content: package com.java2nb.novel.core.filter;
  
  import com.java2nb.novel.core.wrapper.XssHttpServletRequestWrapper;
  import jakarta.servlet.*;
  import jakarta.servlet.http.HttpServletRequest;
  import lombok.SneakyThrows;
  import org.apache.commons.lang3.StringUtils;
  
  import java.util.ArrayList;
  import java.util.Arrays;
  import java.util.List;
  import java.util.regex.Matcher;
  import java.util.regex.Pattern;
  
  /**
   * 防止XSS攻击的过滤器
   * @author Administrator
   */
  public class XssFilter implements Filter {
      /**
       * 排除链接
       */
      public List<String> excludes = new ArrayList<>();
  
      /**
       * xss过滤开关
       */
      public boolean enabled = false;
  
      @SneakyThrows
      @Override
      public void init(FilterConfig filterConfig){
          String tempExcludes = filterConfig.getInitParameter("excludes");
          String tempEnabled = filterConfig.getInitParameter("enabled");
          if (StringUtils.isNotBlank(tempExcludes)) {
              String[] url = tempExcludes.split(",");
              excludes.addAll(Arrays.asList(url));
          }
          if (StringUtils.isNotEmpty(tempEnabled)) {
              enabled = Boolean.parseBoolean(tempEnabled);
          }
      }
  
      @SneakyThrows
      @Override
      public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
              {
          HttpServletRequest req = (HttpServletRequest) request;
                  if (handleExcludeURL(req)) {
              chain.doFilter(request, response);
              return;
          }
          XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest) request);
          chain.doFilter(xssRequest, response);
      }
  
      private boolean handleExcludeURL(HttpServletRequest request) {
          if (!enabled) {
              return true;
          }
          if (excludes == null || excludes.isEmpty()) {
              return false;
          }
          String url = request.getServletPath();
          for (String pattern : excludes) {
              Pattern p = Pattern.compile("^" + pattern);
              Matcher m = p.matcher(url);
              if (m.find()) {
                  return true;
              }
          }
          return false;
      }
  
      @Override
      public void destroy() {
  
      }
  }
  