From 9ea2b9d560f515e27b90721bb4b1cb65700e6a25 Mon Sep 17 00:00:00 2001 From: shil <452061493@qq.com> Date: Wed, 30 Apr 2025 16:22:17 +0800 Subject: [PATCH] =?UTF-8?q?=E5=AF=8C=E6=96=87=E6=9C=AC=E8=A2=ABxss?= =?UTF-8?q?=E8=BF=87=E6=BB=A4=E5=99=A8=E4=BF=AE=E6=94=B9=E5=AF=BC=E8=87=B4?= =?UTF-8?q?=E7=9A=84=E9=97=AE=E9=A2=98=E6=8F=90=E4=BA=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../zdxt/auth/framework/config/XssAndSqlFilter.java | 10 ++++++++++ .../java/com/zdxt/auth/framework/config/XssFilter.java | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlFilter.java index 773b54c0..1bbf8bcd 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlFilter.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssAndSqlFilter.java @@ -31,6 +31,16 @@ public class XssAndSqlFilter implements Filter { XssAndSqlHttpServletRequestWrapper xssRequest = null; if (request instanceof HttpServletRequest) { method = ((HttpServletRequest) request).getMethod(); + + // 解决不需要xss也被拦截的问题 + HttpServletRequest req = (HttpServletRequest) request; + //获取请求你ip后的全部路径 + String uri = req.getRequestURI(); + if (uri.indexOf("/system/notice/") >= 0) { + chain.doFilter(request, response); + return; + } + //获取请求你ip后的全部路径 xssRequest = new XssAndSqlHttpServletRequestWrapper((HttpServletRequest) request); } if ("POST".equalsIgnoreCase(method)) { diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssFilter.java index 899ef091..00bcc047 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssFilter.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssFilter.java @@ -16,7 +16,7 @@ public class XssFilter implements Filter { // 忽略权限检查的url地址 private final String[] excludeUrls = new String[]{ - "null" + "/system/notice/" }; public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2)