package com.tcm.training.admin.common.xss;
|
|
import org.springframework.stereotype.Component;
|
import org.springframework.web.servlet.HandlerInterceptor;
|
|
import javax.servlet.http.HttpServletRequest;
|
import javax.servlet.http.HttpServletResponse;
|
import java.util.Map;
|
|
@Component
|
public class XssParamInterceptor implements HandlerInterceptor {
|
|
@Override
|
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
|
Map<String, String[]> parameterMap = request.getParameterMap();
|
for (Map.Entry<String, String[]> entry : parameterMap.entrySet()) {
|
String[] values = entry.getValue();
|
if (values == null) {
|
continue;
|
}
|
for (String value : values) {
|
if (XssCleaner.containsRiskyPlainText(value)) {
|
throw new IllegalArgumentException("请求参数包含非法脚本内容");
|
}
|
}
|
}
|
return true;
|
}
|
}
|
