diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/cors/CorsFilter.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/cors/CorsFilter.java index ecddc8c6..29ad141d 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/cors/CorsFilter.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/cors/CorsFilter.java @@ -2,8 +2,6 @@ package com.jero.config.filter.cors; import org.apache.commons.lang3.ArrayUtils; -import org.apache.commons.logging.Log; -import org.apache.commons.logging.LogFactory; import javax.servlet.*; import javax.servlet.annotation.WebFilter; @@ -20,8 +18,6 @@ import java.util.Objects; @WebFilter(urlPatterns = {"/verifyCode/**"}) public class CorsFilter implements Filter { - private static final Log LOGGER = LogFactory.getLog(CorsFilter.class); - private final String originIp; private final List notFilter; @@ -34,7 +30,7 @@ public class CorsFilter implements Filter { @Override public void init(FilterConfig filterConfig) throws ServletException { - + // do other } @Override @@ -62,9 +58,9 @@ public class CorsFilter implements Filter { responseInfo(request, response, chain); } public boolean isMSBrowser(HttpServletRequest request) { - String[] IEBrowserSignals = {"MSIE", "Trident"}; + String[] ieBrowserSignals = {"MSIE", "Trident"}; String userAgent = request.getHeader("User-Agent"); - for (String signal : IEBrowserSignals) { + for (String signal : ieBrowserSignals) { if (userAgent.contains(signal)){ return true; } @@ -87,6 +83,7 @@ public class CorsFilter implements Filter { @Override public void destroy() { + // do other } } diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/csrf/CsrfFilter.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/csrf/CsrfFilter.java index e3fdc19e..c40e84f3 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/csrf/CsrfFilter.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/csrf/CsrfFilter.java @@ -83,10 +83,10 @@ public class CsrfFilter implements Filter { String refHost = ""; referUrl = referUrl.toLowerCase(); if (referUrl.startsWith("http://")) { - int i = referUrl.substring(7).indexOf("/"); + int i = referUrl.indexOf("/", 7) - 7; refHost = referUrl.substring(7,i+7); } else if (referUrl.startsWith("https://")) { - int i = referUrl.substring(8).indexOf("/"); + int i = referUrl.indexOf("/", 8) - 8; refHost = referUrl.substring(8,i+8); } @@ -108,14 +108,15 @@ public class CsrfFilter implements Filter { * @return */ public String getIp(HttpServletRequest request) { + String unknown = "unknown"; String ip = request.getHeader("x-forwarded-for"); - if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) { + if (ip == null || ip.length() == 0 || unknown.equalsIgnoreCase(ip)) { ip = request.getHeader("Proxy-Client-IP"); } - if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) { + if (ip == null || ip.length() == 0 || unknown.equalsIgnoreCase(ip)) { ip = request.getHeader("WL-Proxy-Client-IP"); } - if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) { + if (ip == null || ip.length() == 0 || unknown.equalsIgnoreCase(ip)) { ip = request.getRemoteAddr(); } if (ip.equals("0:0:0:0:0:0:0:1")) { @@ -125,6 +126,6 @@ public class CsrfFilter implements Filter { } @Override public void destroy() { - + // do other } } diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/HTMLFilter.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/HTMLFilter.java index e067d1d9..652b60b7 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/HTMLFilter.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/HTMLFilter.java @@ -6,8 +6,12 @@ package com.jero.config.filter.xss; import cn.hutool.core.lang.Console; +import org.jetbrains.annotations.Nullable; -import java.util.*; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.ConcurrentMap; import java.util.regex.Matcher; @@ -17,7 +21,6 @@ import java.util.regex.Pattern; * @author hzwl */ public final class HTMLFilter { - private static final int REGEX_FLAGS_SI = 34; private static final Pattern P_COMMENTS = Pattern.compile("", 32); private static final Pattern P_COMMENT = Pattern.compile("^!