludeUri: /ureport/,/visual/
#
# # 自定义正则表达式验证（主键、登录名）
# validator:
# id: '[a-zA-Z0-9_\-/#\u4e00-\u9fa5]{0,64}'