CVE-2026-10514

@@ -89,5 +89,5 @@ dashboard.whitelist.enabled=false
 # Enable whitelist functionality, if not enabled, access will not be restricted.
 dashboard.whitelist.allowed=
 
-# Full HTML escaping switch. When enabled, all tags will be escaped (may affect content display), only enable for special scenarios.
-xss.escape.all.enabled=false
\ No newline at end of file
+# List of URLs that require XSS filtering, supports Ant-style path matching, e.g., /api/**. If no URLs need to be filtered, it can be left empty.
+# xss.protection.url.list=/account/follow/**,/announcement/add
\ No newline at end of file

@@ -3,14 +3,19 @@
 import com.fasterxml.jackson.core.JsonParser;
 import com.fasterxml.jackson.databind.DeserializationContext;
 import com.fasterxml.jackson.databind.deser.std.StdScalarDeserializer;
+import jakarta.servlet.http.HttpServletRequest;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.autoconfigure.jackson.Jackson2ObjectMapperBuilderCustomizer;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.util.AntPathMatcher;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
 import org.springframework.web.util.HtmlUtils;
 
 import java.io.IOException;
+import java.util.Arrays;
 
 /**
  * 配置类，用于定制 Jackson 的反序列化过程。
@@ -23,8 +28,13 @@
 @Configuration
 public class RequestParamTrimConfig {
 
-    @Value("${xss.escape.all.enabled:false}")
-    private boolean escape;
+    /**
+     * 需要开启 XSS 过滤的 URL 列表（Ant 风格，逗号分隔）。
+     * 示例：/account/follow/**,/announcement/**
+     * 留空表示不对任何请求做 HTML 转义。
+     */
+    @Value("${xss.protection.url.list:}")
+    private String xssFilterUrlList;
 
     /**
      * 定义一个 {@link Jackson2ObjectMapperBuilderCustomizer} Bean，
@@ -37,24 +47,49 @@ public class RequestParamTrimConfig {
      */
     @Bean
     public Jackson2ObjectMapperBuilderCustomizer jackson2ObjectMapperBuilderCustomizer() {
-        return jacksonObjectMapperBuilder -> {
-            // 为 String 类型字段定义自定义的反序列化操作
-            jacksonObjectMapperBuilder
-                    .deserializerByType(String.class, new StdScalarDeserializer<String>(String.class) {
-                        @Override
-                        public String deserialize(JsonParser jsonParser, DeserializationContext ctx)
-                                throws IOException {
-                            // 在反序列化时去除前后空格
-                            String value = StringUtils.trim(jsonParser.getValueAsString());
-
-                            // 进一步清理可能的 XSS 攻击内容,开启后可能会导致一些特殊字符被转义，如 <、>、& 等
-                            if (escape) {
-                                return HtmlUtils.htmlEscape(value);
-                            }
-                            return value;
+        AntPathMatcher pathMatcher = new AntPathMatcher(); // 线程安全，可复用
+
+        return builder -> builder
+                .deserializerByType(String.class, new StdScalarDeserializer<String>(String.class) {
+                    @Override
+                    public String deserialize(JsonParser p, DeserializationContext ctxt) throws IOException {
+                        String rawValue = p.getValueAsString();
+                        String trimmedValue = StringUtils.trim(rawValue);
+
+                        // 判断是否需要对当前值进行 HTML 转义
+                        if (shouldEscapeXss(pathMatcher)) {
+                            return HtmlUtils.htmlEscape(trimmedValue);
                         }
-                    });
-        };
+                        return trimmedValue;
+                    }
+                });
+    }
+
+    /**
+     * 判断当前请求是否命中 XSS 过滤白名单（命中 → 执行转义）。
+     */
+    private boolean shouldEscapeXss(AntPathMatcher pathMatcher) {
+        // 未配置过滤列表
+        if (StringUtils.isBlank(xssFilterUrlList)) {
+            return false;
+        }
+
+        ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
+        if (attributes == null) {
+            return false; // 非 Web 上下文（定时任务等）不处理
+        }
+
+        HttpServletRequest request = attributes.getRequest();
+        String requestURI = request.getRequestURI();
+        if (StringUtils.isBlank(requestURI)) {
+            return false;
+        }
+
+        // 逗号分隔的 Ant 路径列表，任一匹配即需要转义
+        return Arrays.stream(xssFilterUrlList.split(","))
+                .map(String::trim)
+                .filter(StringUtils::isNotBlank)   // 过滤掉空白配置项
+                .anyMatch(pattern -> pathMatcher.match(pattern, requestURI));
     }
 
 }

@@ -39,5 +39,5 @@ dashboard.whitelist.enabled=false
 # Enable whitelist functionality, if not enabled, access will not be restricted.
 dashboard.whitelist.allowed=
 
-# Full HTML escaping switch. When enabled, all tags will be escaped (may affect content display), only enable for special scenarios.
-xss.escape.all.enabled=false
\ No newline at end of file
+# List of URLs that require XSS filtering, supports Ant-style path matching, e.g., /api/**. If no URLs need to be filtered, it can be left empty.
+xss.protection.url.list=/account/follow/**,/announcement/add
\ No newline at end of file