--(.*)--$", 34); private static final Pattern P_TAGS = Pattern.compile("<(.*?)>", 32); @@ -28,21 +31,16 @@ public final class HTMLFilter { private static final Pattern P_PROTOCOL = Pattern.compile("^([^:]+):", 34); private static final Pattern P_ENTITY = Pattern.compile("&#(\\d+);?"); private static final Pattern P_ENTITY_UNICODE = Pattern.compile("&#x([0-9a-f]+);?"); - private static final Pattern P_ENCODE = Pattern.compile("%([0-9a-f]{2});?"); private static final Pattern P_VALID_ENTITIES = Pattern.compile("&([^&;]*)(?=(;|&|$))"); - private static final Pattern P_VALID_QUOTES = Pattern.compile("(>|^)([^<]+?)(<|$)", 32); - private static final Pattern P_END_ARROW = Pattern.compile("^>"); - private static final Pattern P_BODY_TO_END = Pattern.compile("<([^>]*?)(?=<|$)"); - private static final Pattern P_XML_CONTENT = Pattern.compile("(^|>)([^<]*?)(?=>)"); + private static final Pattern P_VALID_QUOTES = Pattern.compile("(>|^)([^<]+)(<|$)", 32); private static final Pattern P_STRAY_LEFT_ARROW = Pattern.compile("<([^>]*?)(?=<|$)"); private static final Pattern P_STRAY_RIGHT_ARROW = Pattern.compile("(^|>)([^<]*?)(?=>)"); - private static final Pattern P_AMP = Pattern.compile("&"); private static final Pattern P_QUOTE = Pattern.compile("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']"); private static final Pattern P_LEFT_ARROW = Pattern.compile("<"); private static final Pattern P_RIGHT_ARROW = Pattern.compile(">"); private static final Pattern P_BOTH_ARROWS = Pattern.compile("<>"); - private static final ConcurrentMap P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap(); - private static final ConcurrentMap P_REMOVE_SELF_BLANKS = new ConcurrentHashMap(); + private static final ConcurrentMap P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap<>(); + private static final ConcurrentMap P_REMOVE_SELF_BLANKS = new ConcurrentHashMap<>(); private final Map> vAllowed; private final Map vTagCounts; private final String[] vSelfClosingTags; @@ -57,75 +55,39 @@ public final class HTMLFilter { private boolean vDebug; private final boolean alwaysMakeTags; + public HTMLFilter() { - this.vTagCounts = new HashMap(); + String strong = "strong"; + this.vTagCounts = new HashMap<>(); this.vDebug = false; - this.vAllowed = new HashMap(); - ArrayList a_atts = new ArrayList(); - a_atts.add("href"); - a_atts.add("target"); - this.vAllowed.put("a", a_atts); - ArrayList img_atts = new ArrayList(); - img_atts.add("src"); - img_atts.add("width"); - img_atts.add("height"); - img_atts.add("alt"); - this.vAllowed.put("img", img_atts); - ArrayList no_atts = new ArrayList(); - this.vAllowed.put("b", no_atts); - this.vAllowed.put("strong", no_atts); - this.vAllowed.put("i", no_atts); - this.vAllowed.put("em", no_atts); + this.vAllowed = new HashMap<>(); + ArrayList aAtts = new ArrayList<>(); + aAtts.add("href"); + aAtts.add("target"); + this.vAllowed.put("a", aAtts); + ArrayList imgAtts = new ArrayList<>(); + imgAtts.add("src"); + imgAtts.add("width"); + imgAtts.add("height"); + imgAtts.add("alt"); + this.vAllowed.put("img", imgAtts); + ArrayList noAtts = new ArrayList<>(); + this.vAllowed.put("b", noAtts); + this.vAllowed.put(strong, noAtts); + this.vAllowed.put("i", noAtts); + this.vAllowed.put("em", noAtts); this.vSelfClosingTags = new String[]{"img"}; - this.vNeedClosingTags = new String[]{"a", "b", "strong", "i", "em"}; + this.vNeedClosingTags = new String[]{"a", "b", strong, "i", "em"}; this.vDisallowed = new String[0]; this.vAllowedProtocols = new String[]{"http", "mailto", "https"}; this.vProtocolAtts = new String[]{"src", "href"}; - this.vRemoveBlanks = new String[]{"a", "b", "strong", "i", "em"}; + this.vRemoveBlanks = new String[]{"a", "b", strong, "i", "em"}; this.vAllowedEntities = new String[]{"amp", "gt", "lt", "quot"}; this.stripComment = true; this.encodeQuotes = true; this.alwaysMakeTags = true; } - public HTMLFilter(boolean debug) { - this(); - this.vDebug = debug; - } - - public HTMLFilter(Map conf) { - this.vTagCounts = new HashMap(); - this.vDebug = false; - - assert conf.containsKey("vAllowed") : "configuration requires vAllowed"; - - assert conf.containsKey("vSelfClosingTags") : "configuration requires vSelfClosingTags"; - - assert conf.containsKey("vNeedClosingTags") : "configuration requires vNeedClosingTags"; - - assert conf.containsKey("vDisallowed") : "configuration requires vDisallowed"; - - assert conf.containsKey("vAllowedProtocols") : "configuration requires vAllowedProtocols"; - - assert conf.containsKey("vProtocolAtts") : "configuration requires vProtocolAtts"; - - assert conf.containsKey("vRemoveBlanks") : "configuration requires vRemoveBlanks"; - - assert conf.containsKey("vAllowedEntities") : "configuration requires vAllowedEntities"; - - this.vAllowed = Collections.unmodifiableMap((HashMap)conf.get("vAllowed")); - this.vSelfClosingTags = (String[])((String[])conf.get("vSelfClosingTags")); - this.vNeedClosingTags = (String[])((String[])conf.get("vNeedClosingTags")); - this.vDisallowed = (String[])((String[])conf.get("vDisallowed")); - this.vAllowedProtocols = (String[])((String[])conf.get("vAllowedProtocols")); - this.vProtocolAtts = (String[])((String[])conf.get("vProtocolAtts")); - this.vRemoveBlanks = (String[])((String[])conf.get("vRemoveBlanks")); - this.vAllowedEntities = (String[])((String[])conf.get("vAllowedEntities")); - this.stripComment = conf.containsKey("stripComment") ? (Boolean)conf.get("stripComment") : true; - this.encodeQuotes = conf.containsKey("encodeQuotes") ? (Boolean)conf.get("encodeQuotes") : true; - this.alwaysMakeTags = conf.containsKey("alwaysMakeTags") ? (Boolean)conf.get("alwaysMakeTags") : true; - } - private void reset() { this.vTagCounts.clear(); } @@ -142,7 +104,6 @@ public final class HTMLFilter { } public static String htmlSpecialChars(String s) { -// String result = regexReplace(P_AMP, "&", s); String result = regexReplace(P_QUOTE, """, s); result = regexReplace(P_LEFT_ARROW, "<", result); result = regexReplace(P_RIGHT_ARROW, ">", result); @@ -161,20 +122,10 @@ public final class HTMLFilter { this.debug(" checkTags: " + s); s = this.processRemoveBlanks(s); this.debug("processRemoveBlanks: " + s); -// s = this.validateEntities(s); -// this.debug(" validateEntites: " + s); this.debug("************************************************\n\n"); return s; } - public boolean isAlwaysMakeTags() { - return this.alwaysMakeTags; - } - - public boolean isStripComments() { - return this.stripComment; - } - private String escapeComments(String s) { Matcher m = P_COMMENTS.matcher(s); StringBuffer buf = new StringBuffer(); @@ -189,9 +140,7 @@ public final class HTMLFilter { private String balanceHTML(String s) { if (this.alwaysMakeTags) { -/* s = regexReplace(P_END_ARROW, "", s); - s = regexReplace(P_BODY_TO_END, "<$1>", s); - s = regexReplace(P_XML_CONTENT, "$1<$2", s);*/ + // do other } else { s = regexReplace(P_STRAY_LEFT_ARROW, "<$1", s); s = regexReplace(P_STRAY_RIGHT_ARROW, "$1$2><", s); @@ -213,14 +162,9 @@ public final class HTMLFilter { m.appendTail(buf); StringBuilder sBuilder = new StringBuilder(buf.toString()); - Iterator var5 = this.vTagCounts.keySet().iterator(); - while(var5.hasNext()) { - String key = (String)var5.next(); - - for(int ii = 0; ii < (Integer)this.vTagCounts.get(key); ++ii) { - sBuilder.append(""); - } + for (Map.Entry entry : this.vTagCounts.entrySet()) { + sBuilder.append(""); } s = sBuilder.toString(); @@ -238,19 +182,19 @@ public final class HTMLFilter { P_REMOVE_PAIR_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?>")); } - result = regexReplace((Pattern)P_REMOVE_PAIR_BLANKS.get(tag), "", result); + result = regexReplace(P_REMOVE_PAIR_BLANKS.get(tag), "", result); if (!P_REMOVE_SELF_BLANKS.containsKey(tag)) { P_REMOVE_SELF_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?