JeroBoot/base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

框架完善

Browse Source
This commit is contained in:
梁琦涛
2023-04-12 16:59:40 +08:00
parent a247d15420
commit 854945db2f
6 changed files with 114 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/cors/CorsFilter.java
+4 -7
View File
@@ -2,8 +2,6 @@ package com.jero.config.filter.cors;
import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.ArrayUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import javax.servlet.*; import javax.servlet.*;
import javax.servlet.annotation.WebFilter; import javax.servlet.annotation.WebFilter;
@@ -20,8 +18,6 @@ import java.util.Objects;
@WebFilter(urlPatterns = {"/verifyCode/**"}) @WebFilter(urlPatterns = {"/verifyCode/**"})
public class CorsFilter implements Filter { public class CorsFilter implements Filter {
private static final Log LOGGER = LogFactory.getLog(CorsFilter.class);
private final String originIp; private final String originIp;
private final List<String> notFilter; private final List<String> notFilter;
@@ -34,7 +30,7 @@ public class CorsFilter implements Filter {
@Override @Override
public void init(FilterConfig filterConfig) throws ServletException { public void init(FilterConfig filterConfig) throws ServletException {
// do other
} }
@Override @Override
@@ -62,9 +58,9 @@ public class CorsFilter implements Filter {
responseInfo(request, response, chain); responseInfo(request, response, chain);
} }
public boolean isMSBrowser(HttpServletRequest request) { public boolean isMSBrowser(HttpServletRequest request) {
String[] IEBrowserSignals = {"MSIE", "Trident"}; String[] ieBrowserSignals = {"MSIE", "Trident"};
String userAgent = request.getHeader("User-Agent"); String userAgent = request.getHeader("User-Agent");
for (String signal : IEBrowserSignals) { for (String signal : ieBrowserSignals) {
if (userAgent.contains(signal)){ if (userAgent.contains(signal)){
return true; return true;
} }
@@ -87,6 +83,7 @@ public class CorsFilter implements Filter {
@Override @Override
public void destroy() { public void destroy() {
// do other
} }
} }
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/csrf/CsrfFilter.java
+7 -6
View File
@@ -83,10 +83,10 @@ public class CsrfFilter implements Filter {
String refHost = ""; String refHost = "";
referUrl = referUrl.toLowerCase(); referUrl = referUrl.toLowerCase();
if (referUrl.startsWith("http://")) { if (referUrl.startsWith("http://")) {
int i = referUrl.substring(7).indexOf("/"); int i = referUrl.indexOf("/", 7) - 7;
refHost = referUrl.substring(7,i+7); refHost = referUrl.substring(7,i+7);
} else if (referUrl.startsWith("https://")) { } else if (referUrl.startsWith("https://")) {
int i = referUrl.substring(8).indexOf("/"); int i = referUrl.indexOf("/", 8) - 8;
refHost = referUrl.substring(8,i+8); refHost = referUrl.substring(8,i+8);
} }
@@ -108,14 +108,15 @@ public class CsrfFilter implements Filter {
* @return * @return
*/ */
public String getIp(HttpServletRequest request) { public String getIp(HttpServletRequest request) {
String unknown = "unknown";
String ip = request.getHeader("x-forwarded-for"); String ip = request.getHeader("x-forwarded-for");
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) { if (ip == null || ip.length() == 0 || unknown.equalsIgnoreCase(ip)) {
ip = request.getHeader("Proxy-Client-IP"); ip = request.getHeader("Proxy-Client-IP");
} }
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) { if (ip == null || ip.length() == 0 || unknown.equalsIgnoreCase(ip)) {
ip = request.getHeader("WL-Proxy-Client-IP"); ip = request.getHeader("WL-Proxy-Client-IP");
} }
