From ccdbde52299d7ec64819fc8de03cee0a12cb12ff Mon Sep 17 00:00:00 2001 From: PIGCLOUD Date: Mon, 2 Nov 2026 17:51:02 +0800 Subject: [PATCH] =?UTF-8?q?fix(pigx-common-security):=20=E4=BF=AE=E5=A4=8D?= =?UTF-8?q?=E5=86=85=E9=83=A8=E8=AF=B7=E6=B1=82=E6=A0=A1=E9=AA=8C=E5=8F=AF?= =?UTF-8?q?=E8=A2=AB=E4=BC=AA=E9=80=A0=20IP=20=E7=BB=95=E8=BF=87=E7=9A=84?= =?UTF-8?q?=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 改用 request.getRemoteAddr() 获取客户端地址，避免从可自定义的转发头提取 IP - 仅放行 IPv4 回环地址，未携带内部标记的外部请求交由后续认证鉴权处理 (cherry picked from commit b5e5b837ef3e82c4d8231be0bcbd6641c3de7516) --- .../component/PigxInnerHeaderRemoveFilter.java | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxInnerHeaderRemoveFilter.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxInnerHeaderRemoveFilter.java index 504eb1ed0..a0a3fe13e 100644 --- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxInnerHeaderRemoveFilter.java +++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxInnerHeaderRemoveFilter.java @@ -2,13 +2,13 @@ package com.pig4cloud.pigx.common.security.component; import cn.hutool.core.net.Ipv4Util; import cn.hutool.core.util.StrUtil; -import cn.hutool.extra.servlet.JakartaServletUtil; import com.pig4cloud.pigx.common.core.constant.SecurityConstants; import jakarta.servlet.FilterChain; import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import lombok.extern.slf4j.Slf4j; +import org.apache.tomcat.util.net.IPv6Utils; import org.jetbrains.annotations.NotNull; import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; import org.springframework.http.HttpStatus; @@ -39,23 +39,23 @@ public class PigxInnerHeaderRemoveFilter extends OncePerRequestFilter { */ @Override protected void doFilterInternal(HttpServletRequest request, @NotNull HttpServletResponse response, @NotNull FilterChain filterChain) throws ServletException, IOException { - // 获取客户端IP地址 - String clientIP = JakartaServletUtil.getClientIP(request); + // 使用容器提供的连接地址，不从调用者可填写的转发头提取 IP。 + String clientIP = request.getRemoteAddr(); - // 允许 127.0.0.1 请求直接通过 - if (Ipv4Util.LOCAL_IP.equals(clientIP)) { + // 兼容 IPv4 回环不解析主机名。 + if (StrUtil.equalsAny(clientIP, Ipv4Util.LOCAL_IP)) { filterChain.doFilter(request, response); return; } String fromHeader = request.getHeader(SecurityConstants.FROM); - // 非 127.0.0.1 请求，没有配置 from header ，直接跳过 + // 普通请求不携带内部标记，交给后续认证与权限检查。 if (StrUtil.isBlank(fromHeader)) { filterChain.doFilter(request, response); return; } - // 非 127.0.0.1，配置了 from header ，直接拒绝访问 + // 外部连接或经过代理的请求，不允许自行声明为内部调用。 log.warn("请求 IP {}，疑似进行系统注入操作，请注意", clientIP); response.setStatus(HttpStatus.FORBIDDEN.value()); }