package cn.iocoder.yudao.framework.xss.config;
|
|
import cn.iocoder.yudao.framework.common.enums.WebFilterOrderEnum;
|
import cn.iocoder.yudao.framework.xss.core.clean.JsoupXssCleaner;
|
import cn.iocoder.yudao.framework.xss.core.clean.XssCleaner;
|
import cn.iocoder.yudao.framework.xss.core.filter.XssFilter;
|
import cn.iocoder.yudao.framework.xss.core.json.XssStringJsonDeserializer;
|
import org.springframework.boot.autoconfigure.AutoConfiguration;
|
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
|
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
|
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
|
import org.springframework.boot.jackson.autoconfigure.JsonMapperBuilderCustomizer;
|
import org.springframework.boot.context.properties.EnableConfigurationProperties;
|
import org.springframework.boot.web.servlet.FilterRegistrationBean;
|
import org.springframework.context.annotation.Bean;
|
import org.springframework.util.PathMatcher;
|
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
|
|
import static cn.iocoder.yudao.framework.web.config.YudaoWebAutoConfiguration.createFilterBean;
|
|
@AutoConfiguration
|
@EnableConfigurationProperties(XssProperties.class)
|
@ConditionalOnProperty(prefix = "yudao.xss", name = "enable", havingValue = "true", matchIfMissing = true) // 设置为 false 时，禁用
|
public class YudaoXssAutoConfiguration implements WebMvcConfigurer {
|
|
/**
|
* Xss 清理者
|
*
|
* @return XssCleaner
|
*/
|
@Bean
|
@ConditionalOnMissingBean(XssCleaner.class)
|
public XssCleaner xssCleaner() {
|
return new JsoupXssCleaner();
|
}
|
|
/**
|
* 注册 Jackson 的序列化器，用于处理 json 类型参数的 xss 过滤
|
*
|
* @return JsonMapperBuilderCustomizer
|
*/
|
@Bean
|
@ConditionalOnMissingBean(name = "xssJacksonCustomizer")
|
@ConditionalOnProperty(value = "yudao.xss.enable", havingValue = "true")
|
public JsonMapperBuilderCustomizer xssJacksonCustomizer(XssProperties properties,
|
PathMatcher pathMatcher,
|
XssCleaner xssCleaner) {
|
// 在反序列化时进行 xss 过滤，可以替换使用 XssStringJsonSerializer，在序列化时进行处理
|
return builder -> builder.addModule(new tools.jackson.databind.module.SimpleModule("XssStringModule")
|
.addDeserializer(String.class, new XssStringJsonDeserializer(properties, pathMatcher, xssCleaner)));
|
}
|
|
/**
|
* 创建 XssFilter Bean，解决 Xss 安全问题
|
*/
|
@Bean
|
@ConditionalOnBean(XssCleaner.class)
|
public FilterRegistrationBean<XssFilter> xssFilter(XssProperties properties, PathMatcher pathMatcher, XssCleaner xssCleaner) {
|
return createFilterBean(new XssFilter(properties, pathMatcher, xssCleaner), WebFilterOrderEnum.XSS_FILTER);
|
}
|
|
}
|
