✨ Introducing new features. #1985 引入 Mica-XSS 插件，避免 element 部分xss 脚本未转义攻击问题

da1569fbb4

pigx-common/pigx-common-bom/pom.xml

@@ -20,13 +20,13 @@
 		<pigx.version>3.10.0</pigx.version>
 		<mybatis-plus.version>3.4.0</mybatis-plus.version>
 		<dynamic-ds.version>3.2.0</dynamic-ds.version>
-		<mica.version>2.0.8-GA</mica.version>
 		<druid.version>1.2.3</druid.version>
 		<mysql.connector.version>8.0.22</mysql.connector.version>
 		<swagger.core.version>1.5.22</swagger.core.version>
 		<mp.weixin.version>3.9.0</mp.weixin.version>
 		<ijpay.version>2.7.0</ijpay.version>
 		<groovy.version>3.0.3</groovy.version>
+		<jsoup.version>1.13.1</jsoup.version>
 		<security.oauth.version>2.3.6.RELEASE</security.oauth.version>
 		<fastjson.version>1.2.73</fastjson.version>
 		<aliyun.version>3.0.52.ALL</aliyun.version>
@@ -112,6 +112,11 @@
 				<artifactId>pigx-common-test</artifactId>
 				<version>${pigx.version}</version>
 			</dependency>
+			<dependency>
+				<groupId>com.pig4cloud</groupId>
+				<artifactId>pigx-common-xss</artifactId>
+				<version>${pigx.version}</version>
+			</dependency>
 			<dependency>
 				<groupId>com.pig4cloud</groupId>
 				<artifactId>pigx-upms-api</artifactId>
@@ -202,11 +207,11 @@
 				<artifactId>spring-security-oauth2</artifactId>
 				<version>${security.oauth.version}</version>
 			</dependency>
-			<!--xss 过滤组件-->
+			<!--jsoup html 解析组件-->
 			<dependency>
-				<groupId>net.dreamlu</groupId>
-				<artifactId>mica-xss</artifactId>
-				<version>${mica.version}</version>
+				<groupId>org.jsoup</groupId>
+				<artifactId>jsoup</artifactId>
+				<version>${jsoup.version}</version>
 			</dependency>
 		</dependencies>
 	</dependencyManagement>

pigx-common/pigx-common-security/pom.xml

@@ -58,10 +58,10 @@
 			<groupId>org.springframework.data</groupId>
 			<artifactId>spring-data-redis</artifactId>
 		</dependency>
-		<!--xss 安全过滤-->
-		<dependency>
-			<groupId>net.dreamlu</groupId>
-			<artifactId>mica-xss</artifactId>
-		</dependency>
-	</dependencies>
+		<!--upms fegin 调用相关工具类-->
+        <dependency>
+            <groupId>com.pig4cloud</groupId>
+            <artifactId>pigx-upms-api</artifactId>
+        </dependency>
+    </dependencies>
 </project>

pigx-common/pigx-common-xss/pom.xml

@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+		 xmlns="http://maven.apache.org/POM/4.0.0"
+		 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.pig4cloud</groupId>
+		<artifactId>pigx-common</artifactId>
+		<version>3.10.0</version>
+	</parent>
+
+	<artifactId>pigx-common-xss</artifactId>
+	<packaging>jar</packaging>
+
+	<description>pigx xss 安全过滤插件 基于 JSOUP</description>
+
+	<dependencies>
+		<dependency>
+			<groupId>cn.hutool</groupId>
+			<artifactId>hutool-core</artifactId>
+			<version>${hutool.version}</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.jsoup</groupId>
+			<artifactId>jsoup</artifactId>
+		</dependency>
+
+		<dependency>
+			<groupId>org.springframework</groupId>
+			<artifactId>spring-webmvc</artifactId>
+		</dependency>
+
+		<dependency>
+			<groupId>com.fasterxml.jackson.core</groupId>
+			<artifactId>jackson-databind</artifactId>
+		</dependency>
+
+		<dependency>
+			<groupId>javax.servlet</groupId>
+			<artifactId>javax.servlet-api</artifactId>
+			<scope>provided</scope>
+		</dependency>
+	</dependencies>
+</project>

pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/PigxXssAutoConfiguration.java

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net).
+ * <p>
+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0;
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * <p>
+ * http://www.gnu.org/licenses/lgpl.html
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.pig4cloud.pigx.common.xss;
+
+import com.pig4cloud.pigx.common.xss.config.PigxXssProperties;
+import com.pig4cloud.pigx.common.xss.core.FormXssClean;
+import com.pig4cloud.pigx.common.xss.core.JacksonXssClean;
+import com.pig4cloud.pigx.common.xss.core.XssCleanInterceptor;
+import lombok.RequiredArgsConstructor;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.autoconfigure.jackson.Jackson2ObjectMapperBuilderCustomizer;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.Ordered;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+/**
+ * jackson xss 配置
+ *
+ * @author L.cm
+ */
+@RequiredArgsConstructor
+@Configuration(proxyBeanMethods = false)
+@EnableConfigurationProperties(PigxXssProperties.class)
+@ConditionalOnProperty(value = "security.xss.enabled", havingValue = "true", matchIfMissing = true)
+public class PigxXssAutoConfiguration implements WebMvcConfigurer {
+
+	private final PigxXssProperties xssProperties;
+
+	@Bean
+	public FormXssClean formXssClean() {
+		return new FormXssClean();
+	}
+
+	@Bean
+	public Jackson2ObjectMapperBuilderCustomizer xssJacksonCustomizer() {
+		return builder -> builder.deserializerByType(String.class, new JacksonXssClean());
+	}
+
+	@Override
+	public void addInterceptors(InterceptorRegistry registry) {
+		XssCleanInterceptor interceptor = new XssCleanInterceptor(xssProperties);
+		registry.addInterceptor(interceptor).addPathPatterns(xssProperties.getPathPatterns())
+				.excludePathPatterns(xssProperties.getExcludePatterns()).order(Ordered.LOWEST_PRECEDENCE);
+	}
+
+}

pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/config/PigxXssProperties.java

@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net).
+ * <p>
+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0;
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * <p>
+ * http://www.gnu.org/licenses/lgpl.html
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.pig4cloud.pigx.common.xss.config;
+
+import cn.hutool.core.collection.CollUtil;
+import lombok.Getter;
+import lombok.Setter;
+import org.springframework.beans.factory.InitializingBean;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Xss配置类
+ *
+ * @author L.cm
+ */
+@Getter
+@Setter
+@ConfigurationProperties("security.xss")
+public class PigxXssProperties implements InitializingBean {
+
+	/**
+	 * 开启xss
+	 */
+	private boolean enabled = true;
+
+	/**
+	 * 拦截的路由，默认拦截 /**
+	 */
+	private List<String> pathPatterns = new ArrayList<>();
+
+	/**
+	 * 放行的规则，默认为空
+	 */
+	private List<String> excludePatterns = new ArrayList<>();
+
+	@Override
+	public void afterPropertiesSet() {
+		if (CollUtil.isEmpty(pathPatterns)) {
+			pathPatterns.add("/**");
+		}
+	}
+
+}

pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/FormXssClean.java

@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net).
+ * <p>
+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0;
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * <p>
+ * http://www.gnu.org/licenses/lgpl.html
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.pig4cloud.pigx.common.xss.core;
+
+import cn.hutool.core.util.StrUtil;
+import com.pig4cloud.pigx.common.xss.utils.XssUtil;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.web.bind.WebDataBinder;
+import org.springframework.web.bind.annotation.ControllerAdvice;
+import org.springframework.web.bind.annotation.InitBinder;
+
+import java.beans.PropertyEditorSupport;
+
+/**
+ * 表单 xss 处理
+ *
+ * @author L.cm
+ */
+@ControllerAdvice
+public class FormXssClean {
+
+	@InitBinder
+	public void initBinder(WebDataBinder binder) {
+		// 处理前端传来的表单字符串
+		binder.registerCustomEditor(String.class, new StringPropertiesEditor());
+	}
+
+	@Slf4j
+	public static class StringPropertiesEditor extends PropertyEditorSupport {
+
+		@Override
+		public String getAsText() {
+			Object value = getValue();
+			return value != null ? value.toString() : StrUtil.EMPTY;
+		}
+
+		@Override
+		public void setAsText(String text) throws IllegalArgumentException {
+			if (text == null) {
+				setValue(null);
+			}
+			else if (XssHolder.isEnabled()) {
+				String value = XssUtil.clean(text);
+				setValue(value);
+				log.trace("Request parameter value:{} cleaned up by mica-xss, current value is:{}.", text, value);
+			}
+			else {
+				setValue(text);
+			}
+		}
+
+	}
+
+}

pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/JacksonXssClean.java

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net).
+ * <p>
+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0;
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * <p>
+ * http://www.gnu.org/licenses/lgpl.html
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.pig4cloud.pigx.common.xss.core;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import com.pig4cloud.pigx.common.xss.utils.XssUtil;
+import lombok.extern.slf4j.Slf4j;
+
+import java.io.IOException;
+
+/**
+ * jackson xss 处理
+ *
+ * @author L.cm
+ */
+@Slf4j
+public class JacksonXssClean extends JsonDeserializer<String> {
+
+	@Override
+	public String deserialize(JsonParser p, DeserializationContext ctxt) throws IOException {
+		// XSS filter
+		String text = p.getValueAsString();
+		if (text == null) {
+			return null;
+		}
+		else if (XssHolder.isEnabled()) {
+			String value = XssUtil.clean(text);
+			log.trace("Json property value:{} cleaned up by mica-xss, current value is:{}.", text, value);
+			return value;
+		}
+		else {
+			return text;
+		}
+	}
+
+}

pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssCleanIgnore.java

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net).
+ * <p>
+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0;
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * <p>
+ * http://www.gnu.org/licenses/lgpl.html
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.pig4cloud.pigx.common.xss.core;
+
+import java.lang.annotation.*;
+
+/**
+ * 忽略 xss
+ *
+ * @author L.cm
+ */
+@Target({ ElementType.TYPE, ElementType.METHOD })
+@Retention(RetentionPolicy.RUNTIME)
+@Documented
+public @interface XssCleanIgnore {
+
+}

pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssCleanInterceptor.java

@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net).
+ * <p>
+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0;
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * <p>
+ * http://www.gnu.org/licenses/lgpl.html
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.pig4cloud.pigx.common.xss.core;
+
+import cn.hutool.core.util.StrUtil;
+import com.pig4cloud.pigx.common.xss.config.PigxXssProperties;
+import lombok.RequiredArgsConstructor;
+import org.springframework.core.annotation.AnnotationUtils;
+import org.springframework.http.HttpMethod;
+import org.springframework.web.method.HandlerMethod;
+import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * xss 处理拦截器
+ *
+ * @author L.cm
+ */
+@RequiredArgsConstructor
+public class XssCleanInterceptor extends HandlerInterceptorAdapter {
+
+	private final PigxXssProperties xssProperties;
+
+	@Override
+	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
+			throws Exception {
+		// 1. 没有开启
+		if (!xssProperties.isEnabled()) {
+			return true;
+		}
+
+		// 2. 非控制器请求直接跳出
+		if (!(handler instanceof HandlerMethod)) {
+			return true;
+		}
+
+		// 3. 只过滤 POST PUT
+		if (!StrUtil.equalsAnyIgnoreCase(request.getMethod(), HttpMethod.POST.name(), HttpMethod.PUT.name())) {
+			return true;
+		}
+
+		// 4. 处理 XssIgnore 注解
+		HandlerMethod handlerMethod = (HandlerMethod) handler;
+		XssCleanIgnore xssCleanIgnore = AnnotationUtils.findAnnotation(handlerMethod.getMethod(), XssCleanIgnore.class);
+		if (xssCleanIgnore == null) {
+			XssHolder.setEnable();
+		}
+		return true;
+	}
+
+	@Override
+	public void afterConcurrentHandlingStarted(HttpServletRequest request, HttpServletResponse response,
+			Object handler) {
+		XssHolder.remove();
+	}
+
+}

pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssHolder.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net).
+ * <p>
+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0;
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * <p>
+ * http://www.gnu.org/licenses/lgpl.html
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.pig4cloud.pigx.common.xss.core;
+
+/**
+ * 利用 ThreadLocal 缓存线程间的数据
+ *
+ * @author L.cm
+ */
+class XssHolder {
+
+	private static final ThreadLocal<Boolean> TL = new ThreadLocal<>();
+
+	public static boolean isEnabled() {
+		return Boolean.TRUE.equals(TL.get());
+	}
+
+	public static void setEnable() {
+		TL.set(Boolean.TRUE);
+	}
+
+	public static void remove() {
+		TL.remove();
+	}
+
+}

pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/utils/XssUtil.java

@@ -0,0 +1,111 @@
+/**
+ * Copyright (c) 2016-2020, Michael Yang 杨福海 (fuhai999@gmail.com).
+ * <p>
+ * Licensed under the GNU Lesser General Public License (LGPL) ,Version 3.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * <p>
+ * http://www.gnu.org/licenses/lgpl-3.0.txt
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.pig4cloud.pigx.common.xss.utils;
+
+import org.jsoup.Jsoup;
+import org.jsoup.nodes.Attribute;
+import org.jsoup.nodes.Element;
+import org.springframework.util.StringUtils;
+
+/**
+ * xss clean
+ *
+ * <p>
+ * 参考自 jpress：https://gitee.com/fuhai/jpress
+ * </p>
+ *
+ * @author L.cm
+ * @author michael
+ */
+public class XssUtil {
+
+	private static HtmlWhitelist whitelist = new HtmlWhitelist();
+
+	/**
+	 * xss 清理
+	 * @param html html
+	 * @return 清理后的 html
+	 */
+	public static String clean(String html) {
+		if (StringUtils.hasText(html)) {
+			return Jsoup.clean(html, whitelist);
+		}
+		return html;
+	}
+
+	/**
+	 * 做自己的白名单，允许base64的图片通过等
+	 *
+	 * @author michael
+	 */
+	public static class HtmlWhitelist extends org.jsoup.safety.Whitelist {
+
+		public HtmlWhitelist() {
+			addTags("a", "b", "blockquote", "br", "caption", "cite", "code", "col", "colgroup", "dd", "div", "span",
+					"embed", "object", "dl", "dt", "em", "h1", "h2", "h3", "h4", "h5", "h6", "i", "img", "li", "ol",
+					"p", "pre", "q", "small", "strike", "strong", "sub", "sup", "table", "tbody", "td", "tfoot", "th",
+					"thead", "tr", "u", "ul");
+
+			addAttributes("a", "href", "title", "target");
+			addAttributes("blockquote", "cite");
+			addAttributes("col", "span");
+			addAttributes("colgroup", "span");
+			addAttributes("img", "align", "alt", "src", "title");
+			addAttributes("ol", "start");
+			addAttributes("q", "cite");
+			addAttributes("table", "summary");
+			addAttributes("td", "abbr", "axis", "colspan", "rowspan", "width");
+			addAttributes("th", "abbr", "axis", "colspan", "rowspan", "scope", "width");
+			addAttributes("video", "src", "autoplay", "controls", "loop", "muted", "poster", "preload");
+			addAttributes("object", "width", "height", "classid", "codebase");
+			addAttributes("param", "name", "value");
+			addAttributes("embed", "src", "quality", "width", "height", "allowFullScreen", "allowScriptAccess",
+					"flashvars", "name", "type", "pluginspage");
+
+			addAttributes(":all", "class", "style", "height", "width", "type", "id", "name");
+
+			addProtocols("blockquote", "cite", "http", "https");
+			addProtocols("cite", "cite", "http", "https");
+			addProtocols("q", "cite", "http", "https");
+
+			// 如果添加以下的协议，那么href 必须是http、 https 等开头，相对路径则被过滤掉了
+			// addProtocols("a", "href", "ftp", "http", "https", "mailto", "tel");
+
+			// 如果添加以下的协议，那么src必须是http 或者 https 开头，相对路径则被过滤掉了，
+			// 所以必须注释掉，允许相对路径的图片资源
+			// addProtocols("img", "src", "http", "https");
+		}
+
+		@Override
+		protected boolean isSafeAttribute(String tagName, Element el, Attribute attr) {
+			// 不允许 javascript 开头的 src 和 href
+			if ("src".equalsIgnoreCase(attr.getKey()) || "href".equalsIgnoreCase(attr.getKey())) {
+				String value = attr.getValue();
+				if (StringUtils.hasText(value) && value.toLowerCase().startsWith("javascript")) {
+					return false;
+				}
+			}
+			// 允许 base64 的图片内容
+			if ("img".equals(tagName) && "src".equals(attr.getKey()) && attr.getValue().startsWith("data:;base64")) {
+				return true;
+			}
+			return super.isSafeAttribute(tagName, el, attr);
+		}
+
+	}
+
+}

pigx-common/pigx-common-xss/src/main/resources/META-INF/spring.factories

@@ -0,0 +1,2 @@
+org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
+  com.pig4cloud.pigx.common.xss.PigxXssAutoConfiguration

pigx-common/pom.xml

@@ -49,5 +49,6 @@
 		<module>pigx-common-swagger</module>
 		<module>pigx-common-test</module>
 		<module>pigx-common-transaction</module>
+		<module>pigx-common-xss</module>
 	</modules>
 </project>

pigx-upms/pigx-upms-biz/pom.xml

@@ -72,6 +72,11 @@
 			<groupId>com.pig4cloud</groupId>
 			<artifactId>pigx-common-security</artifactId>
 		</dependency>
+		<!--XSS 安全过滤-->
+		<dependency>
+			<groupId>com.pig4cloud</groupId>
+			<artifactId>pigx-common-xss</artifactId>
+		</dependency>
 		<!--支持动态路由配置 -->
 		<dependency>
 			<groupId>com.pig4cloud</groupId>

pigx-visual/pigx-codegen/pom.xml

@@ -60,6 +60,10 @@
 			<artifactId>pigx-common-swagger</artifactId>
 		</dependency>
 		<!--安全模块-->
+		<dependency>
+			<groupId>com.pig4cloud</groupId>
+			<artifactId>pigx-common-xss</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>com.pig4cloud</groupId>
 			<artifactId>pigx-common-security</artifactId>

pigx-visual/pigx-mp-platform/pom.xml

@@ -55,6 +55,10 @@
 			<artifactId>pigx-common-swagger</artifactId>
 		</dependency>
 		<!--安全模块-->
+		<dependency>
+			<groupId>com.pig4cloud</groupId>
+			<artifactId>pigx-common-xss</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>com.pig4cloud</groupId>
 			<artifactId>pigx-common-security</artifactId>

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxPortalController.java

@@ -4,16 +4,14 @@ import cn.hutool.core.util.StrUtil;
 import com.pig4cloud.pigx.common.core.constant.SecurityConstants;
 import com.pig4cloud.pigx.common.data.tenant.TenantBroker;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
+import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore;
 import com.pig4cloud.pigx.mp.config.WxMpContextHolder;
 import com.pig4cloud.pigx.mp.config.WxMpInitConfigRunner;
-import com.pig4cloud.pigx.mp.service.WxAccountService;
 import lombok.AllArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import me.chanjar.weixin.mp.api.WxMpService;
 import me.chanjar.weixin.mp.bean.message.WxMpXmlMessage;
 import me.chanjar.weixin.mp.bean.message.WxMpXmlOutMessage;
-import net.dreamlu.mica.xss.core.XssCleanIgnore;
-import org.apache.commons.lang3.StringUtils;
 import org.springframework.web.bind.annotation.*;
 
