From cfbe74b3631d5a056cd4d5675cc3aac6cf35ce0f Mon Sep 17 00:00:00 2001 From: iwangjie <345127857@qq.com> Date: Tue, 7 Mar 2023 23:34:56 +0800 Subject: [PATCH 1/4] xss plugin --- .../main/resources/sql-script/h2/schema.sql | 26 ++++- shenyu-bootstrap/pom.xml | 8 ++ .../common/dto/convert/rule/XssHandle.java | 101 ++++++++++++++++++ .../shenyu/common/enums/PluginEnum.java | 7 +- shenyu-e2e/pom.xml | 7 +- shenyu-plugin/pom.xml | 1 + shenyu-plugin/shenyu-plugin-xss/pom.xml | 62 +++++++++++ .../apache/shenyu/plugin/xss/XssPlugin.java | 83 ++++++++++++++ .../shenyu/plugin/xss/config/XssConfig.java | 52 +++++++++ .../xss/handler/XssPluginDataHandler.java | 65 +++++++++++ .../shenyu/plugin/xss/utils/XSSUtils.java | 68 ++++++++++++ .../shenyu-spring-boot-starter-plugin/pom.xml | 1 + .../pom.xml | 51 +++++++++ .../plugin/xss/XssPluginConfiguration.java | 54 ++++++++++ .../main/resources/META-INF/spring.factories | 19 ++++ .../main/resources/META-INF/spring.provides | 18 ++++ 16 files changed, 611 insertions(+), 12 deletions(-) create mode 100644 shenyu-common/src/main/java/org/apache/shenyu/common/dto/convert/rule/XssHandle.java create mode 100644 shenyu-plugin/shenyu-plugin-xss/pom.xml create mode 100644 shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/XssPlugin.java create mode 100644 shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/config/XssConfig.java create mode 100644 shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/handler/XssPluginDataHandler.java create mode 100644 shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/utils/XSSUtils.java create mode 100644 shenyu-spring-boot-starter/shenyu-spring-boot-starter-plugin/shenyu-spring-boot-starter-plugin-xss/pom.xml create mode 100644 shenyu-spring-boot-starter/shenyu-spring-boot-starter-plugin/shenyu-spring-boot-starter-plugin-xss/src/main/java/org/apache/shenyu/springboot/starter/plugin/xss/XssPluginConfiguration.java create mode 100644 shenyu-spring-boot-starter/shenyu-spring-boot-starter-plugin/shenyu-spring-boot-starter-plugin-xss/src/main/resources/META-INF/spring.factories create mode 100644 shenyu-spring-boot-starter/shenyu-spring-boot-starter-plugin/shenyu-spring-boot-starter-plugin-xss/src/main/resources/META-INF/spring.provides diff --git a/shenyu-admin/src/main/resources/sql-script/h2/schema.sql b/shenyu-admin/src/main/resources/sql-script/h2/schema.sql index 84c0248357c9..661dd14afdbc 100755 --- a/shenyu-admin/src/main/resources/sql-script/h2/schema.sql +++ b/shenyu-admin/src/main/resources/sql-script/h2/schema.sql @@ -501,13 +501,24 @@ INSERT IGNORE INTO `shenyu_dict` (`id`, `type`,`dict_code`, `dict_name`, `dict_v INSERT IGNORE INTO `shenyu_dict` (`id`, `type`,`dict_code`, `dict_name`, `dict_value`, `desc`, `sort`, `enabled`) VALUES ('1630761573833920512', 'mapType', 'mapType', 'all', 'all', '', 0, 1); INSERT IGNORE INTO `shenyu_dict` (`id`, `type`,`dict_code`, `dict_name`, `dict_value`, `desc`, `sort`, `enabled`) VALUES ('1630761984393367552', 'mapType', 'mapType', 'field', 'field', '', 1, 1); -/*plugin*/ +INSERT IGNORE INTO `shenyu_dict` (`id`, `type`,`dict_code`, `dict_name`, `dict_value`, `desc`, `sort`, `enabled`) VALUES ('1630761984393367553', 'reqAttack', 'ATTACK', 'intercept', 'intercept', '', 3, 1); +INSERT IGNORE INTO `shenyu_dict` (`id`, `type`,`dict_code`, `dict_name`, `dict_value`, `desc`, `sort`, `enabled`) VALUES ('1630761984393367554', 'reqAttack', 'ATTACK', 'replace', 'replace', '', 2, 1); +INSERT IGNORE INTO `shenyu_dict` (`id`, `type`,`dict_code`, `dict_name`, `dict_value`, `desc`, `sort`, `enabled`) VALUES ('1630761984393367555', 'reqAttack', 'ATTACK', 'close', 'close', '', 1, 1); + +INSERT IGNORE INTO `shenyu_dict` (`id`, `type`,`dict_code`, `dict_name`, `dict_value`, `desc`, `sort`, `enabled`) VALUES ('1630761984393367556', 'resAttack', 'ATTACK', 'replace', 'replace', '', 2, 1); +INSERT IGNORE INTO `shenyu_dict` (`id`, `type`,`dict_code`, `dict_name`, `dict_value`, `desc`, `sort`, `enabled`) VALUES ('1630761984393367557', 'resAttack', 'ATTACK', 'close', 'close', '', 1, 1); + +INSERT IGNORE INTO `shenyu_dict` (`id`, `type`,`dict_code`, `dict_name`, `dict_value`, `desc`, `sort`, `enabled`) VALUES ('1630761984393367558', 'cookieAttack', 'ATTACK', 'tolerance', 'tolerance', '', 2, 1); +INSERT IGNORE INTO `shenyu_dict` (`id`, `type`,`dict_code`, `dict_name`, `dict_value`, `desc`, `sort`, `enabled`) VALUES ('1630761984393367559', 'cookieAttack', 'ATTACK', 'close', 'close', '', 1, 1); + + INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `enabled`) VALUES ('1','sign','Authentication', 20, '0'); INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`,`config`,`enabled`) VALUES ('2','waf', 'Authentication', 50,'{"model":"black"}','0'); -INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `enabled`) VALUES ('3','rewrite', 'HttpProcess', 90,'0'); -INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `config`,`enabled`) VALUES ('4','rateLimiter','FaultTolerance', 60,'{"master":"mymaster","mode":"standalone","url":"192.168.1.1:6379","password":"abc"}', '0'); -INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `config`,`enabled`) VALUES ('5','divide', 'Proxy', 200,'{"multiSelectorHandle":"1","multiRuleHandle":"0"}','1'); -INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `config`,`enabled`) VALUES ('6','dubbo','Proxy', 310,'{"register":"zookeeper://localhost:2181","multiSelectorHandle":"1","threadpool":"shared","corethreads":0,"threads":2147483647,"queues":0}', '0'); +INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`,`config`,`enabled`) VALUES ('3','xss', 'Authentication', 55,'{"request":"intercept","response":"close","cookie":"close"}','1'); +INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `enabled`) VALUES ('4','rewrite', 'HttpProcess', 90,'0'); +INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `config`,`enabled`) VALUES ('5','rateLimiter','FaultTolerance', 60,'{"master":"mymaster","mode":"standalone","url":"192.168.1.1:6379","password":"abc"}', '0'); +INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `config`,`enabled`) VALUES ('6','divide', 'Proxy', 200,'{"multiSelectorHandle":"1","multiRuleHandle":"0"}','1'); +INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `config`,`enabled`) VALUES ('7','dubbo','Proxy', 310,'{"register":"zookeeper://localhost:2181","multiSelectorHandle":"1","threadpool":"shared","corethreads":0,"threads":2147483647,"queues":0}', '0'); INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `enabled`) VALUES ('8','springCloud','Proxy', 200, '0'); INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `enabled`) VALUES ('9','hystrix', 'FaultTolerance', 130,'0'); INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `enabled`) VALUES ('10','sentinel', 'FaultTolerance', 140,'0'); @@ -543,6 +554,11 @@ INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `enabled`) VALUES ('4 INSERT IGNORE INTO `plugin` (`id`, `name`, `role`, `sort`, `config`, `enabled`) VALUES ('41', 'brpc', 'Proxy', 310,'{"address":"127.0.0.1","port":"8005","corethreads":0,"threads":2147483647,"queues":0,"threadpool":"shared"}','0'); /*insert plugin_handle data for sentinel*/ +INSERT IGNORE INTO plugin_handle (`id`, `plugin_id`,`field`,`label`,`data_type`,`type`,`sort`,`ext_obj`) VALUES ('1529402613204172963', '3', 'reqAttack', 'Request', 3, 3, 1, '{"required":"1","defaultValue":"intercept","placeholder":"attack"}'); +INSERT IGNORE INTO plugin_handle (`id`, `plugin_id`,`field`,`label`,`data_type`,`type`,`sort`,`ext_obj`) VALUES ('1529402613204172964', '3', 'resAttack', 'Response', 3, 3, 