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) { if (ip == null || ip.length() == 0 || unknown.equalsIgnoreCase(ip)) {
ip = request.getRemoteAddr(); ip = request.getRemoteAddr();
} }
if (ip.equals("0:0:0:0:0:0:0:1")) { if (ip.equals("0:0:0:0:0:0:0:1")) {
@@ -125,6 +126,6 @@ public class CsrfFilter implements Filter {
} }
@Override @Override
public void destroy() { public void destroy() {
// do other
} }
} }
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/HTMLFilter.java
+86 -134
View File
@@ -6,8 +6,12 @@
package com.jero.config.filter.xss; package com.jero.config.filter.xss;
import cn.hutool.core.lang.Console; import cn.hutool.core.lang.Console;
import org.jetbrains.annotations.Nullable;
import java.util.*; import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ConcurrentMap; import java.util.concurrent.ConcurrentMap;
import java.util.regex.Matcher; import java.util.regex.Matcher;
@@ -17,7 +21,6 @@ import java.util.regex.Pattern;
* @author hzwl * @author hzwl
*/ */
public final class HTMLFilter { public final class HTMLFilter {
private static final int REGEX_FLAGS_SI = 34;
private static final Pattern P_COMMENTS = Pattern.compile("<!--(.*?)-->", 32); private static final Pattern P_COMMENTS = Pattern.compile("<!--(.*?)-->", 32);
private static final Pattern P_COMMENT = Pattern.compile("^!--(.*)--$", 34); private static final Pattern P_COMMENT = Pattern.compile("^!--(.*)--$", 34);
private static final Pattern P_TAGS = Pattern.compile("<(.*?)>", 32); private static final Pattern P_TAGS = Pattern.compile("<(.*?)>", 32);
@@ -28,21 +31,16 @@ public final class HTMLFilter {
private static final Pattern P_PROTOCOL = Pattern.compile("^([^:]+):", 34); private static final Pattern P_PROTOCOL = Pattern.compile("^([^:]+):", 34);
private static final Pattern P_ENTITY = Pattern.compile("&#(\\d+);?"); private static final Pattern P_ENTITY = Pattern.compile("&#(\\d+);?");
private static final Pattern P_ENTITY_UNICODE = Pattern.compile("&#x([0-9a-f]+);?"); private static final Pattern P_ENTITY_UNICODE = Pattern.compile("&#x([0-9a-f]+);?");
private static final Pattern P_ENCODE = Pattern.compile("%([0-9a-f]{2});?");
private static final Pattern P_VALID_ENTITIES = Pattern.compile("&([^&;]*)(?=(;|&|$))"); private static final Pattern P_VALID_ENTITIES = Pattern.compile("&([^&;]*)(?=(;|&|$))");
private static final Pattern P_VALID_QUOTES = Pattern.compile("(>|^)([^<]+?)(<|$)", 32); private static final Pattern P_VALID_QUOTES = Pattern.compile("(>|^)([^<]+)(<|$)", 32);
private static final Pattern P_END_ARROW = Pattern.compile("^>");
private static final Pattern P_BODY_TO_END = Pattern.compile("<([^>]*?)(?=<|$)");
private static final Pattern P_XML_CONTENT = Pattern.compile("(^|>)([^<]*?)(?=>)");
private static final Pattern P_STRAY_LEFT_ARROW = Pattern.compile("<([^>]*?)(?=<|$)"); private static final Pattern P_STRAY_LEFT_ARROW = Pattern.compile("<([^>]*?)(?=<|$)");
private static final Pattern P_STRAY_RIGHT_ARROW = Pattern.compile("(^|>)([^<]*?)(?=>)"); private static final Pattern P_STRAY_RIGHT_ARROW = Pattern.compile("(^|>)([^<]*?)(?=>)");
private static final Pattern P_AMP = Pattern.compile("&");
private static final Pattern P_QUOTE = Pattern.compile("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']"); private static final Pattern P_QUOTE = Pattern.compile("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']");
private static final Pattern P_LEFT_ARROW = Pattern.compile("<"); private static final Pattern P_LEFT_ARROW = Pattern.compile("<");
private static final Pattern P_RIGHT_ARROW = Pattern.compile(">"); private static final Pattern P_RIGHT_ARROW = Pattern.compile(">");
