SpringCloud gateway 防止XSS漏洞_springcloud项目添加xss防护

        //从请求里获取Post请求体
        String bodyStr = resolveBodyFromRequest(serverHttpRequest);
        // 这种处理方式，必须保证post请求时，原始post表单必须有数据过来，不然会报错
        if (StringUtils.isBlank(bodyStr)) {
            logger.error("请求异常：{} POST请求必须传递参数", serverHttpRequest.getURI().getRawPath());
            ServerHttpResponse response = exchange.getResponse();
            response.setStatusCode(HttpStatus.BAD\_REQUEST);
            byte[] bytes = "{\"code\":400,\"msg\":\"post data error\"}".getBytes(StandardCharsets.UTF\_8);
            DataBuffer buffer = response.bufferFactory().wrap(bytes);
            return response.writeWith(Mono.just(buffer));
        }
        //白名单处理（看业务需求）
        boolean containsTarget = WhiteListUtils.richTextUrls.stream().anyMatch(s -> path.contains(s));
        if (containsTarget) {
            //bodyStr = XssCleanRuleUtils.xssRichTextClean(bodyStr);
            bodyStr = XssCleanRuleUtils.xssClean2(bodyStr);
        } else {
            bodyStr = XssCleanRuleUtils.xssClean(bodyStr);
        }

        URI uri = serverHttpRequest.getURI();
        URI newUri = UriComponentsBuilder.fromUri(uri).build(true).toUri();
        ServerHttpRequest request = exchange.getRequest().mutate().uri(newUri).build();
        DataBuffer bodyDataBuffer = stringBuffer(bodyStr);
        Flux<DataBuffer> bodyFlux = Flux.just(bodyDataBuffer);

        // 定义新的消息头
        HttpHeaders headers = new HttpHeaders();
        headers.putAll(exchange.getRequest().getHeaders());


        // 由于修改了传递参数，需要重新设置CONTENT\_LENGTH，长度是字节长度，不是字符串长度
        int length = bodyStr.getBytes().length;
        headers.remove(HttpHeaders.CONTENT\_LENGTH);
        headers.setContentLength(length);

        // 设置CONTENT\_TYPE
        if (StringUtils.isNotBlank(contentType)) {
            headers.set(HttpHeaders.CONTENT\_TYPE, contentType);
        }

        // 由于post的body只能订阅一次，由于上面代码中已经订阅过一次body。所以要再次封装请求到request才行，不然会报错请求已经订阅过
        request = new ServerHttpRequestDecorator(request) {
            @Override
            public HttpHeaders getHeaders() {
                long contentLength = headers.getContentLength();
                HttpHeaders httpHeaders = new HttpHeaders();
                httpHeaders.putAll(super.getHeaders());
                if (contentLength > 0) {
                    httpHeaders.setContentLength(contentLength);
                } else {
                    // this causes a 'HTTP/1.1 411 Length Required' on httpbin.org
                    httpHeaders.set(HttpHeaders.TRANSFER\_ENCODING, "chunked");
                }
                return httpHeaders;
            }

            @Override
            public Flux<DataBuffer> getBody() {
                return bodyFlux;
            }
        };

        //封装request，传给下一级
        request.mutate().header(HttpHeaders.CONTENT\_LENGTH, Integer.toString(bodyStr.length()));
        return chain.filter(exchange.mutate().request(request).build());
    } else {
        return chain.filter(exchange);
    }

}

@Override
public int getOrder() {
    return -90;
}

/\*\*

* 从Flux中获取字符串的方法
* @return 请求体
*/
private String resolveBodyFromRequest(ServerHttpRequest serverHttpRequest) {
//获取请求体
Flux body = serverHttpRequest.getBody();
AtomicReference bodyRef = new AtomicReference<>();
body.subscribe(buffer -> {
CharBuffer charBuffer = StandardCharsets.UTF_8.decode(bu