From 8a80d89f9fc313607a3dcc9994cd654cc02da53d Mon Sep 17 00:00:00 2001 From: pig666 Date: Mon, 9 Nov 2020 21:18:30 +0800 Subject: [PATCH] =?UTF-8?q?:sparkles:=20Introducing=20new=20features.=20#1?= =?UTF-8?q?985=20=E5=BC=95=E5=85=A5=20Mica-XSS=20=E6=8F=92=E4=BB=B6?= =?UTF-8?q?=EF=BC=8C=E9=81=BF=E5=85=8D=20element=20=E9=83=A8=E5=88=86xss?= =?UTF-8?q?=20=E8=84=9A=E6=9C=AC=E6=9C=AA=E8=BD=AC=E4=B9=89=E6=94=BB?= =?UTF-8?q?=E5=87=BB=E9=97=AE=E9=A2=98=20da1569fbb433e92adad9528c877b313e7?= =?UTF-8?q?66c5f4f?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pigx-common/pigx-common-bom/pom.xml | 15 ++- pigx-common/pigx-common-security/pom.xml | 12 +- pigx-common/pigx-common-xss/pom.xml | 45 +++++++ .../common/xss/PigxXssAutoConfiguration.java | 63 ++++++++++ .../common/xss/config/PigxXssProperties.java | 60 ++++++++++ .../pigx/common/xss/core/FormXssClean.java | 68 +++++++++++ .../pigx/common/xss/core/JacksonXssClean.java | 52 ++++++++ .../pigx/common/xss/core/XssCleanIgnore.java | 31 +++++ .../common/xss/core/XssCleanInterceptor.java | 73 ++++++++++++ .../pigx/common/xss/core/XssHolder.java | 40 +++++++ .../pigx/common/xss/utils/XssUtil.java | 111 ++++++++++++++++++ .../main/resources/META-INF/spring.factories | 2 + pigx-common/pom.xml | 1 + pigx-upms/pigx-upms-biz/pom.xml | 5 + pigx-visual/pigx-codegen/pom.xml | 4 + pigx-visual/pigx-mp-platform/pom.xml | 4 + .../mp/controller/WxPortalController.java | 8 +- pigx-visual/pigx-oa-platform/pom.xml | 5 + .../pigx/act/controller/EditorController.java | 2 +- .../act/controller/LeaveBillController.java | 2 +- .../pigx/act/controller/TaskController.java | 2 +- pigx-visual/pigx-pay-platform/pom.xml | 4 + .../controller/PayNotifyRecordController.java | 2 +- 23 files changed, 590 insertions(+), 21 deletions(-) create mode 100755 pigx-common/pigx-common-xss/pom.xml create mode 100755 pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/PigxXssAutoConfiguration.java create mode 100755 pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/config/PigxXssProperties.java create mode 100755 pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/FormXssClean.java create mode 100755 pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/JacksonXssClean.java create mode 100755 pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssCleanIgnore.java create mode 100755 pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssCleanInterceptor.java create mode 100755 pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssHolder.java create mode 100755 pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/utils/XssUtil.java create mode 100755 pigx-common/pigx-common-xss/src/main/resources/META-INF/spring.factories diff --git a/pigx-common/pigx-common-bom/pom.xml b/pigx-common/pigx-common-bom/pom.xml index 95ef860df..0686ab79c 100644 --- a/pigx-common/pigx-common-bom/pom.xml +++ b/pigx-common/pigx-common-bom/pom.xml @@ -20,13 +20,13 @@ 3.10.0 3.4.0 3.2.0 - 2.0.8-GA 1.2.3 8.0.22 1.5.22 3.9.0 2.7.0 3.0.3 + 1.13.1 2.3.6.RELEASE 1.2.73 3.0.52.ALL @@ -112,6 +112,11 @@ pigx-common-test ${pigx.version} + + com.pig4cloud + pigx-common-xss + ${pigx.version} + com.pig4cloud pigx-upms-api @@ -202,11 +207,11 @@ spring-security-oauth2 ${security.oauth.version} - + - net.dreamlu - mica-xss - ${mica.version} + org.jsoup + jsoup + ${jsoup.version} diff --git a/pigx-common/pigx-common-security/pom.xml b/pigx-common/pigx-common-security/pom.xml index a559ce1b6..46906f33f 100644 --- a/pigx-common/pigx-common-security/pom.xml +++ b/pigx-common/pigx-common-security/pom.xml @@ -58,10 +58,10 @@ org.springframework.data spring-data-redis - - - net.dreamlu - mica-xss - - + + + com.pig4cloud + pigx-upms-api + + diff --git a/pigx-common/pigx-common-xss/pom.xml b/pigx-common/pigx-common-xss/pom.xml new file mode 100755 index 000000000..20a7d89b5 --- /dev/null +++ b/pigx-common/pigx-common-xss/pom.xml @@ -0,0 +1,45 @@ + + + 4.0.0 + + com.pig4cloud + pigx-common + 3.10.0 + + + pigx-common-xss + jar + + pigx xss 安全过滤插件 基于 JSOUP + + + + cn.hutool + hutool-core + ${hutool.version} + + + + org.jsoup + jsoup + + + + org.springframework + spring-webmvc + + + + com.fasterxml.jackson.core + jackson-databind + + + + javax.servlet + javax.servlet-api + provided + + + \ No newline at end of file diff --git a/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/PigxXssAutoConfiguration.java b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/PigxXssAutoConfiguration.java new file mode 100755 index 000000000..6732d51e0 --- /dev/null +++ b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/PigxXssAutoConfiguration.java @@ -0,0 +1,63 @@ +/* + * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net). + *

