SpringBoot去除参数前后空格和XSS过滤

<dependency>
    <groupId>org.jsoup</groupId>
    <artifactId>jsoup</artifactId>
    <version>1.12.1</version>
</dependency>

import org.jsoup.Jsoup;
import org.jsoup.nodes.Document;
import org.jsoup.safety.Whitelist;


public class JsoupUtil {
    
    private static final Whitelist whitelist = Whitelist.basicWithImages();
    
    private static final Document.OutputSettings outputSettings = new Document.OutputSettings().prettyPrint(false);
    static {
        // 富文本编辑时一些样式是使用 style 来进行实现的
        // 比如红色字体 style="color:red;"
        // 所以需要给所有标签添加 style 属性
        whitelist.addAttributes(":all", "style");
    }
    public static String clean(String content) {
        return Jsoup.clean(content, "", whitelist, outputSettings);
    }
}

import javax.servlet.*;
import javax.servlet.Http.httpservletRequest;
import java.io.IOException;


public class ParamsFilter implements Filter {

    @Override
    public void doFilter(ServletRequest arg0, ServletResponse arg1,
                         FilterChain arg2) throws IOException, ServletException {
        ParameterRequestWrapper parmsRequest = new ParameterRequestWrapper(
                (HttpServletRequest) arg0);
        arg2.doFilter(parmsRequest, arg1);
    }

    @Override
    public void init(FilterConfig arg0) throws ServletException {

    }

    @Override
    public void destroy() {

    }
}

import GC.cnnvd.framework.core.filter.ParamsFilter;
import org.springframework.boot.WEB.servlet.FilterReGIStrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import javax.servlet.DispatcherType;

@Configuration
public class ParameterTrimConfig {

    
    @Bean
    public FilterRegistrationBean parmsFilterRegistration() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setDispatcherTypes(DispatcherType.REQUEST);
        registration.setFilter(new ParamsFilter());
        registration.addUrlPatterns("
public class ParameterRequestWrapper extends HttpServletRequestWrapper {

    private Map<String , String[]> params = new HashMap<>();


    public ParameterRequestWrapper(HttpServletRequest request) {
        // 将request交给父类，以便于调用对应方法的时候，将其输出，其实父亲类的实现方式和第一种new的方式类似
        super(request);
        //将参数表，赋予给当前的Map以便于持有request中的参数
        Map<String, String[]> requestMap=request.getParameterMap();

        this.params.putAll(requestMap);
        this.modifyParameterValues();

    }
    
    @Override
    public ServletInputStream getInputStream() throws IOException {
        //非JSON类型，直接返回
        if (!MediaType.APPLICATION_JSON_VALUE.equalsIgnoreCase(super.getHeader(HttpHeaders.CONTENT_TYPE))){
            return super.getInputStream();
        }
        //为空，直接返回
        String json = IOUtils.toString(super.getInputStream(), StandardCharsets.UTF_8);
        if (StringUtils.isEmpty(json)) {
            return super.getInputStream();
        }
        Object resultObject = JsonValueTrimUtil.jsonStrTrim(json);//这里处理的是json传参的参数
        ByteArrayInputStream bis = new ByteArrayInputStream(JSON.toJSONString(resultObject).getBytes(StandardCharsets.UTF_8));
        return new CustomServletInputStream(bis);

    }
    
    public void modifyParameterValues(){
        Set<String> set = params.keySet();
        Iterator<String> it = set.iterator();
        while(it.hasNext()){
            String key = it.next();
            String[] values = params.get(key);
            values[0] = values[0].trim();
            values[0] = JsoupUtil.clean(values[0]);//这里处理的是fORM传参的参数
            params.put(key, values);
        }
    }
    
    @Override
    public String getParameter(String name) {
        String[]values = params.get(name);
        if(values == null || values.length == 0) {
            return null;
        }
        return values[0];
    }
    
    @Override
    public String[] getParameterValues(String name) {//同上
        return params.get(name);
    }

    class CustomServletInputStream extends  ServletInputStream{
        private ByteArrayInputStream bis;
        public CustomServletInputStream(ByteArrayInputStream bis){
            this.bis=bis;
        }
        @Override
        public boolean isFinished() {
            return true;
        }

