fix 68403 【安全】存在Referer问题

jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/CsrfFilter.java

@@ -57,7 +57,7 @@ public class CsrfFilter implements Filter {
             String url = req.getRequestURL().toString();
             // 获取来源
             String referurl = req.getHeader("Referer");
-            if(isWhiteReq(referurl)){
+            if(isWhiteReq(referurl) || url.contains("/websocket/") || url.contains("download")){
                 chain.doFilter(request, response);
             }else{
                 String log = "";
@@ -81,7 +81,7 @@ public class CsrfFilter implements Filter {
      */
     private boolean isWhiteReq(String referUrl) {
         if (referUrl == null || "".equals(referUrl) || size == 0) {
-            return true;
+            return false;
         } else {
             String refHost = "";
             referUrl = referUrl.toLowerCase();

jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml

@@ -272,7 +272,7 @@ jero:
   # 文件限制后缀黑名单
   fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin
   # 跨站白名单
-  whiteUrls:
+  whiteUrls: localhost:3000
   # 加密默认值
   password:
     pbe: