github
/
jeecg-boot
mirror of https://github.com/jeecgboot/jeecg-boot
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Delete XSSUtils.java

pull/3958/head
JEECG 2022-07-20 18:15:40 +08:00 committed by GitHub
parent d3c139ab5d
commit 94b89f2135
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
jeecg-boot/jeecg-boot-module-system/src/main/java/org/jeecg/modules/system/util/XSSUtils.java
View File

@ -1,49 +0,0 @@
package org.jeecg.modules.system.util;
import org.springframework.web.util.HtmlUtils;
import java.util.regex.Pattern;
/**
* @Description: 工具类XSSUtils，现在的做法是替换成空字符，CSDN的是进行转义，比如文字开头的"<"转成&lt;
* @author: lsq
* @date: 2021年07月26日 19:13
*/
public class XssUtils {
private static Pattern[] patterns = new Pattern[]{
//Script fragments
Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE),
//src='...'
Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
//script tags
Pattern.compile("</script>", Pattern.CASE_INSENSITIVE),
Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
//eval(...)
Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
//expression(...)
Pattern.compile("e­xpression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
//javascript:...
Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE),
//vbscript:...
Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE),
//onload(...)=...
Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
};
public static String scriptXss(String value) {
if (value != null) {
value = value.replaceAll(" ", "");
for(Pattern scriptPattern: patterns){
value = scriptPattern.matcher(value).replaceAll("");
}
}
return HtmlUtils.htmlEscape(value);
}
public static void main(String[] args) {
String s = scriptXss("<img src=x onload=alert(111).*?><script></script>javascript:eval()\\\\.");
System.err.println("s======>" + s);
}
}