lsd/ks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修改请求拦截

Browse Source
This commit is contained in:
sh
2026-04-30 14:24:26 +08:00
parent b5a3205829
commit 05253c922a
1 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
ruoyi-common/src/main/java/com/ruoyi/common/filter/RequestWrapperFilter.java
View File

@@ -74,25 +74,25 @@ public class RequestWrapperFilter implements Filter {
// 先做输入规范化 + 解码，消除编码/格式绕过 // 先做输入规范化 + 解码，消除编码/格式绕过
String normalizedForwardUrl = normalizePath(forwardUrl); String normalizedForwardUrl = normalizePath(forwardUrl);
if (normalizedForwardUrl == null) { // if (normalizedForwardUrl == null) {
log.error("非法内部转发：路径格式异常 {}", LogUtils.cleanLog(forwardUrl)); // log.error("非法内部转发：路径格式异常 {}", LogUtils.cleanLog(forwardUrl));
httpResponse.sendError(InternalForwardConstants.FORBIDDEN_CODE, InternalForwardConstants.FORBIDDEN_MSG); // httpResponse.sendError(InternalForwardConstants.FORBIDDEN_CODE, InternalForwardConstants.FORBIDDEN_MSG);
return; // return;
} // }
// 优先拦截敏感路径（前置拦截，避免白名单绕过） // 优先拦截敏感路径（前置拦截，避免白名单绕过）
if (containsTraversalChars(normalizedForwardUrl) || containsSensitiveDir(normalizedForwardUrl)) { // if (containsTraversalChars(normalizedForwardUrl) || containsSensitiveDir(normalizedForwardUrl)) {
log.error("非法内部转发：包含敏感路径片段 {}", LogUtils.cleanLog(normalizedForwardUrl)); // log.error("非法内部转发：包含敏感路径片段 {}", LogUtils.cleanLog(normalizedForwardUrl));
httpResponse.sendError(InternalForwardConstants.FORBIDDEN_CODE, InternalForwardConstants.FORBIDDEN_MSG); // httpResponse.sendError(InternalForwardConstants.FORBIDDEN_CODE, InternalForwardConstants.FORBIDDEN_MSG);
return; // return;
} // }
// 白名单校验（支持全匹配 + 前缀匹配） // 白名单校验（支持全匹配 + 前缀匹配）
if (!isInWhitelist(normalizedForwardUrl)) { // if (!isInWhitelist(normalizedForwardUrl)) {
log.error("非法内部转发：不在白名单内 {}", LogUtils.cleanLog(normalizedForwardUrl)); // log.error("非法内部转发：不在白名单内 {}", LogUtils.cleanLog(normalizedForwardUrl));
httpResponse.sendError(InternalForwardConstants.FORBIDDEN_CODE, InternalForwardConstants.FORBIDDEN_MSG); // httpResponse.sendError(InternalForwardConstants.FORBIDDEN_CODE, InternalForwardConstants.FORBIDDEN_MSG);
return; // return;
} // }
if (StringUtils.isNotBlank(forwardUrl)) { if (StringUtils.isNotBlank(forwardUrl)) {
log.info("GET请求解密后转发URL：{}", LogUtils.cleanLog(forwardUrl)); log.info("GET请求解密后转发URL：{}", LogUtils.cleanLog(forwardUrl));