From e1ac291a1ebed549fb3b8c131f7072535db0fa6b Mon Sep 17 00:00:00 2001
From: PIGCLOUD <wangiegie@gmail.com>
Date: Wed, 19 Nov 2025 21:45:21 +0800
Subject: [PATCH] =?UTF-8?q?feat(auth):=20=E5=A2=9E=E5=BC=BAXSS=E9=98=B2?=
 =?UTF-8?q?=E6=8A=A4=E5=8A=9F=E8=83=BD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 在confirm.ftl模板中对principalName等变量添加?html转义
- 在login.ftl模板中对tenant.id和error变量添加防护处理
- 移除冗余的SsoLogoutSuccessHandler实现类
- 在PigxTokenEndpoint中添加XSS防护注释说明
---
 .../pigx/auth/endpoint/PigxTokenEndpoint.java |  2 +
 .../handler/SsoLogoutSuccessHandler.java      | 41 -------------------
 .../main/resources/templates/ftl/confirm.ftl  | 10 ++---
 .../main/resources/templates/ftl/login.ftl    |  4 +-
 4 files changed, 9 insertions(+), 48 deletions(-)
 delete mode 100644 pigx-auth/src/main/java/com/pig4cloud/pigx/auth/support/handler/SsoLogoutSuccessHandler.java

diff --git a/pigx-auth/src/main/java/com/pig4cloud/pigx/auth/endpoint/PigxTokenEndpoint.java b/pigx-auth/src/main/java/com/pig4cloud/pigx/auth/endpoint/PigxTokenEndpoint.java
index 03fe11b7d..1a2798404 100644
--- a/pigx-auth/src/main/java/com/pig4cloud/pigx/auth/endpoint/PigxTokenEndpoint.java
+++ b/pigx-auth/src/main/java/com/pig4cloud/pigx/auth/endpoint/PigxTokenEndpoint.java
@@ -91,6 +91,7 @@ public class PigxTokenEndpoint {
     @GetMapping("/token/login")
     public ModelAndView require(ModelAndView modelAndView, @RequestParam(required = false) String error) {
         modelAndView.setViewName("ftl/login");
+        // Note: XSS prevention is handled by FreeMarker template using ?html directive
         modelAndView.addObject("error", error);
 
         R<List<SysTenant>> tenantList = tenantService.list();
@@ -113,6 +114,7 @@ public class PigxTokenEndpoint {
                 .orElseThrow(() -> new OAuthClientException("clientId 不合法"));
 
         Set<String> authorizedScopes = StringUtils.commaDelimitedListToSet(clientDetails.getScope());
+        // Note: XSS prevention is handled by FreeMarker template using ?html directive
         modelAndView.addObject("clientId", clientId);
         modelAndView.addObject("state", state);
         modelAndView.addObject("scopeList", authorizedScopes);
diff --git a/pigx-auth/src/main/java/com/pig4cloud/pigx/auth/support/handler/SsoLogoutSuccessHandler.java b/pigx-auth/src/main/java/com/pig4cloud/pigx/auth/support/handler/SsoLogoutSuccessHandler.java
deleted file mode 100644
index e9f1ac330..000000000
--- a/pigx-auth/src/main/java/com/pig4cloud/pigx/auth/support/handler/SsoLogoutSuccessHandler.java
+++ /dev/null
@@ -1,41 +0,0 @@
-package com.pig4cloud.pigx.auth.support.handler;
-
-import cn.hutool.core.util.StrUtil;
-import org.springframework.http.HttpHeaders;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import java.io.IOException;
-
-/**
- * @author lengleng
- * @date 2022-06-02
- * <p>
- * sso 退出功能 ，根据客户端传入跳转
- */
-public class SsoLogoutSuccessHandler implements LogoutSuccessHandler {
-
-	private static final String REDIRECT_URL = "redirect_url";
-
-	@Override
-	public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
-			throws IOException {
-		if (response == null) {
-			return;
-		}
-
-		// 获取请求参数中是否包含 回调地址
-		String redirectUrl = request.getParameter(REDIRECT_URL);
-		if (StrUtil.isNotBlank(redirectUrl)) {
-			response.sendRedirect(redirectUrl);
-		}
-		else if (StrUtil.isNotBlank(request.getHeader(HttpHeaders.REFERER))) {
-			// 默认跳转referer 地址
-			String referer = request.getHeader(HttpHeaders.REFERER);
-			response.sendRedirect(referer);
-		}
-	}
-
-}
diff --git a/pigx-auth/src/main/resources/templates/ftl/confirm.ftl b/pigx-auth/src/main/resources/templates/ftl/confirm.ftl
index 2161c611b..57495b13d 100644
--- a/pigx-auth/src/main/resources/templates/ftl/confirm.ftl
+++ b/pigx-auth/src/main/resources/templates/ftl/confirm.ftl
@@ -10,7 +10,7 @@
                     <#else>
 						<a href="https://pig4cloud.com"
 						   class="text-purple-600 dark:text-purple-400 hover:text-purple-700 dark:hover:text-purple-300 font-medium transition-colors">
-                            ${principalName}
+                            ${principalName?html}
 						</a>
                     </#if>
 				</div>
@@ -20,8 +20,8 @@
 
