|
|
|
@ -18,22 +18,26 @@
|
|
|
|
|
|
|
|
|
|
package com.tencent.cloud.polaris.gateway.example.callee.xss;
|
|
|
|
|
|
|
|
|
|
import com.fasterxml.jackson.core.JsonProcessingException;
|
|
|
|
|
import com.fasterxml.jackson.databind.ObjectMapper;
|
|
|
|
|
import org.apache.commons.lang.StringEscapeUtils;
|
|
|
|
|
import org.springframework.web.servlet.HandlerMapping;
|
|
|
|
|
|
|
|
|
|
import javax.servlet.ReadListener;
|
|
|
|
|
import javax.servlet.ServletInputStream;
|
|
|
|
|
import javax.servlet.http.HttpServletRequest;
|
|
|
|
|
import javax.servlet.http.HttpServletRequestWrapper;
|
|
|
|
|
import java.io.BufferedReader;
|
|
|
|
|
import java.io.ByteArrayInputStream;
|
|
|
|
|
import java.io.IOException;
|
|
|
|
|
import java.io.InputStreamReader;
|
|
|
|
|
import java.util.*;
|
|
|
|
|
import java.util.Collections;
|
|
|
|
|
import java.util.Enumeration;
|
|
|
|
|
import java.util.List;
|
|
|
|
|
import java.util.Map;
|
|
|
|
|
import java.util.stream.Collectors;
|
|
|
|
|
import java.util.stream.Stream;
|
|
|
|
|
|
|
|
|
|
import javax.servlet.ReadListener;
|
|
|
|
|
import javax.servlet.ServletInputStream;
|
|
|
|
|
import javax.servlet.http.HttpServletRequest;
|
|
|
|
|
import javax.servlet.http.HttpServletRequestWrapper;
|
|
|
|
|
|
|
|
|
|
import com.fasterxml.jackson.core.JsonProcessingException;
|
|
|
|
|
import com.fasterxml.jackson.databind.ObjectMapper;
|
|
|
|
|
import org.apache.commons.lang.StringEscapeUtils;
|
|
|
|
|
|
|
|
|
|
import org.springframework.web.servlet.HandlerMapping;
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Wrap HttpServletRequest to escape String arguments
|
|
|
|
@ -69,11 +73,10 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
|
|
|
|
|
/**
|
|
|
|
|
* Handles arguments annotated by @RequestBody
|
|
|
|
|
*
|
|
|
|
|
* @return
|
|
|
|
|
* @throws IOException
|
|
|
|
|
* @return ServletInputStream
|
|
|
|
|
*/
|
|
|
|
|
@Override
|
|
|
|
|
public ServletInputStream getInputStream() throws IOException {
|
|
|
|
|
public ServletInputStream getInputStream() {
|
|
|
|
|
final ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(requestBody);
|
|
|
|
|
return new ServletInputStream() {
|
|
|
|
|
@Override
|
|
|
|
@ -101,7 +104,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
|
|
|
|
|
/**
|
|
|
|
|
* Handles arguments annotated by @RequestParam
|
|
|
|
|
*
|
|
|
|
|
* @param name
|
|
|
|
|
* @param name string parameter
|
|
|
|
|
* @return
|
|
|
|
|
*/
|
|
|
|
|
@Override
|
|
|
|
@ -120,7 +123,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
|
|
|
|
|
/**
|
|
|
|
|
* Handles arguments annotated by @PathVariable
|
|
|
|
|
*
|
|
|
|
|
* @param name
|
|
|
|
|
* @param name string parameter
|
|
|
|
|
* @return
|
|
|
|
|
*/
|
|
|
|
|
@Override
|
|
|
|
@ -140,7 +143,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
|
|
|
|
|
/**
|
|
|
|
|
* Handles arguments annotated by @RequestHeader
|
|
|
|
|
*
|
|
|
|
|
* @param name
|
|
|
|
|
* @param name string parameter
|
|
|
|
|
* @return
|
|
|
|
|
*/
|
|
|
|
|
@Override
|
|
|
|
@ -155,7 +158,8 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
|
|
|
|
|
map.put(k, v);
|
|
|
|
|
});
|
|
|
|
|
e = objectMapper.writeValueAsString(map);
|
|
|
|
|
} catch (JsonProcessingException e1) {
|
|
|
|
|
}
|
|
|
|
|
catch (JsonProcessingException e1) {
|
|
|
|
|
e1.printStackTrace();
|
|
|
|
|
}
|
|
|
|
|
return e;
|
|
|
|
@ -180,7 +184,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
|
|
|
|
|
/**
|
|
|
|
|
* Escape string to defend against XSS
|
|
|
|
|
*
|
|
|
|
|
* @param value
|
|
|
|
|
* @param value string request body
|
|
|
|
|
*/
|
|
|
|
|
private String cleanXSS(String value) {
|
|
|
|
|
value = StringEscapeUtils.escapeHtml(value);
|
|
|
|
|