/>")); } - result = regexReplace((Pattern)P_REMOVE_SELF_BLANKS.get(tag), "", result); + result = regexReplace(P_REMOVE_SELF_BLANKS.get(tag), "", result); } return result; } - private static String regexReplace(Pattern regex_pattern, String replacement, String s) { - Matcher m = regex_pattern.matcher(s); + private static String regexReplace(Pattern regexPattern, String replacement, String s) { + Matcher m = regexPattern.matcher(s); return m.replaceAll(replacement); } @@ -260,7 +204,7 @@ public final class HTMLFilter { if (m.find()) { name = m.group(1).toLowerCase(); if (this.allowed(name) && !inArray(name, this.vSelfClosingTags) && this.vTagCounts.containsKey(name)) { - this.vTagCounts.put(name, (Integer)this.vTagCounts.get(name) - 1); + this.vTagCounts.put(name, this.vTagCounts.get(name) - 1); return ""; } } @@ -279,52 +223,62 @@ public final class HTMLFilter { StringBuilder params = new StringBuilder(); Matcher m2 = P_QUOTED_ATTRIBUTES.matcher(body); Matcher m3 = P_UNQUOTED_ATTRIBUTES.matcher(body); - List paramNames = new ArrayList(); - ArrayList paramValues = new ArrayList(); + List paramNames = new ArrayList<>(); + ArrayList paramValues = new ArrayList<>(); - while(m2.find()) { - paramNames.add(m2.group(1)); - paramValues.add(m2.group(3)); - } + getAppend(name, params, m2, m3, paramNames, paramValues); - while(m3.find()) { - paramNames.add(m3.group(1)); - paramValues.add(m3.group(3)); - } - - for(int ii = 0; ii < paramNames.size(); ++ii) { - String paramName = ((String)paramNames.get(ii)).toLowerCase(); - String paramValue = (String)paramValues.get(ii); - if (this.allowedAttribute(name, paramName)) { - if (inArray(paramName, this.vProtocolAtts)) { - paramValue = this.processParamProtocol(paramValue); - } - - params.append(' ').append(paramName).append("=\"").append(paramValue).append("\""); - } - } - - if (inArray(name, this.vSelfClosingTags)) { - ending = " /"; - } - - if (inArray(name, this.vNeedClosingTags)) { - ending = ""; - } - - if (ending != null && ending.length() >= 1) { - ending = " /"; - } else if (this.vTagCounts.containsKey(name)) { - this.vTagCounts.put(name, (Integer)this.vTagCounts.get(name) + 1); - } else { - this.vTagCounts.put(name, 1); - } + ending = getString(name, ending); return "<" + name + params + ending + ">"; } } } + @Nullable + private String getString(String name, String ending) { + if (inArray(name, this.vSelfClosingTags)) { + ending = " /"; + } + + if (inArray(name, this.vNeedClosingTags)) { + ending = ""; + } + + if (ending != null && ending.length() >= 1) { + ending = " /"; + } else if (this.vTagCounts.containsKey(name)) { + this.vTagCounts.put(name, this.vTagCounts.get(name) + 1); + } else { + this.vTagCounts.put(name, 1); + } + return ending; + } + + private void getAppend(String name, StringBuilder params, Matcher m2, Matcher m3, List paramNames, ArrayList paramValues) { + while(m2.find()) { + paramNames.add(m2.group(1)); + paramValues.add(m2.group(3)); + } + + while(m3.find()) { + paramNames.add(m3.group(1)); + paramValues.add(m3.group(3)); + } + + for(int ii = 0; ii < paramNames.size(); ++ii) { + String paramName = paramNames.get(ii).toLowerCase(); + String paramValue = paramValues.get(ii); + if (this.allowedAttribute(name, paramName)) { + if (inArray(paramName, this.vProtocolAtts)) { + paramValue = this.processParamProtocol(paramValue); + } + + params.append(' ').append(paramName).append("=\"").append(paramValue).append("\""); + } + } + } + private String processParamProtocol(String s) { s = this.decodeEntities(s); Matcher m = P_PROTOCOL.matcher(s); @@ -365,9 +319,7 @@ public final class HTMLFilter { } m.appendTail(buf); - s = buf.toString(); buf = new StringBuffer(); -// m = P_ENCODE.matcher(s); while(m.find()) { match = m.group(1); @@ -441,6 +393,6 @@ public final class HTMLFilter { } private boolean allowedAttribute(String name, String paramName) { - return this.allowed(name) && (this.vAllowed.isEmpty() || ((List)this.vAllowed.get(name)).contains(paramName)); + return this.allowed(name) && (this.vAllowed.isEmpty() || this.vAllowed.get(name).contains(paramName)); } } diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java index 6d8d320a..280b2703 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/SqlFilter.java @@ -5,10 +5,12 @@ package com.jero.config.filter.xss; +import com.jero.common.exception.JeroBootException; import org.apache.commons.lang.StringUtils; public class SqlFilter { - public SqlFilter() { + private SqlFilter(){ + } public static String sqlInject(String str) { @@ -23,7 +25,7 @@ public class SqlFilter { for(int var4 = 0; var4 < var3; ++var4) { String keyword = var2[var4]; if (StringUtils.indexOfIgnoreCase(str, keyword + " ") != -1) { - throw new RuntimeException("包含非法字符"); + throw new JeroBootException("包含非法字符"); } } str = StringUtils.replace(str, "Line_Break", "\\n"); diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/XssFilter.