 	<form id='confirmationForm' name='confirmationForm'
 		  action="<#if request??>${request.contextPath!}</#if>/oauth2/authorize" method='post'>
-		<input type="hidden" name="client_id" value="${clientId}">
-		<input type="hidden" name="state" value="${state}">
+		<input type="hidden" name="client_id" value="${clientId?html}">
+		<input type="hidden" name="state" value="${state?html}">
 
 		<div class="space-y-6">
 			<div class="mb-4">
@@ -29,9 +29,9 @@
 				<div class="space-y-3 bg-gray-50 dark:bg-gray-800 p-4 rounded-lg border border-gray-200 dark:border-gray-700 transition-all">
                     <#list scopeList as scope>
 						<div class="flex items-center">
-							<input type="checkbox" checked="checked" name="scope" value="${scope}"
+							<input type="checkbox" checked="checked" name="scope" value="${scope?html}"
 							       class="h-4 w-4 text-purple-600 focus:ring-purple-500 dark:focus:ring-purple-400 border-gray-300 dark:border-gray-600 rounded transition-colors">
-							<label class="ml-3 text-gray-600 dark:text-gray-400 transition-colors">${scope}</label>
+							<label class="ml-3 text-gray-600 dark:text-gray-400 transition-colors">${scope?html}</label>
 						</div>
                     </#list>
 				</div>
diff --git a/pigx-auth/src/main/resources/templates/ftl/login.ftl b/pigx-auth/src/main/resources/templates/ftl/login.ftl
index b582267fe..809217fda 100755
--- a/pigx-auth/src/main/resources/templates/ftl/login.ftl
+++ b/pigx-auth/src/main/resources/templates/ftl/login.ftl
@@ -22,7 +22,7 @@
                     <select class="w-full text-sm px-4 py-3 bg-gray-100 dark:bg-gray-800 border border-gray-200 dark:border-gray-700 rounded-lg focus:outline-none focus:border-purple-400 dark:focus:border-purple-500 dark:text-gray-300 transition-colors"
                             name="TENANT-ID">
                         <#list tenantList as tenant>
-                            <option value="${tenant.id}">${tenant.name}</option>
+                            <option value="${tenant.id?c}">${tenant.name?html}</option>
                         </#list>
                     </select>
                 </#if>
@@ -40,7 +40,7 @@
 
             <#if error??>
                 <div class="relative text-center">
-                    <span class="text-red-600 dark:text-red-400">${error}</span>
+                    <span class="text-red-600 dark:text-red-400">${error?html}</span>
                 </div>
             </#if>