+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0; + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + *

+ * http://www.gnu.org/licenses/lgpl.html + *

+ * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.pig4cloud.pigx.common.xss; + +import com.pig4cloud.pigx.common.xss.config.PigxXssProperties; +import com.pig4cloud.pigx.common.xss.core.FormXssClean; +import com.pig4cloud.pigx.common.xss.core.JacksonXssClean; +import com.pig4cloud.pigx.common.xss.core.XssCleanInterceptor; +import lombok.RequiredArgsConstructor; +import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; +import org.springframework.boot.autoconfigure.jackson.Jackson2ObjectMapperBuilderCustomizer; +import org.springframework.boot.context.properties.EnableConfigurationProperties; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.core.Ordered; +import org.springframework.web.servlet.config.annotation.InterceptorRegistry; +import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; + +/** + * jackson xss 配置 + * + * @author L.cm + */ +@RequiredArgsConstructor +@Configuration(proxyBeanMethods = false) +@EnableConfigurationProperties(PigxXssProperties.class) +@ConditionalOnProperty(value = "security.xss.enabled", havingValue = "true", matchIfMissing = true) +public class PigxXssAutoConfiguration implements WebMvcConfigurer { + + private final PigxXssProperties xssProperties; + + @Bean + public FormXssClean formXssClean() { + return new FormXssClean(); + } + + @Bean + public Jackson2ObjectMapperBuilderCustomizer xssJacksonCustomizer() { + return builder -> builder.deserializerByType(String.class, new JacksonXssClean()); + } + + @Override + public void addInterceptors(InterceptorRegistry registry) { + XssCleanInterceptor interceptor = new XssCleanInterceptor(xssProperties); + registry.addInterceptor(interceptor).addPathPatterns(xssProperties.getPathPatterns()) + .excludePathPatterns(xssProperties.getExcludePatterns()).order(Ordered.LOWEST_PRECEDENCE); + } + +} diff --git a/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/config/PigxXssProperties.java b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/config/PigxXssProperties.java new file mode 100755 index 000000000..6226b847c --- /dev/null +++ b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/config/PigxXssProperties.java @@ -0,0 +1,60 @@ +/* + * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net). + *

+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0; + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + *

+ * http://www.gnu.org/licenses/lgpl.html + *

+ * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.pig4cloud.pigx.common.xss.config; + +import cn.hutool.core.collection.CollUtil; +import lombok.Getter; +import lombok.Setter; +import org.springframework.beans.factory.InitializingBean; +import org.springframework.boot.context.properties.ConfigurationProperties; + +import java.util.ArrayList; +import java.util.List; + +/** + * Xss配置类 + * + * @author L.cm + */ +@Getter +@Setter +@ConfigurationProperties("security.xss") +public class PigxXssProperties implements InitializingBean { + + /** + * 开启xss + */ + private boolean enabled = true; + + /** + * 拦截的路由，默认拦截 /** + */ + private List pathPatterns = new ArrayList<>(); + + /** + * 放行的规则，默认为空 + */ + private List excludePatterns = new ArrayList<>(); + + @Override + public void afterPropertiesSet() { + if (CollUtil.isEmpty(pathPatterns)) { + pathPatterns.add("/**"); + } + } + +} diff --git a/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/FormXssClean.java b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/FormXssClean.java new file mode 100755 index 000000000..fa55e2816 --- /dev/null +++ b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/FormXssClean.java @@ -0,0 +1,68 @@ +/* + * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net). + *

+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0; + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + *

+ * http://www.gnu.org/licenses/lgpl.html + *

+ * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.pig4cloud.pigx.common.xss.core; + +import cn.hutool.core.util.StrUtil; +import com.pig4cloud.pigx.common.xss.utils.XssUtil; +import lombok.extern.slf4j.Slf4j; +import org.springframework.web.bind.WebDataBinder; +import org.springframework.web.bind.annotation.ControllerAdvice; +import org.springframework.web.bind.annotation.InitBinder; + +import java.beans.PropertyEditorSupport; + +/** + * 表单 xss 处理 + * + * @author L.cm + */ +@ControllerAdvice +public class FormXssClean { + + @InitBinder + public void initBinder(WebDataBinder binder) { + // 处理前端传来的表单字符串 + binder.registerCustomEditor(String.class, new StringPropertiesEditor()); + } + + @Slf4j + public static class StringPropertiesEditor extends PropertyEditorSupport { + + @Override + public String getAsText() { + Object value = getValue(); + return value != null ? value.toString() : StrUtil.EMPTY; + } + + @Override + public void setAsText(String text) throws IllegalArgumentException { + if (text == null) { + setValue(null); + } + else if (XssHolder.isEnabled()) { + String value = XssUtil.clean(text); + setValue(value); + log.trace("Request parameter value:{} cleaned up by mica-xss, current value is:{}.", text, value); + } + else { + setValue(text); + } + } + + } + +} diff --git a/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/JacksonXssClean.java b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/JacksonXssClean.java new file mode 100755 index 000000000..be8fb051c --- /dev/null +++ b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/JacksonXssClean.java @@ -0,0 +1,52 @@ +/* + * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net). + *

+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0; + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + *

+ * http://www.gnu.org/licenses/lgpl.html + *

+ * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.pig4cloud.pigx.common.xss.core; + +import com.fasterxml.jackson.core.JsonParser; +import com.fasterxml.jackson.databind.DeserializationContext; +import com.fasterxml.jackson.databind.JsonDeserializer; +import com.pig4cloud.pigx.common.xss.utils.XssUtil; +import lombok.extern.slf4j.Slf4j; + +import java.io.IOException; + +/** + * jackson xss 处理 + * + * @author L.cm + */ +@Slf4j +public class JacksonXssClean extends JsonDeserializer { + + @Override + public String deserialize(JsonParser p, DeserializationContext ctxt) throws IOException { + // XSS filter + String text = p.getValueAsString(); + if (text == null) { + return null; + } + else if (XssHolder.isEnabled()) { + String value = XssUtil.clean(text); + log.trace("Json property value:{} cleaned up by mica-xss, current value is:{}.", text, value); + return value; + } + else { + return text; + } + } + +} diff --git a/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssCleanIgnore.java b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssCleanIgnore.java new file mode 100755 index 000000000..ff1529571 --- /dev/null +++ b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssCleanIgnore.java @@ -0,0 +1,31 @@ +/* + * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net). + *