2, '{"required":"1","defaultValue":"close","placeholder":"attack"}'); +INSERT IGNORE INTO plugin_handle (`id`, `plugin_id`,`field`,`label`,`data_type`,`type`,`sort`,`ext_obj`) VALUES ('1529402613204172965', '3', 'cookieAttack', 'Cookie', 3, 3, 3, '{"required":"1","defaultValue":"close","placeholder":"attack"}'); + + INSERT IGNORE INTO plugin_handle (`id`, `plugin_id`,`field`,`label`,`data_type`,`type`,`sort`,`ext_obj`) VALUES ('1529402613195784246', '10', 'flowRuleGrade', 'flowRuleGrade', 3, 2, 8, '{"required":"1","defaultValue":"1","rule":""}'); INSERT IGNORE INTO plugin_handle (`id`, `plugin_id`,`field`,`label`,`data_type`,`type`,`sort`,`ext_obj`) VALUES ('1529402613199978496', '10', 'flowRuleControlBehavior', 'flowRuleControlBehavior', 3, 2, 5, '{"required":"1","defaultValue":"0","rule":""}'); INSERT IGNORE INTO plugin_handle (`id`, `plugin_id`,`field`,`label`,`data_type`,`type`,`sort`,`ext_obj`) VALUES ('1529402613199978497', '10', 'flowRuleEnable', 'flowRuleEnable 1 or 0)', 1, 2, 7, '{"required":"1","defaultValue":"1","rule":"/^[01]$/"}'); diff --git a/shenyu-bootstrap/pom.xml b/shenyu-bootstrap/pom.xml index 599fdd98cb73..9f89c5bd2a5a 100644 --- a/shenyu-bootstrap/pom.xml +++ b/shenyu-bootstrap/pom.xml @@ -64,6 +64,14 @@ + + + org.apache.shenyu + shenyu-spring-boot-starter-plugin-xss + ${project.version} + + + org.apache.shenyu diff --git a/shenyu-common/src/main/java/org/apache/shenyu/common/dto/convert/rule/XssHandle.java b/shenyu-common/src/main/java/org/apache/shenyu/common/dto/convert/rule/XssHandle.java new file mode 100644 index 000000000000..e2552459c2e3 --- /dev/null +++ b/shenyu-common/src/main/java/org/apache/shenyu/common/dto/convert/rule/XssHandle.java @@ -0,0 +1,101 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.shenyu.common.dto.convert.rule; + +import java.util.Objects; + +/** + * this is Xss plugin handle. + */ +public class XssHandle { + + /** + * permission. + */ + private String permission; + + /** + * statusCode. + */ + private String statusCode; + + /** + * get permission. + * + * @return permission + */ + public String getPermission() { + return permission; + } + + /** + * set permission. + * + * @param permission permission + */ + public void setPermission(final String permission) { + this.permission = permission; + } + + /** + * get statusCode. + * + * @return statusCode + */ + public String getStatusCode() { + return statusCode; + } + + /** + * set statusCode. + * + * @param statusCode statusCode + */ + public void setStatusCode(final String statusCode) { + this.statusCode = statusCode; + } + + @Override + public boolean equals(final Object o) { + if (this == o) { + return true; + } + if (o == null || getClass() != o.getClass()) { + return false; + } + XssHandle XssHandle = (XssHandle) o; + return Objects.equals(permission, XssHandle.permission) && Objects.equals(statusCode, XssHandle.statusCode); + } + + @Override + public int hashCode() { + return Objects.hash(permission, statusCode); + } + + @Override + public String toString() { + return "XssHandle{" + + "permission='" + + permission + + '\'' + + ", statusCode='" + + statusCode + + '\'' + + '}'; + } +} diff --git a/shenyu-common/src/main/java/org/apache/shenyu/common/enums/PluginEnum.java b/shenyu-common/src/main/java/org/apache/shenyu/common/enums/PluginEnum.java index 05a0c8b41346..d34a934a6294 100644 --- a/shenyu-common/src/main/java/org/apache/shenyu/common/enums/PluginEnum.java +++ b/shenyu-common/src/main/java/org/apache/shenyu/common/enums/PluginEnum.java @@ -76,7 +76,12 @@ public enum PluginEnum { * Waf plugin enum. */ WAF(50, 0, "waf"), - + + /** + * Xss plugin enum. + */ + XSS(55, 0, "xss"), + /** * Rate limiter plugin enum. */ diff --git a/shenyu-e2e/pom.xml b/shenyu-e2e/pom.xml index a15b07742257..4284f3c45bce 100644 --- a/shenyu-e2e/pom.xml +++ b/shenyu-e2e/pom.xml @@ -19,12 +19,7 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"> 4.0.0 - - org.apache - apache - 21 - ./pom.xml - + org.apache.shenyu shenyu-e2e 0.0.1-SNAPSHOT diff --git a/shenyu-plugin/pom.xml b/shenyu-plugin/pom.xml index fd9ad504bf0a..ddc6c849c6c0 100644 --- a/shenyu-plugin/pom.xml +++ b/shenyu-plugin/pom.xml @@ -65,5 +65,6 @@ shenyu-plugin-casdoor shenyu-plugin-key-auth shenyu-plugin-brpc + shenyu-plugin-xss diff --git a/shenyu-plugin/shenyu-plugin-xss/pom.xml b/shenyu-plugin/shenyu-plugin-xss/pom.xml new file mode 100644 index 000000000000..75bd1586ec14 --- /dev/null +++ b/shenyu-plugin/shenyu-plugin-xss/pom.xml @@ -0,0 +1,62 @@ + + + + + + org.apache.shenyu + shenyu-plugin + 2.6.0-SNAPSHOT + + 4.0.0 + shenyu-plugin-xss + + + + org.apache.shenyu + shenyu-plugin-base + ${project.version} + + + org.apache.shenyu + shenyu-loadbalancer + ${project.version} + + + io.projectreactor + reactor-test + test + + + org.assertj + assertj-core + test + + + com.fasterxml.jackson.module + jackson-module-kotlin + test + + + org.springframework + spring-test + test + + + \ No newline at end of file diff --git a/shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/XssPlugin.java b/shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/XssPlugin.java new file mode 100644 index 000000000000..480e3882fc2c --- /dev/null +++ b/shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/XssPlugin.java @@ -0,0 +1,83 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.shenyu.plugin.xss; + +import org.apache.shenyu.common.dto.RuleData; +import org.apache.shenyu.common.dto.SelectorData; +import org.apache.shenyu.common.enums.PluginEnum; +import org.apache.shenyu.plugin.api.ShenyuPluginChain; +import org.apache.shenyu.plugin.base.AbstractShenyuPlugin; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.core.io.buffer.DataBuffer; +import org.springframework.core.io.buffer.DataBufferUtils; +import org.springframework.http.HttpHeaders; +import org.springframework.http.server.reactive.ServerHttpRequest; +import org.springframework.http.server.reactive.ServerHttpResponse; +import org.springframework.web.server.ServerWebExchange; +import reactor.core.publisher.Mono; + +import java.nio.charset.StandardCharsets; +import java.util.ArrayList; +import java.util.List; + +/** + * XSS plugin avoids common XSS attacks. + */ +public class XssPlugin extends AbstractShenyuPlugin { + + private static final Logger LOG = LoggerFactory.getLogger(XssPlugin.class); + + + @Override + protected Mono doExecute(final ServerWebExchange exchange, final ShenyuPluginChain chain, final SelectorData selector, final RuleData rule) { + LOG.info("Xss plugin doExecute start."); + + // Http only 过滤 + ServerHttpResponse response = exchange.getResponse(); + HttpHeaders headers = response.getHeaders(); + List cookies = headers.get(HttpHeaders.SET_COOKIE); + if (cookies != null) { + List newCookies = new ArrayList<>(cookies.size()); + for (String cookie : cookies) { + if (cookie.contains("JSESSIONID")) { + newCookies.add(cookie + "; HttpOnly"); + } else { + newCookies.add(cookie); + } + } + headers.put(HttpHeaders.SET_COOKIE, newCookies); + } + // Http only 过滤 + + + LOG.info("Xss plugin doExecute end."); + return chain.execute(exchange); + } + + + @Override + public int getOrder() { + return PluginEnum.XSS.getCode(); + } + + @Override + public String named() { + return PluginEnum.XSS.getName(); + } +} diff --git a/shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/config/XssConfig.java b/shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/config/XssConfig.java new file mode 100644 index 000000000000..d39ab5aba2e5 --- /dev/null +++ b/shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/config/XssConfig.java @@ -0,0 +1,52 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.shenyu.plugin.xss.config; + +import java.io.Serializable; + +/** + * The type Xss config. + */ +public class XssConfig implements Serializable { + + private static final long serialVersionUID = 96834909685183123L; + + /** + * black or mixed. + * default is black; mixed . + */ + private String model; + + /** + * Gets model. + * + * @return the model + */ + public String getModel() { + return model; + } + + /** + * Sets model. + * + * @param model the model + */ + public void setModel(final String model) { + this.model = model; + } +} diff --git a/shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/handler/XssPluginDataHandler.java b/shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/handler/XssPluginDataHandler.java new file mode 100644 index 000000000000..c818dd670723 --- /dev/null +++ b/shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/handler/XssPluginDataHandler.java @@ -0,0 +1,65 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.shenyu.plugin.xss.handler; + +import org.apache.shenyu.common.dto.PluginData; +import org.apache.shenyu.common.dto.RuleData; +import org.apache.shenyu.common.dto.convert.rule.XssHandle; +import org.apache.shenyu.common.enums.PluginEnum; +import org.apache.shenyu.common.utils.GsonUtils; +import org.apache.shenyu.common.utils.Singleton; +import org.apache.shenyu.plugin.base.cache.CommonHandleCache; +import org.apache.shenyu.plugin.base.handler.PluginDataHandler; +import org.apache.shenyu.plugin.base.utils.BeanHolder; +import org.apache.shenyu.plugin.base.utils.CacheKeyUtils; +import org.apache.shenyu.plugin.xss.config.XssConfig; + +import java.util.Optional; +import java.util.function.Supplier; + +/** + * The type Xss plugin data handler. + */ +public class XssPluginDataHandler implements PluginDataHandler { + + public static final Supplier> CACHED_HANDLE = new BeanHolder<>(CommonHandleCache::new); + + @Override + public void handlerPlugin(final PluginData pluginData) { + XssConfig XssConfig = GsonUtils.getInstance().fromJson(pluginData.getConfig(), XssConfig.class); + Singleton.INST.single(XssConfig.class, XssConfig); + } + + @Override + public void handlerRule(final RuleData ruleData) { + Optional.ofNullable(ruleData.getHandle()).ifPresent(s -> { + final XssHandle XssHandle = GsonUtils.getInstance().fromJson(s, XssHandle.class); + CACHED_HANDLE.get().cachedHandle(CacheKeyUtils.INST.getKey(ruleData), XssHandle); + }); + } + + @Override + public void removeRule(final RuleData ruleData) { + Optional.ofNullable(ruleData.getHandle()).ifPresent(s -> CACHED_HANDLE.get().removeHandle(CacheKeyUtils.INST.getKey(ruleData))); + } + + @Override + public String pluginNamed() { + return PluginEnum.XSS.getName(); + } +} diff --git a/shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/utils/XSSUtils.java b/shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/utils/XSSUtils.java new file mode 100644 index 000000000000..d96c275a5e02 --- /dev/null +++ b/shenyu-plugin/shenyu-plugin-xss/src/main/java/org/apache/shenyu/plugin/xss/utils/XSSUtils.java @@ -0,0 +1,68 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.shenyu.plugin.xss.utils; + +import org.springframework.util.StringUtils; + +import java.util.regex.Pattern; + +/** + * xss utils. + */ +public final class XSSUtils { + + private XSSUtils() { + } + + private static final Pattern[] PATTERNS = { + // Avoid anything in a ", Pattern.CASE_INSENSITIVE), + // Avoid anything in a src='...' type of expression + Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), + Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), + // Remove any lonesome tag + Pattern.compile("", Pattern.CASE_INSENSITIVE), + // Avoid anything in a ", Pattern.CASE_INSENSITIVE), + // Remove any lonesome