private static final Pattern P_BOTH_ARROWS = Pattern.compile("<>"); private static final Pattern P_BOTH_ARROWS = Pattern.compile("<>");
private static final ConcurrentMap<String, Pattern> P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap(); private static final ConcurrentMap<String, Pattern> P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap<>();
private static final ConcurrentMap<String, Pattern> P_REMOVE_SELF_BLANKS = new ConcurrentHashMap(); private static final ConcurrentMap<String, Pattern> P_REMOVE_SELF_BLANKS = new ConcurrentHashMap<>();
private final Map<String, List<String>> vAllowed; private final Map<String, List<String>> vAllowed;
private final Map<String, Integer> vTagCounts; private final Map<String, Integer> vTagCounts;
private final String[] vSelfClosingTags; private final String[] vSelfClosingTags;
@@ -57,75 +55,39 @@ public final class HTMLFilter {
private boolean vDebug; private boolean vDebug;
private final boolean alwaysMakeTags; private final boolean alwaysMakeTags;
public HTMLFilter() { public HTMLFilter() {
this.vTagCounts = new HashMap(); String strong = "strong";
this.vTagCounts = new HashMap<>();
this.vDebug = false; this.vDebug = false;
this.vAllowed = new HashMap(); this.vAllowed = new HashMap<>();
ArrayList<String> a_atts = new ArrayList(); ArrayList<String> aAtts = new ArrayList<>();
a_atts.add("href"); aAtts.add("href");
a_atts.add("target"); aAtts.add("target");
this.vAllowed.put("a", a_atts); this.vAllowed.put("a", aAtts);
ArrayList<String> img_atts = new ArrayList(); ArrayList<String> imgAtts = new ArrayList<>();
img_atts.add("src"); imgAtts.add("src");
img_atts.add("width"); imgAtts.add("width");
img_atts.add("height"); imgAtts.add("height");
img_atts.add("alt"); imgAtts.add("alt");
this.vAllowed.put("img", img_atts); this.vAllowed.put("img", imgAtts);
ArrayList<String> no_atts = new ArrayList(); ArrayList<String> noAtts = new ArrayList<>();
this.vAllowed.put("b", no_atts); this.vAllowed.put("b", noAtts);
this.vAllowed.put("strong", no_atts); this.vAllowed.put(strong, noAtts);
this.vAllowed.put("i", no_atts); this.vAllowed.put("i", noAtts);
this.vAllowed.put("em", no_atts); this.vAllowed.put("em", noAtts);
this.vSelfClosingTags = new String[]{"img"}; this.vSelfClosingTags = new String[]{"img"};
this.vNeedClosingTags = new String[]{"a", "b", "strong", "i", "em"}; this.vNeedClosingTags = new String[]{"a", "b", strong, "i", "em"};
this.vDisallowed = new String[0]; this.vDisallowed = new String[0];
this.vAllowedProtocols = new String[]{"http", "mailto", "https"}; this.vAllowedProtocols = new String[]{"http", "mailto", "https"};
this.vProtocolAtts = new String[]{"src", "href"}; this.vProtocolAtts = new String[]{"src", "href"};
this.vRemoveBlanks = new String[]{"a", "b", "strong", "i", "em"}; this.vRemoveBlanks = new String[]{"a", "b", strong, "i", "em"};
this.vAllowedEntities = new String[]{"amp", "gt", "lt", "quot"}; this.vAllowedEntities = new String[]{"amp", "gt", "lt", "quot"};
this.stripComment = true; this.stripComment = true;
this.encodeQuotes = true; this.encodeQuotes = true;
this.alwaysMakeTags = true; this.alwaysMakeTags = true;
} }
public HTMLFilter(boolean debug) {
this();
this.vDebug = debug;
}
public HTMLFilter(Map<String, Object> conf) {
this.vTagCounts = new HashMap();
this.vDebug = false;
assert conf.containsKey("vAllowed") : "configuration requires vAllowed";
assert conf.containsKey("vSelfClosingTags") : "configuration requires vSelfClosingTags";
assert conf.containsKey("vNeedClosingTags") : "configuration requires vNeedClosingTags";
