✨ Introducing new features. #1985 引入 Mica-XSS 插件，避免 element 部分xss 脚本未转义攻击问题 新特性

pigx-common/pigx-common-bom/pom.xml

@@ -20,6 +20,7 @@
 		<pigx.version>3.10.0</pigx.version>
 		<mybatis-plus.version>3.4.0</mybatis-plus.version>
 		<dynamic-ds.version>3.2.0</dynamic-ds.version>
+		<mica.version>2.0.8-GA</mica.version>
 		<druid.version>1.2.1</druid.version>
 		<mysql.connector.version>8.0.21</mysql.connector.version>
 		<swagger.core.version>1.5.22</swagger.core.version>
@@ -201,6 +202,12 @@
 				<artifactId>spring-security-oauth2</artifactId>
 				<version>${security.oauth.version}</version>
 			</dependency>
+			<!--xss 过滤组件-->
+			<dependency>
+				<groupId>net.dreamlu</groupId>
+				<artifactId>mica-xss</artifactId>
+				<version>${mica.version}</version>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>
 

pigx-common/pigx-common-security/pom.xml

@@ -58,5 +58,10 @@
 			<groupId>org.springframework.data</groupId>
 			<artifactId>spring-data-redis</artifactId>
 		</dependency>
+		<!--xss 安全过滤-->
+		<dependency>
+			<groupId>net.dreamlu</groupId>
+			<artifactId>mica-xss</artifactId>
+		</dependency>
 	</dependencies>
 </project>

pigx-gateway/pom.xml

@@ -63,11 +63,6 @@
 			<artifactId>captcha-spring-boot-starter</artifactId>
 			<version>${captcha.version}</version>
 		</dependency>
-		<!--hutool-->
-		<dependency>
-			<groupId>com.pig4cloud</groupId>
-			<artifactId>pigx-common-core</artifactId>
-		</dependency>
 		<!--缓存-->
 		<dependency>
 			<groupId>org.springframework.boot</groupId>

pigx-visual/pigx-mp-platform/src/main/java/com/pig4cloud/pigx/mp/controller/WxPortalController.java

@@ -12,6 +12,7 @@ import lombok.extern.slf4j.Slf4j;
 import me.chanjar.weixin.mp.api.WxMpService;
 import me.chanjar.weixin.mp.bean.message.WxMpXmlMessage;
 import me.chanjar.weixin.mp.bean.message.WxMpXmlOutMessage;
+import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.web.bind.annotation.*;
 
@@ -39,6 +40,7 @@ public class WxPortalController {
 	 * @param echostr 随机字符串
 	 * @return
 	 */
+	@XssCleanIgnore
 	@GetMapping(produces = "text/plain;charset=utf-8")
 	public String authGet(@PathVariable("appId") String appId,
 			@RequestParam(name = "signature", required = false) String signature,
@@ -76,6 +78,7 @@ public class WxPortalController {
 	 * @param nonce 随机数
 	 * @return
 	 */
+	@XssCleanIgnore
 	@PostMapping(produces = "application/xml; charset=UTF-8")
 	public String post(@PathVariable("appId") String appId, @RequestBody String requestBody,
 			@RequestParam("signature") String signature, @RequestParam("timestamp") String timestamp,

pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java

@@ -20,6 +20,7 @@ package com.pig4cloud.pigx.act.controller;
 import com.pig4cloud.pigx.act.service.EditorService;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
 import lombok.AllArgsConstructor;
+import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.web.bind.annotation.*;
 
 /**
@@ -44,6 +45,7 @@ public class EditorController {
 		return editorService.getEditorJson(modelId);
 	}
 
+	@XssCleanIgnore
 	@PutMapping("/model/{modelId}/save")
 	public void saveModel(@PathVariable(value = "modelId") String modelId, String name, String description,
 			@RequestParam("json_xml") String jsonXml, @RequestParam("svg_xml") String svgXml) {

pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/LeaveBillController.java

@@ -26,6 +26,7 @@ import com.pig4cloud.pigx.common.core.constant.enums.TaskStatusEnum;
 import com.pig4cloud.pigx.common.core.util.R;
 import com.pig4cloud.pigx.common.security.util.SecurityUtils;
 import lombok.AllArgsConstructor;
+import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.web.bind.annotation.*;
 
 /**
@@ -70,6 +71,7 @@ public class LeaveBillController {
 	 * @return R
 	 */
 	@PostMapping
+	@XssCleanIgnore
 	public R save(@RequestBody LeaveBill leaveBill) {
 		leaveBill.setUsername(SecurityUtils.getUser().getUsername());
 		leaveBill.setState(TaskStatusEnum.UNSUBMIT.getStatus());
@@ -82,6 +84,7 @@ public class LeaveBillController {
 	 * @return R
 	 */
 	@PutMapping
+	@XssCleanIgnore
 	public R updateById(@RequestBody LeaveBill leaveBill) {
 		return R.ok(leaveBillService.updateById(leaveBill));
 	}

pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/TaskController.java

@@ -24,6 +24,7 @@ import com.pig4cloud.pigx.common.core.util.R;
 import com.pig4cloud.pigx.common.security.annotation.Inner;
 import com.pig4cloud.pigx.common.security.util.SecurityUtils;
 import lombok.AllArgsConstructor;
+import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
@@ -55,6 +56,7 @@ public class TaskController {
 	}
 
 	@PostMapping
+	@XssCleanIgnore
 	public R submitTask(@RequestBody LeaveBillDto leaveBillDto) {
 		return R.ok(actTaskService.submitTask(leaveBillDto));
 	}

pigx-visual/pigx-pay-platform/src/main/java/com/pig4cloud/pigx/pay/controller/PayNotifyRecordController.java

@@ -32,6 +32,7 @@ import io.swagger.annotations.Api;
 import lombok.AllArgsConstructor;
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
+import net.dreamlu.mica.xss.core.XssCleanIgnore;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
@@ -122,6 +123,7 @@ public class PayNotifyRecordController {
 	 */
 	@Inner(false)
 	@SneakyThrows
+	@XssCleanIgnore
 	@PostMapping("/ali/callbak")
 	public void aliCallbak(HttpServletRequest request, HttpServletResponse response) {
 		// 解析回调信息
@@ -137,6 +139,7 @@ public class PayNotifyRecordController {
 	@Inner(false)
 	@SneakyThrows
 	@ResponseBody
+	@XssCleanIgnore
 	@PostMapping("/wx/callbak")
 	public String wxCallbak(HttpServletRequest request) {
 		String xmlMsg = HttpKit.readData(request);