        @Override
        public boolean isReady() {
            return true;
        }

        @Override
        public void setReadListener(ReadListener listener) {

        }
        @Override
        public int read() throws IOException {
            return bis.read();
        }
    }
}

import cn.hutool.json.JSONTokener;
import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
import gc.cnnvd.framework.util.JsoupUtil;
import org.apache.commons.lang3.StringUtils;

import java.util.Map;
import java.util.Set;



public class JsonValueTrimUtil {

    public static Object jsonStrTrim(String jsonStr){
        if (StringUtils.isBlank(jsonStr)){
            return "";
        }
        Object typeObject = new JSONTokener(jsonStr).nextValue();
        if (typeObject instanceof cn.hutool.json.JSONObject){
            return jsonObjectTrim(JSONObject.parseObject(jsonStr));
        }
        if (typeObject instanceof cn.hutool.json.JSONArray){
            return jsonArrayTrim(JSONArray.parseArray(jsonStr));
        }
        jsonStr = JsoupUtil.clean(jsonStr);
        return jsonStr.trim();
    }

    
    public static JSONObject jsonObjectTrim(JSONObject jsonObject){
        // 取出 jsonObject 中的字段的值的空格
        Set<Map.Entry<String, Object>> entrySets = jsonObject.entrySet();
        entrySets.forEach(entry -> {
            Object value = entry.getValue();
            if (value == null){
                return;
            }
            if (value instanceof String) {
                String resultValue = (String) value;
                if (StringUtils.isNotBlank(resultValue)){
                    resultValue = resultValue.trim();
                    resultValue = JsoupUtil.clean(resultValue);
                    jsonObject.put(entry.geTKEy(), resultValue);
                }
                return;
            }
            if (value instanceof JSONObject){
                jsonObject.put(entry.getKey(), jsonObjectTrim((JSONObject) value));
                return;
            }
            if (value instanceof JSONArray){
                jsonObject.put(entry.getKey(), jsonArrayTrim((JSONArray) value));
                return;
            }
        });
        return jsonObject;
    }

    
    public static JSONArray jsonArrayTrim(JSONArray arr){
        if( arr != null && arr.size() > 0){
            Object tempObject = null;
            for (int i = 0; i < arr.size(); i++) {
                tempObject = arr.get(i);
                if (tempObject instanceof String){
                    arr.set(i,  tempObject );
                    continue;
                }
                JSONObject jsonObject = (JSONObject) arr.get(i);
                // 取出 jsonObject 中的字段的值的空格
                jsonObject = jsonObjectTrim(jsonObject);
                arr.set(i,  jsonObject );
            }
        }
        return arr;
    }
}

import gc.cnnvd.framework.common.api.ApiResult;
import gc.cnnvd.framework.log.annotation.OperationLogIgnore;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiModel;
import io.swagger.annotations.ApiModelProperty;
import io.swagger.annotations.ApiOperation;
import lombok.Data;
import lombok.experimental.Accessors;
import lombok.extern.slf4j.Slf4j;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import javax.validation.constraints.NotBlank;
import java.io.Serializable;



@Slf4j
@RestController
@RequestMapping("/tourist")
@Api(value = "测试游客页面xss", tags = {"游客页面xss"})
public class TouristTestXssController {

    @PostMapping("/testXssForm")
    @OperationLogIgnore
    @ApiOperation(value = "测试放开游客页面接口xssForm", notes = "测试放开游客页面接口xssForm", response = String.class)
    public ApiResult<String> testXss(TestXssFormParam testXssFormParam) {
        log.info("form param testStr:[{}]", testXssFormParam.getTestStr());
        // from 不好使
        return ApiResult.ok(testXssFormParam.getTestStr());
    }

    @PostMapping("/testXssJson")
    @OperationLogIgnore
    @ApiOperation(value = "测试放开游客页面接口xssJson", notes = "测试放开游客页面接口xssJson", response = String.class)
    public ApiResult<String> testXssJson(@Validated @RequestBody TestXssFormParam testXssFormParam) {
        log.info("json param testStr:[{}]", testXssFormParam.getTestStr());
        return ApiResult.ok(testXssFormParam.getTestStr());
    }

    @Data
    @Accessors(chain = true)
    @ApiModel(value = "testXss参数")
    public static class TestXssFormParam implements Serializable {

        private static final long serialVersionUID = 1L;

        @NotBlank(message = "testStr不能为空")
        @ApiModelProperty("testStr")
        private String testStr;
    }

}