| | |
|---|
| | | @ConditionalOnProperty(value = "security.xss.enabled", havingValue = "true") |
|---|
| | | public class XssFilter implements GlobalFilter, Ordered { |
|---|
| | | private static final Logger log = LoggerFactory.getLogger(XssFilter.class); |
|---|
| | | private static final Set<String> RICH_TEXT_URLS = new HashSet<>(Arrays.asList( |
|---|
| | | "/system/faq" |
|---|
| | | )); |
|---|
| | | // 跨站脚本的 xss 配置，nacos自行添加 |
|---|
| | | @Autowired |
|---|
| | | private XssProperties xss; |
|---|
| | |
|---|
| | | } |
|---|
| | | // excludeUrls 不过滤 |
|---|
| | | String url = request.getURI().getPath(); |
|---|
| | | if (StringUtils.matches(url, xss.getExcludeUrls())) { |
|---|
| | | if (StringUtils.matches(url, xss.getExcludeUrls()) || RICH_TEXT_URLS.contains(url)) { |
|---|
| | | return chain.filter(exchange); |
|---|
| | | } |
|---|
| | | ServerHttpRequestDecorator httpRequestDecorator = requestDecorator(exchange); |
|---|
