springcloudgateway实现XSS过滤

Spring Cloud Gateway可以通过编写自定义的过滤器实现XSS过滤。

首先，我们需要创建一个XSS过滤器类，实现`GlobalFilter`和`Ordered`接口：

@Component
public class XssGlobalFilter implements GlobalFilter, Ordered {

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        ServerHttpRequest request = exchange.getRequest();
        HttpHeaders headers = request.getHeaders();
        MediaType contentType = headers.getContentType();
        HttpMethod method = request.getMethod();
        if (contentType != null && contentType.isCompatibleWith(MediaType.APPLICATION_JSON) && HttpMethod.POST.equals(method)) {
            return chain.filter(exchange.mutate().request(new XssServerHttpRequest(request)).build());
        }
        return chain.filter(exchange);
    }

    @Override
    public int getOrder() {
        return -1;
    }
}

这里，我们首先判断请求的Content-Type是否为`application/json`，并且请求方法是否为POST，如果是，则将请求的`ServerHttpRequest`替换为我们自定义的`XssServerHttpRequest`，该类继承自`ServerHttpRequestDecorator`，在该类中对请求体进行XSS过滤，代码如下：

public class XssServerHttpRequest extends ServerHttpRequestDecorator {

    public XssServerHttpRequest(ServerHttpRequest delegate) {
        super(delegate);
    }

    @Override
    public Flux<DataBuffer> getBody() {
        Flux<DataBuffer> body = super.getBody();
        return body.map(dataBuffer -> {
            CharBuffer charBuffer = StandardCharsets.UTF_8.decode(dataBuffer.asByteBuffer());
            String bodyContent = charBuffer.toString();
            // 进行XSS过滤
            String filteredBodyContent = Jsoup.clean(bodyContent, Whitelist.none());
            byte[] bytes = filteredBodyContent.getBytes(StandardCharsets.UTF_8);
            DataBuffer buffer = new DefaultDataBufferFactory().wrap(bytes);
            DataBufferUtils.release(dataBuffer);
            return buffer;
        });
    }
}

在该类中，我们首先将`DataBuffer`转换成`CharBuffer`，再将其转换成字符串，然后使用Jsoup对字符串进行XSS过滤，最后再将过滤后的字符串转换成`DataBuffer`返回。

最后，我们需要将这个过滤器添加到Spring Cloud Gateway的过滤器链中，在配置类中添加：

@Configuration
public class GatewayConfig {

    @Bean
    public XssGlobalFilter xssGlobalFilter() {
        return new XssGlobalFilter();
    }

    @Bean
    public RouteLocator customRouteLocator(RouteLocatorBuilder builder) {
        return builder.routes()
                // 添加自定义路由
                .route(r -> r.path("/api/**").uri("lb://service-provider"))
                .build();
    }
}

这样，当请求Content-Type为`application/json`，并且请求方法为POST时，请求体中的HTML标签就会被过滤掉，从而实现XSS过滤。