/**
 * Filter配置
 *
 * @author lirui
 */
@Configuration
public class FilterConfig {

    /**
     * 注册过滤器
     *
     * @param url 提供可不拦截接口
     *            实现配置不过滤部分接口，部分接口需要不做过滤
     * @return
     */
    @Bean
    public FilterRegistrationBean xssFilterRegistration(XssIgnoreFilterUrl url) {
        FilterRegistrationBean registration = getFilterRegistrationBean(url);
        return registration;
    }

    private FilterRegistrationBean getFilterRegistrationBean(XssIgnoreFilterUrl url) {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        //指定发起请求时过滤
        registration.setDispatcherTypes(DispatcherType.REQUEST);
        registration.setFilter(new XssFilter(Objects.isNull(url) ? null : url.getUrls()));
        //默认所有接口
        registration.addUrlPatterns("/*");
        registration.setName("xssFilter");
        //设置最后执行，防止有其他过滤器对值需要修改等操作，保证最后过滤字符即可
        registration.setOrder(Integer.MAX_VALUE);
        return registration;
    }
}

/**
 * xss忽略过滤地址
 *
 * @author LiRui
 * @version 1.0
 */
@Configuration
@ConfigurationProperties(prefix = "xss.ignore")
public class XssIgnoreFilterUrl {
    private Set<String> urls;

    public Set<String> getUrls() {
        return urls;
    }

    public void setUrls(Set<String> urls) {
        this.urls = urls;
    }
}

//yml配置
xss:
  ignore:
    urls:
      - /xss/form

/**
 * XSS过滤
 *
 * @author lirui
 */
public class XssFilter implements Filter {

    private Set<String> excludedUris;

    public XssFilter() {
    }

    public XssFilter(Set<String> excludedUris) {
        this.excludedUris = excludedUris;
    }

    /**
     * 是否排除
     *
     * @param uri
     * @return
     */
    private boolean isExcludedUri(String uri) {
        if (CollectionUtils.isEmpty(excludedUris)) {
            return false;
        }
        for (String ex : excludedUris) {
            if (match(ex, uri)) {
                return true;
            }
        }
        return false;
    }

    /**
     * 地址匹配
     *
     * @param patternPath
     * @param requestPath
     * @return
     */
    public static boolean match(String patternPath, String requestPath) {
        if (StringUtils.isEmpty(patternPath) || StringUtils.isEmpty(requestPath)) {
            return false;
        }
        PathMatcher matcher = new AntPathMatcher();
        return matcher.match(patternPath, requestPath);
    }


    @Override
    public void init(FilterConfig config) throws ServletException {
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        //可配置多个字符串过滤
        XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(
                (HttpServletRequest) request, new HTMLFilter());
        String url = xssRequest.getServletPath();
        if (isExcludedUri(url)) {
            chain.doFilter(request, response);
            return;
        }
        chain.doFilter(xssRequest, response);
    }

    @Override
    public void destroy() {
    }
}

            //自动补充<,> 注释允许传递<>符号
//            s = regexReplace(P_BODY_TO_END, "<$1>", s);
//            s = regexReplace(P_XML_CONTENT, "$1<$2", s);

return HtmlUtil.cleanHtmlTag(HtmlKit.getTextFromHtml(s));
//getTextFromHtml方法源码
  public static String getTextFromHtml(String htmlStr) {
        if (htmlStr == null) {
            return "";
        } else {
            htmlStr = delHtmlLabel(htmlStr);
            htmlStr = htmlStr.replaceAll(" ", "");
            return htmlStr;
        }
    }