assert conf.containsKey("vDisallowed") : "configuration requires vDisallowed";
assert conf.containsKey("vAllowedProtocols") : "configuration requires vAllowedProtocols";
assert conf.containsKey("vProtocolAtts") : "configuration requires vProtocolAtts";
assert conf.containsKey("vRemoveBlanks") : "configuration requires vRemoveBlanks";
assert conf.containsKey("vAllowedEntities") : "configuration requires vAllowedEntities";
this.vAllowed = Collections.unmodifiableMap((HashMap)conf.get("vAllowed"));
this.vSelfClosingTags = (String[])((String[])conf.get("vSelfClosingTags"));
this.vNeedClosingTags = (String[])((String[])conf.get("vNeedClosingTags"));
this.vDisallowed = (String[])((String[])conf.get("vDisallowed"));
this.vAllowedProtocols = (String[])((String[])conf.get("vAllowedProtocols"));
this.vProtocolAtts = (String[])((String[])conf.get("vProtocolAtts"));
this.vRemoveBlanks = (String[])((String[])conf.get("vRemoveBlanks"));
this.vAllowedEntities = (String[])((String[])conf.get("vAllowedEntities"));
this.stripComment = conf.containsKey("stripComment") ? (Boolean)conf.get("stripComment") : true;
this.encodeQuotes = conf.containsKey("encodeQuotes") ? (Boolean)conf.get("encodeQuotes") : true;
this.alwaysMakeTags = conf.containsKey("alwaysMakeTags") ? (Boolean)conf.get("alwaysMakeTags") : true;
}
private void reset() { private void reset() {
this.vTagCounts.clear(); this.vTagCounts.clear();
} }
@@ -142,7 +104,6 @@ public final class HTMLFilter {
} }
public static String htmlSpecialChars(String s) { public static String htmlSpecialChars(String s) {
// String result = regexReplace(P_AMP, "&amp;", s);
String result = regexReplace(P_QUOTE, "&quot;", s); String result = regexReplace(P_QUOTE, "&quot;", s);
result = regexReplace(P_LEFT_ARROW, "&lt;", result); result = regexReplace(P_LEFT_ARROW, "&lt;", result);
result = regexReplace(P_RIGHT_ARROW, "&gt;", result); result = regexReplace(P_RIGHT_ARROW, "&gt;", result);
@@ -161,20 +122,10 @@ public final class HTMLFilter {
this.debug(" checkTags: " + s); this.debug(" checkTags: " + s);
s = this.processRemoveBlanks(s); s = this.processRemoveBlanks(s);
this.debug("processRemoveBlanks: " + s); this.debug("processRemoveBlanks: " + s);
// s = this.validateEntities(s);
// this.debug(" validateEntites: " + s);
this.debug("************************************************\n\n"); this.debug("************************************************\n\n");
return s; return s;
} }
public boolean isAlwaysMakeTags() {
return this.alwaysMakeTags;
}
public boolean isStripComments() {
return this.stripComment;
}
private String escapeComments(String s) { private String escapeComments(String s) {
Matcher m = P_COMMENTS.matcher(s); Matcher m = P_COMMENTS.matcher(s);
StringBuffer buf = new StringBuffer(); StringBuffer buf = new StringBuffer();
@@ -189,9 +140,7 @@ public final class HTMLFilter {
private String balanceHTML(String s) { private String balanceHTML(String s) {
if (this.alwaysMakeTags) { if (this.alwaysMakeTags) {
/* s = regexReplace(P_END_ARROW, "", s); // do other
s = regexReplace(P_BODY_TO_END, "<$1>", s);
s = regexReplace(P_XML_CONTENT, "$1<$2", s);*/
} else { } else {
s = regexReplace(P_STRAY_LEFT_ARROW, "&lt;$1", s); s = regexReplace(P_STRAY_LEFT_ARROW, "&lt;$1", s);
s = regexReplace(P_STRAY_RIGHT_ARROW, "$1$2&gt;<", s); s = regexReplace(P_STRAY_RIGHT_ARROW, "$1$2&gt;<", s);
@@ -213,14 +162,9 @@ public final class HTMLFilter {
m.appendTail(buf); m.appendTail(buf);
StringBuilder sBuilder = new StringBuilder(buf.toString()); StringBuilder sBuilder = new StringBuilder(buf.toString());
Iterator var5 = this.vTagCounts.keySet().iterator();
