반응형
package com.example.demo;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;

@Controller
public class GreetingController {
	
	/**
	 * script 삭제 
	 * @param oldText
	 * @return
	 */
	private String removeScriptXSS(String oldText) {
		String regex = "<script(?:[^>]*src=['\"]([^'\"]*)['\"][^>]*>|[^>]*>([^<]*)</script>)";
	    Pattern pattern = Pattern.compile(regex, Pattern.CASE_INSENSITIVE | Pattern.DOTALL);
		StringBuffer sb = new StringBuffer();
		Matcher matcher = pattern.matcher(oldText);
        while (matcher.find()) {
        	matcher.appendReplacement(sb, "");
        }
        matcher.appendTail(sb);
        return sb.toString();
	}

	@GetMapping("/greeting.do")
	public String greeting(@RequestParam(name="name", required=false, defaultValue="World") String name, Model model) {
		
		String cont = "<div class=\"skin_view\">\n"
				+ "								<h2 id=\"dkBody\" class=\"screen_out\">티스토리 뷰</h2>\n"
				+ "								<div class=\"area_title\">\n"
				+ "									<strong class=\"tit_category\"><a href=\"/category/Programming/JSP\">Programming/JSP</a></strong>\n"
				+ "			<Script type=\"text/javaScript\">alert(1111111);</scripT>"
				+ "									<h3 class=\"tit_post\"><a href=\"/26\">[JSP]JSP 프로젝트 생성 및 설정</a></h3>\n"
				+ "									<span class=\"txt_detail my_post\">heyhyo\n"
				+ "			<Script type=\"application/javascript\">alert(444444);"
				+ "      alert('7777777777');"
				+ "                   </scripT>"
				+ "										<span class=\"txt_bar\"></span>2018. 8. 7. 15:32\n"
				+ "										\n"
				+ "			<Script>alert(222222);</scripT>"
				+ "									</span>\n"
				+ "								</div>\n"
				+ "								<div class=\"area_view\">"
				+ "</div></div>";
		
		model.addAttribute("name", removeScriptXSS(cont));
		
		return "greeting";
	}

}
반응형

'java' 카테고리의 다른 글

logback  (0) 2021.12.22
java proxy  (0) 2021.04.07
spring poi excel download  (0) 2020.10.22
JAVA File to byte []  (0) 2013.01.11
[RCP] "org.eclipse.ui.ide.workbench" could not be found in the registry  (0) 2012.01.26

+ Recent posts