devbox
繁依Fanyi0
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

SpringMVC 反射型跨站点脚本攻击_反射型跨站点脚本攻击解决方案

作者：繁依Fanyi0 | 2024-02-27 05:37:24

赞

踩

反射型跨站点脚本攻击解决方案

解决方案：

服务端校验，添加拦截器

配置web,xml
  1.   <filter>
  2.     <filter-name>xssFilter </filter-name>
  3.     <filter-class>com.fh.filter.XssFilter </filter-class>
  4.   </filter>
XssFilter
  1. package com.fh.filter;
  2.  
  3. import com.fh.controller.base.BaseController;
  4. import lombok.extern.slf4j.Slf4j;
  5. import org.apache.commons.lang.StringUtils;
  6.  
  7. import javax.servlet.*;
  8. import javax.servlet.http.HttpServletRequest;
  9. import javax.servlet.http.HttpServletResponse;
  10. import java.io.IOException;
  11. import java.util.ArrayList;
  12. import java.util.List;
  13. import java.util.regex.Matcher;
  14. import java.util.regex.Pattern;
  15.  
  16. @Slf4j
  17. public class XssFilter extends BaseController implements Filter {
  18.  
  19.     /**
  20.      * 不需要过滤的链接
  21.      */
  22.     public List<String> excludes = new ArrayList<>();
  23.     /**
  24.      * xss过滤开关
  25.      */
  26.     public boolean enabled = false;
  27.  
  28.     @Override
  29.     public void init(FilterConfig filterConfig) throws ServletException {
  30.         String tempExcludes = filterConfig.getInitParameter("excludes");
  31.         String tempEnabled = filterConfig.getInitParameter("enabled");
  32.         if (StringUtils.isNotEmpty(tempExcludes)) {
  33.             String[] url = tempExcludes.split(",");
  34.             for (int i = 0; url != null && i < url.length; i++) {
  35.                 excludes.add(url[i]);
  36.             }
  37.         }
  38.         if (StringUtils.isNotEmpty(tempEnabled)) {
  39.             enabled = Boolean.valueOf(tempEnabled);
  40.         }
  41.     }
  42.  
  43.     @Override
  44.     public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
  45.         HttpServletRequest req = (HttpServletRequest) request;
  46.         HttpServletResponse resp = (HttpServletResponse) response;
  47.         if (handleExcludeURL(req, resp)) {
  48.             filterChain.doFilter(request, response);
  49.             return;
  50.         }
  51.         filterChain.doFilter(new XssHttpServletRequestWrapper((HttpServletRequest) request), response);
  52.     }
  53.  
  54.  
  55.  
  56.     @Override
  57.     public void destroy() {
  58.         // noop
  59.     }
  60.  
  61.     private boolean handleExcludeURL(HttpServletRequest request, HttpServletResponse response) {
  62.         if (!enabled) {
  63.             return true;
  64.         }
  65.         if (excludes == null || excludes.isEmpty()) {
  66.             return false;
  67.         }
  68.         String url = request.getServletPath();
  69.         for (String pattern : excludes) {
  70.             Pattern p = Pattern.compile("^" + pattern);
  71.             Matcher m = p.matcher(url);
  72.             if (m.find()){
  73.                 return true;
  74.             }
  75.         }
  76.         return false;
  77.     }
  78. }
  79.
XssHttpServletRequestWrapper
  1. package com.fh.filter;
  2.  
  3. import lombok.extern.slf4j.Slf4j;
  4. import org.apache.commons.io.IOUtils;
  5. import org.apache.commons.lang.StringUtils;
  6. import org.springframework.http.HttpHeaders;
  7. import org.springframework.http.MediaType;
  8.  
  9. import javax.servlet.ServletInputStream;
  10. import javax.servlet.http.HttpServletRequest;
  11. import javax.servlet.http.HttpServletRequestWrapper;
  12. import java.io.ByteArrayInputStream;
  13. import java.io.IOException;
  14. import java.util.*;
  15.  
  16. @Slf4j
  17. public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
  18.  
  19.     private HttpServletRequest orgRequest;
  20.  
  21.     // html过滤
  22.     private final static HTMLFilter htmlFilter = new HTMLFilter();
  23.  
  24.     public XssHttpServletRequestWrapper(HttpServletRequest request) {
  25.         super(request);
  26.         orgRequest = request;
  27.     }
  28.  
  29.     @Override
  30.     public ServletInputStream getInputStream() throws IOException {
  31.         // 非json类型，直接返回
  32.         if (!isJsonRequest()) {
  33.             return super.getInputStream();
  34.         }
  35.         // 为空，直接返回
  36.         String json = IOUtils.toString(super.getInputStream(), "utf-8");
  37.         if (StringUtils.isBlank(json)) {
  38.             return super.getInputStream();