while(var5.hasNext()) { for (Map.Entry<String, Integer> entry : this.vTagCounts.entrySet()) {
String key = (String)var5.next(); sBuilder.append("</").append(entry.getKey()).append(">");
for(int ii = 0; ii < (Integer)this.vTagCounts.get(key); ++ii) {
sBuilder.append("</").append(key).append(">");
}
} }
s = sBuilder.toString(); s = sBuilder.toString();
@@ -238,19 +182,19 @@ public final class HTMLFilter {
P_REMOVE_PAIR_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?></" + tag + ">")); P_REMOVE_PAIR_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?></" + tag + ">"));
} }
result = regexReplace((Pattern)P_REMOVE_PAIR_BLANKS.get(tag), "", result); result = regexReplace(P_REMOVE_PAIR_BLANKS.get(tag), "", result);
if (!P_REMOVE_SELF_BLANKS.containsKey(tag)) { if (!P_REMOVE_SELF_BLANKS.containsKey(tag)) {
P_REMOVE_SELF_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?/>")); P_REMOVE_SELF_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?/>"));
} }
result = regexReplace((Pattern)P_REMOVE_SELF_BLANKS.get(tag), "", result); result = regexReplace(P_REMOVE_SELF_BLANKS.get(tag), "", result);
} }
return result; return result;
} }
private static String regexReplace(Pattern regex_pattern, String replacement, String s) { private static String regexReplace(Pattern regexPattern, String replacement, String s) {
Matcher m = regex_pattern.matcher(s); Matcher m = regexPattern.matcher(s);
return m.replaceAll(replacement); return m.replaceAll(replacement);
} }
@@ -260,7 +204,7 @@ public final class HTMLFilter {
if (m.find()) { if (m.find()) {
name = m.group(1).toLowerCase(); name = m.group(1).toLowerCase();
if (this.allowed(name) && !inArray(name, this.vSelfClosingTags) && this.vTagCounts.containsKey(name)) { if (this.allowed(name) && !inArray(name, this.vSelfClosingTags) && this.vTagCounts.containsKey(name)) {
this.vTagCounts.put(name, (Integer)this.vTagCounts.get(name) - 1); this.vTagCounts.put(name, this.vTagCounts.get(name) - 1);
return "</" + name + ">"; return "</" + name + ">";
} }
} }
@@ -279,52 +223,62 @@ public final class HTMLFilter {
StringBuilder params = new StringBuilder(); StringBuilder params = new StringBuilder();
Matcher m2 = P_QUOTED_ATTRIBUTES.matcher(body); Matcher m2 = P_QUOTED_ATTRIBUTES.matcher(body);
Matcher m3 = P_UNQUOTED_ATTRIBUTES.matcher(body); Matcher m3 = P_UNQUOTED_ATTRIBUTES.matcher(body);
List<String> paramNames = new ArrayList(); List<String> paramNames = new ArrayList<>();
ArrayList paramValues = new ArrayList(); ArrayList<String> paramValues = new ArrayList<>();
while(m2.find()) { getAppend(name, params, m2, m3, paramNames, paramValues);
paramNames.add(m2.group(1));
paramValues.add(m2.group(3));
}
while(m3.find()) { ending = getString(name, ending);
paramNames.add(m3.group(1));
paramValues.add(m3.group(3));
}
for(int ii = 0; ii < paramNames.size(); ++ii) {
String paramName = ((String)paramNames.get(ii)).toLowerCase();
String paramValue = (String)paramValues.get(ii);
if (this.allowedAttribute(name, paramName)) {
if (inArray(paramName, this.vProtocolAtts)) {
paramValue = this.processParamProtocol(paramValue);
}
params.append(' ').append(paramName).append("=\"").append(paramValue).append("\"");
}
}
if (inArray(name, this.vSelfClosingTags)) {
ending = " /";
}
if (inArray(name, this.vNeedClosingTags)) {
ending = "";
}
if (ending != null && ending.length() >= 1) {
ending = " /";
} else if (this.vTagCounts.containsKey(name)) {
this.vTagCounts.put(name, (Integer)this.vTagCounts.get(name) + 1);
} else {
this.vTagCounts.put(name, 1);
}
return "<" + name + params + ending + ">"; return "<" + name + params + ending + ">";
} }
} }
} }
@Nullable