+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0; + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + *

+ * http://www.gnu.org/licenses/lgpl.html + *

+ * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.pig4cloud.pigx.common.xss.core; + +import java.lang.annotation.*; + +/** + * 忽略 xss + * + * @author L.cm + */ +@Target({ ElementType.TYPE, ElementType.METHOD }) +@Retention(RetentionPolicy.RUNTIME) +@Documented +public @interface XssCleanIgnore { + +} diff --git a/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssCleanInterceptor.java b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssCleanInterceptor.java new file mode 100755 index 000000000..03c206e8a --- /dev/null +++ b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssCleanInterceptor.java @@ -0,0 +1,73 @@ +/* + * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net). + *

+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0; + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + *

+ * http://www.gnu.org/licenses/lgpl.html + *

+ * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.pig4cloud.pigx.common.xss.core; + +import cn.hutool.core.util.StrUtil; +import com.pig4cloud.pigx.common.xss.config.PigxXssProperties; +import lombok.RequiredArgsConstructor; +import org.springframework.core.annotation.AnnotationUtils; +import org.springframework.http.HttpMethod; +import org.springframework.web.method.HandlerMethod; +import org.springframework.web.servlet.handler.HandlerInterceptorAdapter; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + +/** + * xss 处理拦截器 + * + * @author L.cm + */ +@RequiredArgsConstructor +public class XssCleanInterceptor extends HandlerInterceptorAdapter { + + private final PigxXssProperties xssProperties; + + @Override + public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) + throws Exception { + // 1. 没有开启 + if (!xssProperties.isEnabled()) { + return true; + } + + // 2. 非控制器请求直接跳出 + if (!(handler instanceof HandlerMethod)) { + return true; + } + + // 3. 只过滤 POST PUT + if (!StrUtil.equalsAnyIgnoreCase(request.getMethod(), HttpMethod.POST.name(), HttpMethod.PUT.name())) { + return true; + } + + // 4. 处理 XssIgnore 注解 + HandlerMethod handlerMethod = (HandlerMethod) handler; + XssCleanIgnore xssCleanIgnore = AnnotationUtils.findAnnotation(handlerMethod.getMethod(), XssCleanIgnore.class); + if (xssCleanIgnore == null) { + XssHolder.setEnable(); + } + return true; + } + + @Override + public void afterConcurrentHandlingStarted(HttpServletRequest request, HttpServletResponse response, + Object handler) { + XssHolder.remove(); + } + +} diff --git a/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssHolder.java b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssHolder.java new file mode 100755 index 000000000..3b2b7cbe5 --- /dev/null +++ b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/core/XssHolder.java @@ -0,0 +1,40 @@ +/* + * Copyright (c) 2019-2029, Dreamlu 卢春梦 (596392912@qq.com & www.dreamlu.net). + *

+ * Licensed under the GNU LESSER GENERAL PUBLIC LICENSE 3.0; + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + *

+ * http://www.gnu.org/licenses/lgpl.html + *

+ * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.pig4cloud.pigx.common.xss.core; + +/** + * 利用 ThreadLocal 缓存线程间的数据 + * + * @author L.cm + */ +class XssHolder { + + private static final ThreadLocal TL = new ThreadLocal<>(); + + public static boolean isEnabled() { + return Boolean.TRUE.equals(TL.get()); + } + + public static void setEnable() { + TL.set(Boolean.TRUE); + } + + public static void remove() { + TL.remove(); + } + +} diff --git a/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/utils/XssUtil.java b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/utils/XssUtil.java new file mode 100755 index 000000000..2549a4e6f --- /dev/null +++ b/pigx-common/pigx-common-xss/src/main/java/com/pig4cloud/pigx/common/xss/utils/XssUtil.java @@ -0,0 +1,111 @@ +/** + * Copyright (c) 2016-2020, Michael Yang 杨福海 (fuhai999@gmail.com). + *