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/XssFilter.java index dca9b096..7f4d2dfa 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/XssFilter.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/XssFilter.java @@ -17,7 +17,7 @@ public class XssFilter implements Filter { @Override public void init(FilterConfig config) throws ServletException { - + // do other } @Override @@ -40,6 +40,7 @@ public class XssFilter implements Filter { @Override public void destroy() { + // do other } diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/XssHttpServletRequestWrapper.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/XssHttpServletRequestWrapper.java index 7e554c1f..d73678b8 100644 --- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/XssHttpServletRequestWrapper.java +++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/filter/xss/XssHttpServletRequestWrapper.java @@ -14,7 +14,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; import java.io.ByteArrayInputStream; import java.io.IOException; -import java.util.Iterator; +import java.nio.charset.StandardCharsets; import java.util.LinkedHashMap; import java.util.Map; @@ -24,7 +24,6 @@ import java.util.Map; public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { HttpServletRequest orgRequest; private static final HTMLFilter HTML_FILTER = new HTMLFilter(); - private static final SqlFilter sqlFilter = new SqlFilter(); public XssHttpServletRequestWrapper(HttpServletRequest request) { super(request); @@ -37,12 +36,12 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { if (StringUtils.indexOfIgnoreCase(type, "application/json") < 0) { return super.getInputStream(); } else { - String json = IOUtils.toString(super.getInputStream(), "utf-8"); + String json = IOUtils.toString(super.getInputStream(), StandardCharsets.UTF_8); if (StringUtils.isBlank(json)) { return super.getInputStream(); } else { json = this.xssSqlEncode(json); - final ByteArrayInputStream bis = new ByteArrayInputStream(json.getBytes("utf-8")); + final ByteArrayInputStream bis = new ByteArrayInputStream(json.getBytes(StandardCharsets.UTF_8)); return new ServletInputStream() { @Override public boolean isFinished() { @@ -54,6 +53,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { } @Override public void setReadListener(ReadListener readListener) { + // do other } @Override public int read() throws IOException { @@ -84,25 +84,21 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { return parameters; } else { - return null; + return new String[0]; } } @Override public Map getParameterMap() { - Map map = new LinkedHashMap(); + Map map = new LinkedHashMap<>(); Map parameters = super.getParameterMap(); - Iterator var3 = parameters.keySet().iterator(); - while(var3.hasNext()) { - String key = (String)var3.next(); - String[] values = (String[])parameters.get(key); - - for(int i = 0; i < values.length; ++i) { + for (Map.Entry entry : parameters.entrySet()) { + String[] values = entry.getValue(); + for (int i = 0; i < values.length; ++i) { values[i] = this.xssSqlEncode(values[i]); } - - map.put(key, values); + map.put(entry.getKey(), values); } return map; @@ -119,7 +115,7 @@ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { } private String xssSqlEncode(String input) { - input=input.replaceAll("%5b","[").replaceAll("%5d","]"); + input=input.replace("%5b","[").replace("%5d","]"); String htmlOutput= HTML_FILTER.filter(input); return SqlFilter.sqlInject(htmlOutput); }