XSS脚本过滤详解

ruoyi-admin/src/main/resources/application.yml

# 防止XSS攻击
xss: 
  # 过滤开关
  enabled: true
  # 排除链接（多个用逗号分隔）
  excludes: /system/notice
  # 匹配链接
  urlPatterns: /system/*,/monitor/*,/tool/*

1
2
3
4
5
6
7
8

通用过滤器配置

ruoyi-framework/src/main/java/com/ruoyi/framework/config/FilterConfig.java

@Bean
    @ConditionalOnProperty(value = "xss.enabled", havingValue = "true")
    public FilterRegistrationBean xssFilterRegistration()
    {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setDispatcherTypes(DispatcherType.REQUEST);
        registration.setFilter(new XssFilter());
        registration.addUrlPatterns(StringUtils.split(urlPatterns, ","));
        registration.setName("xssFilter");
        registration.setOrder(FilterRegistrationBean.HIGHEST_PRECEDENCE);
        Map<String, String> initParameters = new HashMap<String, String>();
        initParameters.put("excludes", excludes);
        registration.setInitParameters(initParameters);
        return registration;
    }

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

ruoyi-common/src/main/java/com/ruoyi/common/filter/XssFilter.java

上次更新: 2025/04/03, 11:07:08

← 系统接口实现详解防止重复提交过滤详解→