From 38916dda25765e74f0e555767bc530fdd0bbcb8d Mon Sep 17 00:00:00 2001 From: PIGAI Date: Fri, 26 Sep 2025 17:41:44 +0800 Subject: [PATCH] =?UTF-8?q?feat(security):=20=E6=96=B0=E5=A2=9E=E5=8D=95?= =?UTF-8?q?=E4=BD=93=E6=9E=B6=E6=9E=84=E4=B8=8B=E5=86=85=E9=83=A8=E8=AF=B7?= =?UTF-8?q?=E6=B1=82=E5=A4=B4=E5=AE=89=E5=85=A8=E8=BF=87=E6=BB=A4=E6=9C=BA?= =?UTF-8?q?=E5=88=B6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 添加PigxInnerHeaderRemoveFilter类用于防止前端伪造inner header - 实现基于IP地址和FROM请求头的访问控制逻辑 - 在AutoConfiguration中注册过滤器配置 - 添加hutool-extra依赖支持IP地址工具类 --- pigx-common/pigx-common-security/pom.xml | 4 ++ .../PigxInnerHeaderRemoveFilter.java | 62 +++++++++++++++++++ ...ot.autoconfigure.AutoConfiguration.imports | 1 + 3 files changed, 67 insertions(+) create mode 100644 pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxInnerHeaderRemoveFilter.java diff --git a/pigx-common/pigx-common-security/pom.xml b/pigx-common/pigx-common-security/pom.xml index 9e067bbbd..585e9ba48 100644 --- a/pigx-common/pigx-common-security/pom.xml +++ b/pigx-common/pigx-common-security/pom.xml @@ -43,6 +43,10 @@ cn.hutool hutool-http + + cn.hutool + hutool-extra + org.springframework.security diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxInnerHeaderRemoveFilter.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxInnerHeaderRemoveFilter.java new file mode 100644 index 000000000..504eb1ed0 --- /dev/null +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxInnerHeaderRemoveFilter.java @@ -0,0 +1,62 @@ +package com.pig4cloud.pigx.common.security.component; + +import cn.hutool.core.net.Ipv4Util; +import cn.hutool.core.util.StrUtil; +import cn.hutool.extra.servlet.JakartaServletUtil; +import com.pig4cloud.pigx.common.core.constant.SecurityConstants; +import jakarta.servlet.FilterChain; +import jakarta.servlet.ServletException; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; +import lombok.extern.slf4j.Slf4j; +import org.jetbrains.annotations.NotNull; +import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; +import org.springframework.http.HttpStatus; +import org.springframework.web.filter.OncePerRequestFilter; + +import java.io.IOException; + +/** + * 避免前端请求伪造 inner header 直接进行服务调用，但又没有按要求配置nginx 过滤 + *

+ * 仅针对单体架构下生效，微服务架构下网关已经做了过滤 + * + * @author lengleng + * @date 2025/09/26 + */ +@Slf4j +@ConditionalOnProperty(value = "security.micro", havingValue = "false") +public class PigxInnerHeaderRemoveFilter extends OncePerRequestFilter { + + /** + * 执行过滤器内部处理逻辑 + * + * @param request HTTP请求对象 + * @param response HTTP响应对象 + * @param filterChain 过滤器链 + * @throws ServletException 如果发生servlet相关异常 + * @throws IOException 如果发生I/O异常 + */ + @Override + protected void doFilterInternal(HttpServletRequest request, @NotNull HttpServletResponse response, @NotNull FilterChain filterChain) throws ServletException, IOException { + // 获取客户端IP地址 + String clientIP = JakartaServletUtil.getClientIP(request); + + // 允许 127.0.0.1 请求直接通过 + if (Ipv4Util.LOCAL_IP.equals(clientIP)) { + filterChain.doFilter(request, response); + return; + } + + String fromHeader = request.getHeader(SecurityConstants.FROM); + // 非 127.0.0.1 请求，没有配置 from header ，直接跳过 + if (StrUtil.isBlank(fromHeader)) { + filterChain.doFilter(request, response); + return; + } + + // 非 127.0.0.1，配置了 from header ，直接拒绝访问 + log.warn("请求 IP {}，疑似进行系统注入操作，请注意", clientIP); + response.setStatus(HttpStatus.FORBIDDEN.value()); + } +} diff --git a/pigx-common/pigx-common-security/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/pigx-common/pigx-common-security/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports index eac267c60..a5ea77dac 100644 --- a/pigx-common/pigx-common-security/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports +++ b/pigx-common/pigx-common-security/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports @@ -5,5 +5,6 @@ com.pig4cloud.pigx.common.security.service.PigxTocMobileUserDetailsServiceImpl com.pig4cloud.pigx.common.security.service.PigxRedisOAuth2AuthorizationService com.pig4cloud.pigx.common.security.service.PigxRedisOAuth2AuthorizationConsentService com.pig4cloud.pigx.common.security.component.PigxSecurityInnerAspect +com.pig4cloud.pigx.common.security.component.PigxInnerHeaderRemoveFilter com.pig4cloud.pigx.common.security.component.PigxSecurityMessageSourceConfiguration com.pig4cloud.pigx.common.security.service.PigxRemoteRegisteredClientRepository