ZQ/laws-sinotruk-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(过滤): h5标签过滤问题

Browse Source
This commit is contained in:
yjz
2023-10-17 16:05:19 +08:00
parent 29626aea40
commit 7cb7fe871f
1 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
laws-base/laws-base-core/src/main/java/com/jero/config/filter/xss/HTMLFilter.java
+12 -7
View File
@@ -36,8 +36,8 @@ public final class HTMLFilter {
private static final Pattern P_STRAY_LEFT_ARROW = Pattern.compile("<([^>]*?)(?=<|$)"); private static final Pattern P_STRAY_LEFT_ARROW = Pattern.compile("<([^>]*?)(?=<|$)");
private static final Pattern P_STRAY_RIGHT_ARROW = Pattern.compile("(^|>)([^<]*?)(?=>)"); private static final Pattern P_STRAY_RIGHT_ARROW = Pattern.compile("(^|>)([^<]*?)(?=>)");
private static final Pattern P_QUOTE = Pattern.compile("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']"); private static final Pattern P_QUOTE = Pattern.compile("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']");
private static final Pattern P_LEFT_ARROW = Pattern.compile("<"); // private static final Pattern P_LEFT_ARROW = Pattern.compile("<");
private static final Pattern P_RIGHT_ARROW = Pattern.compile(">"); // private static final Pattern P_RIGHT_ARROW = Pattern.compile(">");
private static final Pattern P_BOTH_ARROWS = Pattern.compile("<>"); private static final Pattern P_BOTH_ARROWS = Pattern.compile("<>");
private static final ConcurrentMap<String, Pattern> P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap<>(); private static final ConcurrentMap<String, Pattern> P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap<>();
private static final ConcurrentMap<String, Pattern> P_REMOVE_SELF_BLANKS = new ConcurrentHashMap<>(); private static final ConcurrentMap<String, Pattern> P_REMOVE_SELF_BLANKS = new ConcurrentHashMap<>();
@@ -104,10 +104,12 @@ public final class HTMLFilter {
} }
public static String htmlSpecialChars(String s) { public static String htmlSpecialChars(String s) {
String result = regexReplace(P_QUOTE, "&quot;", s); /**
result = regexReplace(P_LEFT_ARROW, "&lt;", result); * String result = regexReplace(P_QUOTE, "&quot;", s);
result = regexReplace(P_RIGHT_ARROW, "&gt;", result); * result = regexReplace(P_LEFT_ARROW, "&lt;", result);
return result; * result = regexReplace(P_RIGHT_ARROW, "&gt;", result);
*/
return regexReplace(P_QUOTE, "&quot;", s);
} }
public String filter(String input) { public String filter(String input) {
@@ -118,7 +120,10 @@ public final class HTMLFilter {
this.debug(" escapeComments: " + s); this.debug(" escapeComments: " + s);
s = this.balanceHTML(s); s = this.balanceHTML(s);
this.debug(" balanceHTML: " + s); this.debug(" balanceHTML: " + s);
s = this.checkTags(s); /**
* h5标签过滤问题
* s = this.checkTags(s);
*/
this.debug(" checkTags: " + s); this.debug(" checkTags: " + s);
s = this.processRemoveBlanks(s); s = this.processRemoveBlanks(s);
this.debug("processRemoveBlanks: " + s); this.debug("processRemoveBlanks: " + s);