private String getString(String name, String ending) {
if (inArray(name, this.vSelfClosingTags)) {
ending = " /";
}
if (inArray(name, this.vNeedClosingTags)) {
ending = "";
}
if (ending != null && ending.length() >= 1) {
ending = " /";
} else if (this.vTagCounts.containsKey(name)) {
this.vTagCounts.put(name, this.vTagCounts.get(name) + 1);
} else {
this.vTagCounts.put(name, 1);
}
return ending;
}
private void getAppend(String name, StringBuilder params, Matcher m2, Matcher m3, List<String> paramNames, ArrayList<String> paramValues) {
while(m2.find()) {
paramNames.add(m2.group(1));
paramValues.add(m2.group(3));
}
while(m3.find()) {
paramNames.add(m3.group(1));
paramValues.add(m3.group(3));
}
for(int ii = 0; ii < paramNames.size(); ++ii) {
String paramName = paramNames.get(ii).toLowerCase();
String paramValue = paramValues.get(ii);
if (this.allowedAttribute(name, paramName)) {
if (inArray(paramName, this.vProtocolAtts)) {
paramValue = this.processParamProtocol(paramValue);
}
params.append(' ').append(paramName).append("=\"").append(paramValue).append("\"");
}
}
}
private String processParamProtocol(String s) { private String processParamProtocol(String s) {
s = this.decodeEntities(s); s = this.decodeEntities(s);
Matcher m = P_PROTOCOL.matcher(s); Matcher m = P_PROTOCOL.matcher(s);
@@ -365,9 +319,7 @@ public final class HTMLFilter {
} }
m.appendTail(buf); m.appendTail(buf);
s = buf.toString();
buf = new StringBuffer(); buf = new StringBuffer();
// m = P_ENCODE.matcher(s);
while(m.find()) { while(m.find()) {
match = m.group(1); match = m.group(1);
@@ -441,6 +393,6 @@ public final class HTMLFilter {
} }
private boolean allowedAttribute(String name, String paramName) { private boolean allowedAttribute(String name, String paramName) {
return this.allowed(name) && (this.vAllowed.isEmpty() || ((List)this.vAllowed.get(name)).contains(paramName)); return this.allowed(name) && (this.vAllowed.isEmpty() || this.vAllowed.get(name).contains(paramName));
} }
} }
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java
+4 -2
View File
@@ -5,10 +5,12 @@
package com.jero.config.filter.xss; package com.jero.config.filter.xss;
import com.jero.common.exception.JeroBootException;
import org.apache.commons.lang.StringUtils; import org.apache.commons.lang.StringUtils;
public class SqlFilter { public class SqlFilter {
public SqlFilter() { private SqlFilter(){
} }
public static String sqlInject(String str) { public static String sqlInject(String str) {
@@ -23,7 +25,7 @@ public class SqlFilter {
for(int var4 = 0; var4 < var3; ++var4) { for(int var4 = 0; var4 < var3; ++var4) {
String keyword = var2[var4]; String keyword = var2[var4];
if (StringUtils.indexOfIgnoreCase(str, keyword + " ") != -1) { if (StringUtils.indexOfIgnoreCase(str, keyword + " ") != -1) {
throw new RuntimeException("包含非法字符"); throw new JeroBootException("包含非法字符");
} }
} }
str = StringUtils.replace(str, "Line_Break", "\\n"); str = StringUtils.replace(str, "Line_Break", "\\n");
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/XssFilter.java
+2 -1
View File
@@ -17,7 +17,7 @@ public class XssFilter implements Filter {
@Override @Override
public void init(FilterConfig config) throws ServletException { public void init(FilterConfig config) throws ServletException {
// do other
} }
@Override @Override
@@ -40,6 +40,7 @@ public class XssFilter implements Filter {
@Override @Override
public void destroy() { public void destroy() {
// do other
} }
jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/XssHttpServletRequestWrapper.java
+11 -15
View File
@@ -14,7 +14,7 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper; import javax.servlet.http.HttpServletRequestWrapper;
