KH/kh-device-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix 68403 【安全】存在Referer问题

Browse Source
This commit is contained in:
liao
2023-05-06 10:15:39 +08:00
parent f517cca6f5
commit 75b8f4a40c
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/CsrfFilter.java
+2 -2
View File
@@ -57,7 +57,7 @@ public class CsrfFilter implements Filter {
String url = req.getRequestURL().toString(); String url = req.getRequestURL().toString();
// 获取来源 // 获取来源
String referurl = req.getHeader("Referer"); String referurl = req.getHeader("Referer");
if(isWhiteReq(referurl)){ if(isWhiteReq(referurl) || url.contains("/websocket/") || url.contains("download")){
chain.doFilter(request, response); chain.doFilter(request, response);
}else{ }else{
String log = ""; String log = "";
@@ -81,7 +81,7 @@ public class CsrfFilter implements Filter {
*/ */
private boolean isWhiteReq(String referUrl) { private boolean isWhiteReq(String referUrl) {
if (referUrl == null || "".equals(referUrl) || size == 0) { if (referUrl == null || "".equals(referUrl) || size == 0) {
return true; return false;
} else { } else {
String refHost = ""; String refHost = "";
referUrl = referUrl.toLowerCase(); referUrl = referUrl.toLowerCase();
jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml
+1 -1
View File
@@ -272,7 +272,7 @@ jero:
# 文件限制后缀黑名单 # 文件限制后缀黑名单
fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin
# 跨站白名单 # 跨站白名单
whiteUrls: whiteUrls: localhost:3000
# 加密默认值 # 加密默认值
password: password:
pbe: pbe: