修复 Livewire 请求导致本机网址被防火墙封禁 (#194)

config/firewall.php

@@ -418,7 +418,10 @@ return [
 
             'inputs' => [
                 'only' => [], // i.e. 'first_name'
-                'except' => [], // i.e. 'password'
+                // Livewire cryptographically signs this serialized component
+                // state. Its large JSON payload produces false positives; user
+                // updates and every other request field remain protected.
+                'except' => ['snapshot'],
             ],
 
             'patterns' => [

tests/Unit/Firewall/LivewireXssExclusionTest.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace Tests\Unit\Firewall;
+
+use Akaunting\Firewall\Middleware\Xss;
+use Illuminate\Http\Request;
+use Tests\TestCase;
+
+class LivewireXssExclusionTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        config(['firewall.middleware.xss.enabled' => true]);
+    }
+
+    public function test_signed_livewire_snapshot_is_excluded_from_xss_scanning(): void
+    {
+        $middleware = new Xss();
+        $middleware->prepare(Request::create('/1/livewire/update', 'POST'));
+
+        $this->assertFalse($middleware->match(
+            $middleware->getPatterns()[4],
+            ['components' => [['snapshot' => '{"data":{"product_name":"<img src=x>"}}']]],
+        ));
+    }
+
+    public function test_livewire_user_updates_and_regular_fields_remain_protected(): void
+    {
+        $middleware = new Xss();
+        $middleware->prepare(Request::create('/1/livewire/update', 'POST'));
+
+        $this->assertSame(1, $middleware->match(
+            $middleware->getPatterns()[4],
+            ['components' => [['updates' => ['name' => '<img src=x>']]]],
+        ));
+        $this->assertSame(1, $middleware->match(
+            $middleware->getPatterns()[4],
+            ['name' => '<img src=x>'],
+        ));
+    }
+}