+ * Licensed under the GNU Lesser General Public License (LGPL) ,Version 3.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + *

+ * http://www.gnu.org/licenses/lgpl-3.0.txt + *

+ * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.pig4cloud.pigx.common.xss.utils; + +import org.jsoup.Jsoup; +import org.jsoup.nodes.Attribute; +import org.jsoup.nodes.Element; +import org.springframework.util.StringUtils; + +/** + * xss clean + * + *

+ * 参考自 jpress：https://gitee.com/fuhai/jpress + *

+ * + * @author L.cm + * @author michael + */ +public class XssUtil { + + private static HtmlWhitelist whitelist = new HtmlWhitelist(); + + /** + * xss 清理 + * @param html html + * @return 清理后的 html + */ + public static String clean(String html) { + if (StringUtils.hasText(html)) { + return Jsoup.clean(html, whitelist); + } + return html; + } + + /** + * 做自己的白名单，允许base64的图片通过等 + * + * @author michael + */ + public static class HtmlWhitelist extends org.jsoup.safety.Whitelist { + + public HtmlWhitelist() { + addTags("a", "b", "blockquote", "br", "caption", "cite", "code", "col", "colgroup", "dd", "div", "span", + "embed", "object", "dl", "dt", "em", "h1", "h2", "h3", "h4", "h5", "h6", "i", "img", "li", "ol", + "p", "pre", "q", "small", "strike", "strong", "sub", "sup", "table", "tbody", "td", "tfoot", "th", + "thead", "tr", "u", "ul"); + + addAttributes("a", "href", "title", "target"); + addAttributes("blockquote", "cite"); + addAttributes("col", "span"); + addAttributes("colgroup", "span"); + addAttributes("img", "align", "alt", "src", "title"); + addAttributes("ol", "start"); + addAttributes("q", "cite"); + addAttributes("table", "summary"); + addAttributes("td", "abbr", "axis", "colspan", "rowspan", "width"); + addAttributes("th", "abbr", "axis", "colspan", "rowspan", "scope", "width"); + addAttributes("video", "src", "autoplay", "controls", "loop", "muted", "poster", "preload"); + addAttributes("object", "width", "height", "classid", "codebase"); + addAttributes("param", "name", "value"); + addAttributes("embed", "src", "quality", "width", "height", "allowFullScreen", "allowScriptAccess", + "flashvars", "name", "type", "pluginspage"); + + addAttributes(":all", "class", "style", "height", "width", "type", "id", "name"); + + addProtocols("blockquote", "cite", "http", "https"); + addProtocols("cite", "cite", "http", "https"); + addProtocols("q", "cite", "http", "https"); + + // 如果添加以下的协议，那么href 必须是http、 https 等开头，相对路径则被过滤掉了 + // addProtocols("a", "href", "ftp", "http", "https", "mailto", "tel"); + + // 如果添加以下的协议，那么src必须是http 或者 https 开头，相对路径则被过滤掉了， + // 所以必须注释掉，允许相对路径的图片资源 + // addProtocols("img", "src", "http", "https"); + } + + @Override + protected boolean isSafeAttribute(String tagName, Element el, Attribute attr) { + // 不允许 javascript 开头的 src 和 href + if ("src".equalsIgnoreCase(attr.getKey()) || "href".equalsIgnoreCase(attr.getKey())) { + String value = attr.getValue(); + if (StringUtils.hasText(value) && value.toLowerCase().startsWith("javascript")) { + return false; + } + } + // 允许 base64 的图片内容 + if ("img".equals(tagName) && "src".equals(attr.getKey()) && attr.getValue().startsWith("data:;base64")) { + return true; + } + return super.isSafeAttribute(tagName, el, attr); + } + + } + +} diff --git a/pigx-common/pigx-common-xss/src/main/resources/META-INF/spring.factories b/pigx-common/pigx-common-xss/src/main/resources/META-INF/spring.factories new file mode 100755 index 000000000..4634a2e80 --- /dev/null +++ b/pigx-common/pigx-common-xss/src/main/resources/META-INF/spring.factories @@ -0,0 +1,2 @@ +org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ + com.pig4cloud.pigx.common.xss.PigxXssAutoConfiguration \ No newline at end of file diff --git a/pigx-common/pom.xml b/pigx-common/pom.xml index 22234fc75..e07721832 100644 --- a/pigx-common/pom.xml +++ b/pigx-common/pom.xml @@ -49,5 +49,6 @@ pigx-common-swagger pigx-common-test pigx-common-transaction + pigx-common-xss diff --git a/pigx-upms/pigx-upms-biz/pom.xml b/pigx-upms/pigx-upms-biz/pom.xml index 249e6b7e1..8e83c6e8a 100644 --- a/pigx-upms/pigx-upms-biz/pom.xml +++ b/pigx-upms/pigx-upms-biz/pom.xml @@ -72,6 +72,11 @@ com.pig4cloud pigx-common-security + + + com.pig4cloud + pigx-common-xss + com.pig4cloud diff --git a/pigx-visual/pigx-codegen/pom.xml b/pigx-visual/pigx-codegen/pom.xml index 8a73cc914..41aaa11b3 100755 --- a/pigx-visual/pigx-codegen/pom.xml +++ b/pigx-visual/pigx-codegen/pom.xml @@ -60,6 +60,10 @@ pigx-common-swagger + + com.pig4cloud + pigx-common-xss + com.pig4cloud pigx-common-security diff --git a/pigx-visual/pigx-mp-platform/pom.xml b/pigx-visual/pigx-mp-platform/pom.xml index 71348de5f..4de46fc5c 100755 --- a/pigx-visual/pigx-mp-platform/pom.xml +++ b/pigx-visual/pigx-mp-platform/pom.xml @@ -55,6 +55,10 @@ pigx-common-swagger + + com.pig4cloud + pigx-common-xss + com.pig4cloud pigx-common-security diff --git a/pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxPortalController.java b/pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxPortalController.java index c09d62c03..e7db71b0a 100755 --- a/pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxPortalController.java +++ b/pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxPortalController.java @@ -4,16 +4,14 @@ import cn.hutool.core.util.StrUtil; import com.pig4cloud.pigx.common.core.constant.SecurityConstants; import com.pig4cloud.pigx.common.data.tenant.TenantBroker; import com.pig4cloud.pigx.common.security.annotation.Inner; +import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore; import com.pig4cloud.pigx.mp.config.WxMpContextHolder; import com.pig4cloud.pigx.mp.config.WxMpInitConfigRunner; -import com.pig4cloud.pigx.mp.service.WxAccountService; import lombok.AllArgsConstructor; import lombok.extern.slf4j.Slf4j; import me.chanjar.weixin.mp.api.WxMpService; import me.chanjar.weixin.mp.bean.message.WxMpXmlMessage; import me.chanjar.weixin.mp.bean.message.WxMpXmlOutMessage; -import net.dreamlu.mica.xss.core.XssCleanIgnore; -import org.apache.commons.lang3.StringUtils; import org.springframework.web.bind.annotation.*; /** @@ -29,8 +27,6 @@ import org.springframework.web.bind.annotation.*; @RequestMapping("/{appId}/portal") public class WxPortalController { - private final WxAccountService accountService; - /** * 微信接入校验处理 * @param appId 多公众号标志位 @@ -50,7 +46,7 @@ public class WxPortalController { log.info("接收到来自微信服务器的认证消息：[{}, {}, {}, {}]", signature, timestamp, nonce, echostr); - if (StringUtils.isAnyBlank(signature, timestamp, nonce, echostr)) { + if (StrUtil.isAllBlank(signature, timestamp, nonce, echostr)) { throw new IllegalArgumentException("请求参数非法，请核实!"); } diff --git a/pigx-visual/pigx-oa-platform/pom.xml b/pigx-visual/pigx-oa-platform/pom.xml index 0f87ac725..66abed936 100644 --- a/pigx-visual/pigx-oa-platform/pom.xml +++ b/pigx-visual/pigx-oa-platform/pom.xml @@ -137,6 +137,11 @@ com.pig4cloud pigx-common-swagger + + + com.pig4cloud + pigx-common-xss + com.pig4cloud pigx-common-security diff --git a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java index 00f6e17fb..381d37ade 100644 --- a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java +++ b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java @@ -19,8 +19,8 @@ package com.pig4cloud.pigx.act.controller; import com.pig4cloud.pigx.act.service.EditorService; import com.pig4cloud.pigx.common.security.annotation.Inner; +import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore; import lombok.AllArgsConstructor; -import net.dreamlu.mica.xss.core.XssCleanIgnore; import org.springframework.web.bind.annotation.