PeijunDev/Aluer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修复 WAF 误拦截本地回环地址访问 Web 控制台：localhost/127.0.0.1/::1 跳过 WAF 过滤

Browse Source
This commit is contained in:
Peijun Zhao
2026-05-16 20:17:18 +08:00
parent 7e55676775
commit 915b16e05a
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/aluer/security/WafRequestFilter.java
+10 -2
View File
@@ -28,12 +28,20 @@ public class WafRequestFilter extends OncePerRequestFilter {
@Override @Override
protected boolean shouldNotFilter(HttpServletRequest request) { protected boolean shouldNotFilter(HttpServletRequest request) {
String uri = request.getRequestURI(); String uri = request.getRequestURI();
return uri.startsWith("/favicon") if (uri.startsWith("/favicon")
|| uri.startsWith("/assets/") || uri.startsWith("/assets/")
|| uri.endsWith(".css") || uri.endsWith(".css")
|| uri.endsWith(".js") || uri.endsWith(".js")
|| uri.endsWith(".png") || uri.endsWith(".png")
|| uri.endsWith(".ico"); || uri.endsWith(".ico")) {
return true;
}
// 本地回环地址不经过 WAF 过滤（localhost / 127.0.0.1 / ::1）
String remoteAddr = request.getRemoteAddr();
return "127.0.0.1".equals(remoteAddr)
|| "0:0:0:0:0:0:0:1".equals(remoteAddr)
|| "::1".equals(remoteAddr)
|| "localhost".equalsIgnoreCase(remoteAddr);
} }
@Override @Override