- * 1. XSS过滤 - * 2. body重复读 - */ -@Slf4j -public class RequestWrapper extends HttpServletRequestWrapper { - private final byte[] body; - - RequestWrapper(HttpServletRequest request) { - super(request); - this.body = getByteBody(request); - } - - @Override - public BufferedReader getReader() { - return ObjectUtils.isEmpty(body) ? null - : new BufferedReader(new InputStreamReader(getInputStream())); - } - - @Override - public ServletInputStream getInputStream() { - final ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(body); - return new ServletInputStream() { - @Override - public boolean isFinished() { - return false; - } - - @Override - public boolean isReady() { - return false; - } - - @Override - public void setReadListener(ReadListener readListener) { - - } - - @Override - public int read() { - return byteArrayInputStream.read(); - } - }; - } - - @Override - public String[] getParameterValues(String name) { - String[] values = super.getParameterValues(name); - if (values == null) { - return null; - } - int count = values.length; - String[] encodedValues = new String[count]; - for (int i = 0; i < count; i++) { - encodedValues[i] = HtmlUtils.htmlEscape(values[i]); - } - return encodedValues; - } - - @Override - public String getParameter(String name) { - String value = super.getParameter(name); - if (value == null) { - return null; - } - return HtmlUtils.htmlEscape(value); - } - - @Override - public Object getAttribute(String name) { - Object value = super.getAttribute(name); - if (value instanceof String) { - HtmlUtils.htmlEscape((String) value); - } - return value; - } - - @Override - public String getHeader(String name) { - String value = super.getHeader(name); - if (value == null) { - return null; - } - return HtmlUtils.htmlEscape(value); - } - - @Override - public String getQueryString() { - String value = super.getQueryString(); - if (value == null) { - return null; - } - return HtmlUtils.htmlEscape(value); - } - - private static byte[] getByteBody(HttpServletRequest request) { - byte[] body = new byte[0]; - try { - body = StreamUtils.copyToByteArray(request.getInputStream()); - } catch (IOException e) { - log.error("解析流中数据异常", e); - } - return body; - } -} diff --git a/pigx-common/pigx-common-core/src/main/java/com/pig4cloud/pigx/common/core/xss/RequestWrapperFilter.java b/pigx-common/pigx-common-core/src/main/java/com/pig4cloud/pigx/common/core/xss/RequestWrapperFilter.java deleted file mode 100644 index a85833b4d..000000000 --- a/pigx-common/pigx-common-core/src/main/java/com/pig4cloud/pigx/common/core/xss/RequestWrapperFilter.java +++ /dev/null @@ -1,44 +0,0 @@ -/* - * Copyright (c) 2018-2025, lengleng All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions are met: - * - * Redistributions of source code must retain the above copyright notice, - * this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * Neither the name of the pig4cloud.com developer nor the names of its - * contributors may be used to endorse or promote products derived from - * this software without specific prior written permission. - * Author: lengleng (wangiegie@gmail.com) - */ - -package com.pig4cloud.pigx.common.core.xss; - -import org.springframework.lang.NonNull; -import org.springframework.web.filter.OncePerRequestFilter; - -import javax.servlet.FilterChain; -import javax.servlet.ServletException; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import java.io.IOException; - -/** - * @author lengleng - * @date 2019-08-13 - *
- * request 处理过滤器 - */ -public class RequestWrapperFilter extends OncePerRequestFilter { - - @Override - protected void doFilterInternal(@NonNull HttpServletRequest request, - @NonNull HttpServletResponse response, - @NonNull FilterChain filterChain) - throws ServletException, IOException { - filterChain.doFilter(new RequestWrapper(request), response); - } -} \ No newline at end of file diff --git a/pigx-common/pigx-common-core/src/main/resources/META-INF/spring.factories b/pigx-common/pigx-common-core/src/main/resources/META-INF/spring.factories index 9499b6652..8bdf5ad3b 100644 --- a/pigx-common/pigx-common-core/src/main/resources/META-INF/spring.factories +++ b/pigx-common/pigx-common-core/src/main/resources/META-INF/spring.factories @@ -2,5 +2,4 @@ org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ com.pig4cloud.pigx.common.core.config.JacksonConfig,\ com.pig4cloud.pigx.common.core.config.MessageSourceConfig,\ com.pig4cloud.pigx.common.core.config.RestTemplateConfig,\ - com.pig4cloud.pigx.common.core.util.SpringContextHolder,\ - com.pig4cloud.pigx.common.core.xss.RequestWrapperFilter + com.pig4cloud.pigx.common.core.util.SpringContextHolder