*; /** diff --git a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/LeaveBillController.java b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/LeaveBillController.java index 5f69db49b..7541d0c9a 100755 --- a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/LeaveBillController.java +++ b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/LeaveBillController.java @@ -25,8 +25,8 @@ import com.pig4cloud.pigx.act.service.ProcessService; import com.pig4cloud.pigx.common.core.constant.enums.TaskStatusEnum; import com.pig4cloud.pigx.common.core.util.R; import com.pig4cloud.pigx.common.security.util.SecurityUtils; +import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore; import lombok.AllArgsConstructor; -import net.dreamlu.mica.xss.core.XssCleanIgnore; import org.springframework.web.bind.annotation.*; /** diff --git a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/TaskController.java b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/TaskController.java index bbd3a48d4..ec7e810cc 100644 --- a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/TaskController.java +++ b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/TaskController.java @@ -23,8 +23,8 @@ import com.pig4cloud.pigx.act.service.ActTaskService; import com.pig4cloud.pigx.common.core.util.R; import com.pig4cloud.pigx.common.security.annotation.Inner; import com.pig4cloud.pigx.common.security.util.SecurityUtils; +import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore; import lombok.AllArgsConstructor; -import net.dreamlu.mica.xss.core.XssCleanIgnore; import org.springframework.http.HttpHeaders; import org.springframework.http.HttpStatus; import org.springframework.http.MediaType; diff --git a/pigx-visual/pigx-pay-platform/pom.xml b/pigx-visual/pigx-pay-platform/pom.xml index 08958724a..5345047c3 100755 --- a/pigx-visual/pigx-pay-platform/pom.xml +++ b/pigx-visual/pigx-pay-platform/pom.xml @@ -69,6 +69,10 @@ pigx-common-swagger + + com.pig4cloud + pigx-common-xss + com.pig4cloud pigx-common-security diff --git a/pigx-visual/pigx-pay-platform/src/main/java/com/pig4cloud/pigx/pay/controller/PayNotifyRecordController.java b/pigx-visual/pigx-pay-platform/src/main/java/com/pig4cloud/pigx/pay/controller/PayNotifyRecordController.java index f7ce26a72..74c2e6e1b 100755 --- a/pigx-visual/pigx-pay-platform/src/main/java/com/pig4cloud/pigx/pay/controller/PayNotifyRecordController.java +++ b/pigx-visual/pigx-pay-platform/src/main/java/com/pig4cloud/pigx/pay/controller/PayNotifyRecordController.java @@ -25,6 +25,7 @@ import com.ijpay.core.kit.WxPayKit; import com.pig4cloud.pigx.common.core.util.R; import com.pig4cloud.pigx.common.log.annotation.SysLog; import com.pig4cloud.pigx.common.security.annotation.Inner; +import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore; import com.pig4cloud.pigx.pay.entity.PayNotifyRecord; import com.pig4cloud.pigx.pay.handler.PayNotifyCallbakHandler; import com.pig4cloud.pigx.pay.service.PayNotifyRecordService; @@ -32,7 +33,6 @@ import io.swagger.annotations.Api; import lombok.AllArgsConstructor; import lombok.SneakyThrows; import lombok.extern.slf4j.Slf4j; -import net.dreamlu.mica.xss.core.XssCleanIgnore; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.web.bind.annotation.*;