fix: security problems

SonicCloudOrg · Mar 30, 2023 · 6c48075 · 6c48075
1 parent 8592f78
commit 6c48075
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/sonic-server-common/src/main/resources/application-sonic-server-gateway.yml b/sonic-server-common/src/main/resources/application-sonic-server-gateway.yml
@@ -2,7 +2,7 @@ server:
   port: 3000
 
 filter:
-  white-list: /server,/projects/list,/websockets,/users/login,/users/register,/users/loginConfig,/swagger,/v3/api-docs,/doc.html,/folder/upload,/keepFiles/,/imageFiles/,/recordFiles/,/logFiles/,/packageFiles/
+  white-list: /projects/list,/websockets,/users/login,/users/register,/users/loginConfig,/swagger,/v3/api-docs,/doc.html,/folder/upload,/keepFiles/,/imageFiles/,/recordFiles/,/logFiles/,/packageFiles/
 
 knife4j:
   gateway:

diff --git a/sonic-server-gateway/src/main/java/org/cloud/sonic/gateway/config/AuthFilter.java b/sonic-server-gateway/src/main/java/org/cloud/sonic/gateway/config/AuthFilter.java
@@ -45,7 +45,7 @@ public class AuthFilter implements GlobalFilter, Ordered {
     @Override
     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
         for (String white : whiteList) {
-            if (exchange.getRequest().getURI().toString().contains(white)) {
+            if (exchange.getRequest().getURI().getPath().contains(white)) {
                 return chain.filter(exchange);
             }
         }