JAVA----参数过滤器配置文件，配置参数，实现：防XSS，去掉参数左右空格

实现功能：防参数XSS攻击，去掉参数左右空格

ParamsFilterConfig 参数过滤配置文件

Configuration
public class ParamsFilterConfig {

    @Value("${xss.enabled}")
    private String enabled;

    @Value("${xss.excludes}")
    private String excludes;

    @Value("${xss.urlPatterns}")
    private String urlPatterns;

    @SuppressWarnings({"rawtypes", "unchecked"})
    @Bean
    public FilterRegistrationBean xssFilterRegistration() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setDispatcherTypes(DispatcherType.REQUEST);
        registration.setFilter(new XssFilter());
        registration.addUrlPatterns(StringUtils.split(urlPatterns, ","));
        registration.setName("xssFilter");
        registration.setOrder(Integer.MAX_VALUE);

        Map<String, String> initParameters = new HashMap<>();
        initParameters.put("excludes", excludes);
        initParameters.put("enabled", enabled);
        registration.setInitParameters(initParameters);

        return registration;
    }
}

配置参数配置

xss:
  enabled: true                             # 过滤开关
  excludes: /download/*,/upload/*           # 排除url
  urlPatterns: /*                           # 匹配url