 /**
@@ -29,8 +27,6 @@ import org.springframework.web.bind.annotation.*;
 @RequestMapping("/{appId}/portal")
 public class WxPortalController {
 
-	private final WxAccountService accountService;
-
 	/**
 	 * 微信接入校验处理
 	 * @param appId 多公众号标志位
@@ -50,7 +46,7 @@ public class WxPortalController {
 
 		log.info("接收到来自微信服务器的认证消息：[{}, {}, {}, {}]", signature, timestamp, nonce, echostr);
 
-		if (StringUtils.isAnyBlank(signature, timestamp, nonce, echostr)) {
+		if (StrUtil.isAllBlank(signature, timestamp, nonce, echostr)) {
 			throw new IllegalArgumentException("请求参数非法，请核实!");
 		}
 

pigx-visual/pigx-oa-platform/pom.xml

@@ -137,6 +137,11 @@
 			<groupId>com.pig4cloud</groupId>
 			<artifactId>pigx-common-swagger</artifactId>
 		</dependency>
+		<!--安全模块-->
+		<dependency>
+			<groupId>com.pig4cloud</groupId>
+			<artifactId>pigx-common-xss</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>com.pig4cloud</groupId>
 			<artifactId>pigx-common-security</artifactId>

pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java

@@ -19,8 +19,8 @@ package com.pig4cloud.pigx.act.controller;
 
 import com.pig4cloud.pigx.act.service.EditorService;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
+import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore;
 import lombok.AllArgsConstructor;
-import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.web.bind.annotation.*;
 
 /**

pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/LeaveBillController.java

@@ -25,8 +25,8 @@ import com.pig4cloud.pigx.act.service.ProcessService;
 import com.pig4cloud.pigx.common.core.constant.enums.TaskStatusEnum;
 import com.pig4cloud.pigx.common.core.util.R;
 import com.pig4cloud.pigx.common.security.util.SecurityUtils;
+import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore;
 import lombok.AllArgsConstructor;
-import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.web.bind.annotation.*;
 
 /**

pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/TaskController.java

@@ -23,8 +23,8 @@ import com.pig4cloud.pigx.act.service.ActTaskService;
 import com.pig4cloud.pigx.common.core.util.R;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
 import com.pig4cloud.pigx.common.security.util.SecurityUtils;
+import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore;
 import lombok.AllArgsConstructor;
-import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;

pigx-visual/pigx-pay-platform/pom.xml

@@ -69,6 +69,10 @@
 			<artifactId>pigx-common-swagger</artifactId>
 		</dependency>
 		<!--安全模块-->
+		<dependency>
+			<groupId>com.pig4cloud</groupId>
+			<artifactId>pigx-common-xss</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>com.pig4cloud</groupId>
 			<artifactId>pigx-common-security</artifactId>

pigx-visual/pigx-pay-platform/src/main/java/com/pig4cloud/pigx/pay/controller/PayNotifyRecordController.java

@@ -25,6 +25,7 @@ import com.ijpay.core.kit.WxPayKit;
 import com.pig4cloud.pigx.common.core.util.R;
 import com.pig4cloud.pigx.common.log.annotation.SysLog;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
+import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore;
 import com.pig4cloud.pigx.pay.entity.PayNotifyRecord;
 import com.pig4cloud.pigx.pay.handler.PayNotifyCallbakHandler;
 import com.pig4cloud.pigx.pay.service.PayNotifyRecordService;
@@ -32,7 +33,6 @@ import io.swagger.annotations.Api;
 import lombok.AllArgsConstructor;
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
-import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;