반응형
package com.example.demo;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
@Controller
public class GreetingController {
/**
* script 삭제
* @param oldText
* @return
*/
private String removeScriptXSS(String oldText) {
String regex = "<script(?:[^>]*src=['\"]([^'\"]*)['\"][^>]*>|[^>]*>([^<]*)</script>)";
Pattern pattern = Pattern.compile(regex, Pattern.CASE_INSENSITIVE | Pattern.DOTALL);
StringBuffer sb = new StringBuffer();
Matcher matcher = pattern.matcher(oldText);
while (matcher.find()) {
matcher.appendReplacement(sb, "");
}
matcher.appendTail(sb);
return sb.toString();
}
@GetMapping("/greeting.do")
public String greeting(@RequestParam(name="name", required=false, defaultValue="World") String name, Model model) {
String cont = "<div class=\"skin_view\">\n"
+ " <h2 id=\"dkBody\" class=\"screen_out\">티스토리 뷰</h2>\n"
+ " <div class=\"area_title\">\n"
+ " <strong class=\"tit_category\"><a href=\"/category/Programming/JSP\">Programming/JSP</a></strong>\n"
+ " <Script type=\"text/javaScript\">alert(1111111);</scripT>"
+ " <h3 class=\"tit_post\"><a href=\"/26\">[JSP]JSP 프로젝트 생성 및 설정</a></h3>\n"
+ " <span class=\"txt_detail my_post\">heyhyo\n"
+ " <Script type=\"application/javascript\">alert(444444);"
+ " alert('7777777777');"
+ " </scripT>"
+ " <span class=\"txt_bar\"></span>2018. 8. 7. 15:32\n"
+ " \n"
+ " <Script>alert(222222);</scripT>"
+ " </span>\n"
+ " </div>\n"
+ " <div class=\"area_view\">"
+ "</div></div>";
model.addAttribute("name", removeScriptXSS(cont));
return "greeting";
}
}
반응형
'java' 카테고리의 다른 글
logback (0) | 2021.12.22 |
---|---|
java proxy (0) | 2021.04.07 |
spring poi excel download (0) | 2020.10.22 |
JAVA File to byte [] (0) | 2013.01.11 |
[RCP] "org.eclipse.ui.ide.workbench" could not be found in the registry (0) | 2012.01.26 |