From 915b16e05a487df8d76df4cd5396a4dd4fffe8d8 Mon Sep 17 00:00:00 2001 From: Peijun Zhao Date: Sat, 16 May 2026 20:17:18 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20WAF=20=E8=AF=AF=E6=8B=A6?= =?UTF-8?q?=E6=88=AA=E6=9C=AC=E5=9C=B0=E5=9B=9E=E7=8E=AF=E5=9C=B0=E5=9D=80?= =?UTF-8?q?=E8=AE=BF=E9=97=AE=20Web=20=E6=8E=A7=E5=88=B6=E5=8F=B0=EF=BC=9A?= =?UTF-8?q?localhost/127.0.0.1/::1=20=E8=B7=B3=E8=BF=87=20WAF=20=E8=BF=87?= =?UTF-8?q?=E6=BB=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../java/com/aluer/security/WafRequestFilter.java | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/main/java/com/aluer/security/WafRequestFilter.java b/src/main/java/com/aluer/security/WafRequestFilter.java index 7b17cfe..4936fcb 100644 --- a/src/main/java/com/aluer/security/WafRequestFilter.java +++ b/src/main/java/com/aluer/security/WafRequestFilter.java @@ -28,12 +28,20 @@ public class WafRequestFilter extends OncePerRequestFilter { @Override protected boolean shouldNotFilter(HttpServletRequest request) { String uri = request.getRequestURI(); - return uri.startsWith("/favicon") + if (uri.startsWith("/favicon") || uri.startsWith("/assets/") || uri.endsWith(".css") || uri.endsWith(".js") || uri.endsWith(".png") - || uri.endsWith(".ico"); + || uri.endsWith(".ico")) { + return true; + } + // 本地回环地址不经过 WAF 过滤（localhost / 127.0.0.1 / ::1） + String remoteAddr = request.getRemoteAddr(); + return "127.0.0.1".equals(remoteAddr) + || "0:0:0:0:0:0:0:1".equals(remoteAddr) + || "::1".equals(remoteAddr) + || "localhost".equalsIgnoreCase(remoteAddr); } @Override