✨ Introducing new features. #1985 引入 Mica-XSS 插件，避免 element 部分xss 脚本未转义攻击问题

da1569fbb4

pigx-visual/pigx-codegen/pom.xml

@@ -60,6 +60,10 @@
 			<artifactId>pigx-common-swagger</artifactId>
 		</dependency>
 		<!--安全模块-->
+		<dependency>
+			<groupId>com.pig4cloud</groupId>
+			<artifactId>pigx-common-xss</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>com.pig4cloud</groupId>
 			<artifactId>pigx-common-security</artifactId>

pigx-visual/pigx-mp-platform/pom.xml

@@ -55,6 +55,10 @@
 			<artifactId>pigx-common-swagger</artifactId>
 		</dependency>
 		<!--安全模块-->
+		<dependency>
+			<groupId>com.pig4cloud</groupId>
+			<artifactId>pigx-common-xss</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>com.pig4cloud</groupId>
 			<artifactId>pigx-common-security</artifactId>

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxPortalController.java

@@ -4,16 +4,14 @@ import cn.hutool.core.util.StrUtil;
 import com.pig4cloud.pigx.common.core.constant.SecurityConstants;
 import com.pig4cloud.pigx.common.data.tenant.TenantBroker;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
+import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore;
 import com.pig4cloud.pigx.mp.config.WxMpContextHolder;
 import com.pig4cloud.pigx.mp.config.WxMpInitConfigRunner;
-import com.pig4cloud.pigx.mp.service.WxAccountService;
 import lombok.AllArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import me.chanjar.weixin.mp.api.WxMpService;
 import me.chanjar.weixin.mp.bean.message.WxMpXmlMessage;
 import me.chanjar.weixin.mp.bean.message.WxMpXmlOutMessage;
-import net.dreamlu.mica.xss.core.XssCleanIgnore;
-import org.apache.commons.lang3.StringUtils;
 import org.springframework.web.bind.annotation.*;
 
 /**
@@ -29,8 +27,6 @@ import org.springframework.web.bind.annotation.*;
 @RequestMapping("/{appId}/portal")
 public class WxPortalController {
 
-	private final WxAccountService accountService;
-
 	/**
 	 * 微信接入校验处理
 	 * @param appId 多公众号标志位
@@ -50,7 +46,7 @@ public class WxPortalController {
 
 		log.info("接收到来自微信服务器的认证消息：[{}, {}, {}, {}]", signature, timestamp, nonce, echostr);
 
-		if (StringUtils.isAnyBlank(signature, timestamp, nonce, echostr)) {
+		if (StrUtil.isAllBlank(signature, timestamp, nonce, echostr)) {
 			throw new IllegalArgumentException("请求参数非法，请核实!");
 		}
 

pigx-visual/pigx-oa-platform/pom.xml

@@ -137,6 +137,11 @@
 			<groupId>com.pig4cloud</groupId>
 			<artifactId>pigx-common-swagger</artifactId>
 		</dependency>
+		<!--安全模块-->
+		<dependency>
+			<groupId>com.pig4cloud</groupId>
+			<artifactId>pigx-common-xss</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>com.pig4cloud</groupId>
 			<artifactId>pigx-common-security</artifactId>

pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java

@@ -19,8 +19,8 @@ package com.pig4cloud.pigx.act.controller;
 
 import com.pig4cloud.pigx.act.service.EditorService;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
+import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore;
 import lombok.AllArgsConstructor;
-import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.web.bind.annotation.*;
 
 /**

pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/LeaveBillController.java

@@ -25,8 +25,8 @@ import com.pig4cloud.pigx.act.service.ProcessService;
 import com.pig4cloud.pigx.common.core.constant.enums.TaskStatusEnum;
 import com.pig4cloud.pigx.common.core.util.R;
 import com.pig4cloud.pigx.common.security.util.SecurityUtils;
+import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore;
 import lombok.AllArgsConstructor;
-import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.web.bind.annotation.*;
 
 /**

pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/TaskController.java

@@ -23,8 +23,8 @@ import com.pig4cloud.pigx.act.service.ActTaskService;
 import com.pig4cloud.pigx.common.core.util.R;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
 import com.pig4cloud.pigx.common.security.util.SecurityUtils;
+import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore;
 import lombok.AllArgsConstructor;
-import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;

pigx-visual/pigx-pay-platform/pom.xml

@@ -69,6 +69,10 @@
 			<artifactId>pigx-common-swagger</artifactId>
 		</dependency>
 		<!--安全模块-->
+		<dependency>
+			<groupId>com.pig4cloud</groupId>
+			<artifactId>pigx-common-xss</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>com.pig4cloud</groupId>
 			<artifactId>pigx-common-security</artifactId>

pigx-visual/pigx-pay-platform/src/main/java/com/pig4cloud/pigx/pay/controller/PayNotifyRecordController.java

@@ -25,6 +25,7 @@ import com.ijpay.core.kit.WxPayKit;
 import com.pig4cloud.pigx.common.core.util.R;
 import com.pig4cloud.pigx.common.log.annotation.SysLog;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
+import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore;
 import com.pig4cloud.pigx.pay.entity.PayNotifyRecord;
 import com.pig4cloud.pigx.pay.handler.PayNotifyCallbakHandler;
 import com.pig4cloud.pigx.pay.service.PayNotifyRecordService;
@@ -32,7 +33,6 @@ import io.swagger.annotations.Api;
 import lombok.AllArgsConstructor;
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
-import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;