fix0806: APP端去掉全部的市辖区选择

hejianhao

2026-08-28 16a57a8fc6868cea9171a1119698572407a2fc03

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
package com.tcm.training.admin.common.xss;
 
import org.springframework.core.MethodParameter;
import org.springframework.http.HttpInputMessage;
import org.springframework.http.converter.HttpMessageConverter;
import org.springframework.http.server.ServletServerHttpRequest;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.servlet.mvc.method.annotation.RequestBodyAdviceAdapter;
 
import javax.servlet.http.HttpServletRequest;
import java.lang.reflect.Field;
import java.lang.reflect.Modifier;
import java.lang.reflect.Type;
import java.util.Collection;
import java.util.IdentityHashMap;
import java.util.Map;
import java.util.Set;
 
@ControllerAdvice(annotations = Controller.class)
public class XssRequestBodyAdvice extends RequestBodyAdviceAdapter {
 
    @Override
    public boolean supports(MethodParameter methodParameter, Type targetType, Class<? extends HttpMessageConverter<?>> converterType) {
        return true;
    }
 
    @Override
    public Object afterBodyRead(Object body,
                                HttpInputMessage inputMessage,
                                MethodParameter parameter,
                                Type targetType,
                                Class<? extends HttpMessageConverter<?>> converterType) {
        if (!(inputMessage instanceof ServletServerHttpRequest)) {
            return body;
        }
        HttpServletRequest request = ((ServletServerHttpRequest) inputMessage).getServletRequest();
        String contentType = request.getContentType();
        if (contentType == null || !contentType.toLowerCase().contains("application/json")) {
            return body;
        }
        sanitize(body, new IdentityHashMap<Object, Boolean>());
        return body;
    }
 
    @SuppressWarnings("unchecked")
    private void sanitize(Object target, Map<Object, Boolean> visited) {
        if (target == null || visited.containsKey(target)) {
            return;
        }
        visited.put(target, Boolean.TRUE);
 
        if (target instanceof String || target instanceof Number || target instanceof Boolean || target instanceof Enum) {
            return;
        }
        if (target instanceof Collection) {
            for (Object item : (Collection<Object>) target) {
                sanitize(item, visited);
            }
            return;
        }
        if (target instanceof Map) {
            for (Map.Entry<Object, Object> entry : ((Map<Object, Object>) target).entrySet()) {
                Object value = entry.getValue();
                if (value instanceof String) {
                    entry.setValue(XssCleaner.cleanPlainText((String) value));
                } else {
                    sanitize(value, visited);
                }
            }
            return;
        }
        if (target.getClass().isArray()) {
            return;
        }
 
        Class<?> type = target.getClass();
        while (type != null && !Object.class.equals(type)) {
            Field[] fields = type.getDeclaredFields();
            for (Field field : fields) {
                if (Modifier.isStatic(field.getModifiers()) || Modifier.isFinal(field.getModifiers())) {
                    continue;
                }
                field.setAccessible(true);
                try {
                    Object value = field.get(target);
                    if (value == null) {
                        continue;
                    }
                    if (value instanceof String) {
                        String sanitized = field.isAnnotationPresent(XssSafeHtml.class)
                                ? XssCleaner.cleanRichText((String) value)
                                : XssCleaner.cleanPlainText((String) value);
                        field.set(target, sanitized);
                    } else {
                        sanitize(value, visited);
                    }
                } catch (IllegalAccessException ignored) {
                }
            }
            type = type.getSuperclass();
        }
    }
}