import java.io.ByteArrayInputStream; import java.io.ByteArrayInputStream;
import java.io.IOException; import java.io.IOException;
import java.util.Iterator; import java.nio.charset.StandardCharsets;
import java.util.LinkedHashMap; import java.util.LinkedHashMap;
import java.util.Map; import java.util.Map;
@@ -24,7 +24,6 @@ import java.util.Map;
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
HttpServletRequest orgRequest; HttpServletRequest orgRequest;
private static final HTMLFilter HTML_FILTER = new HTMLFilter(); private static final HTMLFilter HTML_FILTER = new HTMLFilter();
private static final SqlFilter sqlFilter = new SqlFilter();
public XssHttpServletRequestWrapper(HttpServletRequest request) { public XssHttpServletRequestWrapper(HttpServletRequest request) {
super(request); super(request);
@@ -37,12 +36,12 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
if (StringUtils.indexOfIgnoreCase(type, "application/json") < 0) { if (StringUtils.indexOfIgnoreCase(type, "application/json") < 0) {
return super.getInputStream(); return super.getInputStream();
} else { } else {
String json = IOUtils.toString(super.getInputStream(), "utf-8"); String json = IOUtils.toString(super.getInputStream(), StandardCharsets.UTF_8);
if (StringUtils.isBlank(json)) { if (StringUtils.isBlank(json)) {
return super.getInputStream(); return super.getInputStream();
} else { } else {
json = this.xssSqlEncode(json); json = this.xssSqlEncode(json);
final ByteArrayInputStream bis = new ByteArrayInputStream(json.getBytes("utf-8")); final ByteArrayInputStream bis = new ByteArrayInputStream(json.getBytes(StandardCharsets.UTF_8));
return new ServletInputStream() { return new ServletInputStream() {
@Override @Override
public boolean isFinished() { public boolean isFinished() {
@@ -54,6 +53,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
} }
@Override @Override
public void setReadListener(ReadListener readListener) { public void setReadListener(ReadListener readListener) {
// do other
} }
@Override @Override
public int read() throws IOException { public int read() throws IOException {
@@ -84,25 +84,21 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
return parameters; return parameters;
} else { } else {
return null; return new String[0];
} }
} }
@Override @Override
public Map<String, String[]> getParameterMap() { public Map<String, String[]> getParameterMap() {
Map<String, String[]> map = new LinkedHashMap(); Map<String, String[]> map = new LinkedHashMap<>();
Map<String, String[]> parameters = super.getParameterMap(); Map<String, String[]> parameters = super.getParameterMap();
Iterator var3 = parameters.keySet().iterator();
while(var3.hasNext()) { for (Map.Entry<String, String[]> entry : parameters.entrySet()) {
String key = (String)var3.next(); String[] values = entry.getValue();
String[] values = (String[])parameters.get(key); for (int i = 0; i < values.length; ++i) {
for(int i = 0; i < values.length; ++i) {
values[i] = this.xssSqlEncode(values[i]); values[i] = this.xssSqlEncode(values[i]);
} }
map.put(entry.getKey(), values);
map.put(key, values);
} }
return map; return map;
@@ -119,7 +115,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
} }
private String xssSqlEncode(String input) { private String xssSqlEncode(String input) {
input=input.replaceAll("%5b","[").replaceAll("%5d","]"); input=input.replace("%5b","[").replace("%5d","]");
String htmlOutput= HTML_FILTER.filter(input); String htmlOutput= HTML_FILTER.filter(input);
return SqlFilter.sqlInject(htmlOutput); return SqlFilter.sqlInject(htmlOutput);
} }