diff --git a/jeecg-boot/jeecg-boot-module-system/src/main/java/org/jeecg/modules/system/util/XSSUtils.java b/jeecg-boot/jeecg-boot-module-system/src/main/java/org/jeecg/modules/system/util/XSSUtils.java deleted file mode 100644 index 1fbb3804..00000000 --- a/jeecg-boot/jeecg-boot-module-system/src/main/java/org/jeecg/modules/system/util/XSSUtils.java +++ /dev/null @@ -1,49 +0,0 @@ -package org.jeecg.modules.system.util; - -import org.springframework.web.util.HtmlUtils; - -import java.util.regex.Pattern; - -/** - * @Description: 工具类XSSUtils,现在的做法是替换成空字符,CSDN的是进行转义,比如文字开头的"<"转成< - * @author: lsq - * @date: 2021年07月26日 19:13 - */ -public class XssUtils { - - private static Pattern[] patterns = new Pattern[]{ - //Script fragments - Pattern.compile("", Pattern.CASE_INSENSITIVE), - //src='...' - Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), - Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), - //script tags - Pattern.compile("", Pattern.CASE_INSENSITIVE), - Pattern.compile("", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), - //eval(...) - Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), - //expression(...) - Pattern.compile("e­xpression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), - //javascript:... - Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE), - //vbscript:... - Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE), - //onload(...)=... - Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL), - }; - - public static String scriptXss(String value) { - if (value != null) { - value = value.replaceAll(" ", ""); - for(Pattern scriptPattern: patterns){ - value = scriptPattern.matcher(value).replaceAll(""); - } - } - return HtmlUtils.htmlEscape(value); - } - - public static void main(String[] args) { - String s = scriptXss("javascript:eval()\\\\."); - System.err.println("s======>" + s); - } -}