  39.         }
  40.  
  41.         // xss过滤
  42.         json = xssEncode(json);
  43.         final ByteArrayInputStream bis = new ByteArrayInputStream(json.getBytes("utf-8"));
  44.         return new ServletInputStream() {
  45.             @Override
  46.             public int read() throws IOException {
  47.                 return bis.read();
  48.             }
  49.         };
  50.     }
  51.  
  52.     /**
  53.      * 覆盖getParameter方法，将参数名和参数值都做xss过滤。<br/>
  54.      */
  55.     @Override
  56.     public String getParameter(String rawName) {
  57.         String value = super.getParameter(xssEncode(rawName));
  58.         if (StringUtils.isNotBlank(value)) {
  59.             value = xssEncode(value);
  60.         }
  61.         return value;
  62.     }
  63.  
  64.     @Override
  65.     public String[] getParameterValues(String name) {
  66.         String[] parameters = super.getParameterValues(name);
  67.         if (parameters == null || parameters.length == 0) {
  68.             return null;
  69.         }
  70.  
  71.         for (int i = 0; i < parameters.length; i++) {
  72.             parameters[i] = xssEncode(parameters[i]);
  73.         }
  74.         return parameters;
  75.     }
  76.  
  77.     @Override
  78.     public Enumeration<String> getParameterNames() {
  79.         Enumeration<String> parameterNames = super.getParameterNames();
  80.  
  81.         List<String> list = new LinkedList<>();
  82.         if (parameterNames != null) {
  83.  
  84.             while (parameterNames.hasMoreElements()) {
  85.                 String rawName = parameterNames.nextElement();
  86.                 String safetyName = xssEncode(rawName);
  87.  
  88.                 if (!Objects.equals(rawName, safetyName))
  89.                 {
  90.                     log.warn("请求路径: {},参数键: {}, xss过滤后: {}. 疑似xss攻击",
  91.                             orgRequest.getRequestURI(), rawName, safetyName);
  92.                 }
  93.                 list.add(safetyName);
  94.             }
  95.         }
  96.  
  97.         return Collections.enumeration(list);
  98.     }
  99.  
  100.     @Override
  101.     public Map<String, String[]> getParameterMap() {
  102.  
  103.         Map<String, String[]> map = new LinkedHashMap<>();
  104.         Map<String, String[]> parameters = super.getParameterMap();
  105.         for (String key : parameters.keySet()) {
  106.             String[] values = parameters.get(key);
  107.             for (int i = 0; i < values.length; i++) {
  108.                 values[i] = xssEncode(values[i]);
  109.             }
  110.             map.put(key, values);
  111.         }
  112.         return map;
  113.     }
  114.  
  115.     /**
  116.      * 覆盖getHeader方法，将参数名和参数值都做xss过滤。<br/>
  117.      * 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>
  118.      * getHeaderNames 也可能需要覆盖
  119.      */
  120.     @Override
  121.     public String getHeader(String name) {
  122.         String value = super.getHeader(xssEncode(name));
  123.         if (StringUtils.isNotBlank(value)) {
  124.             value = xssEncode(value);
  125.         }
  126.         return value;
  127.     }
  128.  
  129.  
  130.     private String xssEncode(String input) {
  131.         return htmlFilter.filter(input);
  132.     }
  133.  
  134.     /**
  135.      * 是否是Json请求
  136.      */
  137.     public boolean isJsonRequest()
  138.     {
  139.         String header = super.getHeader(HttpHeaders.CONTENT_TYPE);
  140.         return StringUtils.startsWithIgnoreCase(header, MediaType.APPLICATION_JSON_VALUE);
  141.     }
  142. }
  143.
 HTMLFilter
  1. package com.fh.filter;
  2.  
  3. import lombok.extern.slf4j.Slf4j;
  4.  
  5. import java.util.*;
  6. import java.util.concurrent.ConcurrentHashMap;
  7. import java.util.concurrent.ConcurrentMap;
  8. import java.util.regex.Matcher;
  9. import java.util.regex.Pattern;
  10.  
  11. @Slf4j
  12. public final class HTMLFilter {
  13.  
  14.     /** regex flag union representing /si modifiers in php **/
  15.     private static final int REGEX_FLAGS_SI = Pattern.CASE_INSENSITIVE | Pattern.DOTALL;
  16.     private static final Pattern P_COMMENTS = Pattern.compile("<!--(.*?)-->", Pattern.DOTALL);
  17.     private static final Pattern P_COMMENT = Pattern.compile("^!--(.*)--$", REGEX_FLAGS_SI);
  18.     private static final Pattern P_TAGS = Pattern.compile("<(.*?)>", Pattern.DOTALL);
  19.     private static final Pattern P_END_TAG = Pattern.compile("^/([a-z0-9]+)", REGEX_FLAGS_SI);
  20.     private static final Pattern P_START_TAG = Pattern.compile("^([a-z0-9]+)(.*?)(/?)$", REGEX_FLAGS_SI);
  21.     private static final Pattern P_QUOTED_ATTRIBUTES = Pattern.compile("([a-z0-9]+)=([\"'])(.*?)\\2", REGEX_FLAGS_SI);
  22.     private static final Pattern P_UNQUOTED_ATTRIBUTES = Pattern.compile("([a-z0-9]+)(=)([^\"\\s']+)", REGEX_FLAGS_SI);
  23.     private static final Pattern P_PROTOCOL = Pattern.compile("^([^:]+):", REGEX_FLAGS_SI);
  24.     private static final Pattern P_ENTITY = Pattern.compile("&#(\\d+);?");
  25.     private static final Pattern P_ENTITY_UNICODE = Pattern.compile("&#x([0-9a-f]+);?");
  26.     private static final Pattern P_ENCODE = Pattern.compile("%([0-9a-f]{2});?");
  27.     private static final Pattern P_VALID_ENTITIES = Pattern.compile("&([^&;]*)(?=(;|&|$))");
  28.     private static final Pattern P_VALID_QUOTES = Pattern.compile("(>|^)([^<]+?)(<|$)", Pattern.DOTALL);
  29.     private static final Pattern P_END_ARROW = Pattern.compile("^>");
  30.     private static final Pattern P_BODY_TO_END = Pattern.compile("<([^>]*?)(?=<|$)");
  31.     private static final Pattern P_XML_CONTENT = Pattern.compile("(^|>)([^<]*?)(?=>)");
  32.     private static final Pattern P_STRAY_LEFT_ARROW = Pattern.compile("<([^>]*?)(?=<|$)");
  33.     private static final Pattern P_STRAY_RIGHT_ARROW = Pattern.compile("(^|>)([^<]*?)(?=>)");
  34.     private static final Pattern P_AMP = Pattern.compile("&");
  35.     private static final Pattern P_QUOTE = Pattern.compile("<");
  36.     private static final Pattern P_LEFT_ARROW = Pattern.compile("<");
  37.     private static final Pattern P_RIGHT_ARROW = Pattern.compile(">");
  38.     private static final Pattern P_BOTH_ARROWS = Pattern.compile("<>");
  39.  
  40.     // @xxx could grow large... maybe use sesat's ReferenceMap
  41.     private static final ConcurrentMap<String,Pattern> P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap<String, Pattern>();
  42.     private static final ConcurrentMap<String,Pattern> P_REMOVE_SELF_BLANKS = new ConcurrentHashMap<String, Pattern>();
  43.  
  44.     /** set of allowed html elements, along with allowed attributes for each element **/
  45.     private final Map<String, List<String>> vAllowed;
  46.     /** counts of open tags for each (allowable) html element **/
  47.     private final Map<String, Integer> vTagCounts = new HashMap<String, Integer>();
  48.  
  49.     /** html elements which must always be self-closing (e.g. "<img />") **/
  50.     private final String[] vSelfClosingTags;
  51.     /** html elements which must always have separate opening and closing tags (e.g. "<b></b>") **/
  52.     private final String[] vNeedClosingTags;
  53.     /** set of disallowed html elements **/
  54.     private final String[] vDisallowed;
  55.     /** attributes which should be checked for valid protocols **/
  56.     private final String[] vProtocolAtts;
  57.     /** allowed protocols **/
  58.     private final String[] vAllowedProtocols;
  59.     /** tags which should be removed if they contain no content (e.g. "<b></b>" or "<b />") **/
  60.     private final String[] vRemoveBlanks;
  61.     /** entities allowed within html markup **/
  62.     private final String[] vAllowedEntities;
  63.     /** flag determining whether comments are allowed in input String. */
  64.     private final boolean stripComment;
  65.     private final boolean encodeQuotes;
  66.     private boolean vDebug = false;
  67.     /**
  68.      * flag determining whether to try to make tags when presented with "unbalanced"
  69.      * angle brackets (e.g. "<b text </b>" becomes "<b> text </b>").  If set to false,
  70.      * unbalanced angle brackets will be html escaped.
  71.      */
  72.     private final boolean alwaysMakeTags;
  73.  
  74.     /** Default constructor.
  75.      *
  76.      */
  77.     public HTMLFilter() {
  78.         vAllowed = new HashMap<>();
  79.  
  80.         final ArrayList<String> a_atts = new ArrayList<String>();
  81.         a_atts.add("href");
  82.         a_atts.add("target");
  83.         vAllowed.put("a", a_atts);
  84.  
  85.         final ArrayList<String> img_atts = new ArrayList<String>();
  86.         img_atts.add("src");
  87.         img_atts.add("width");
  88.         img_atts.add("height");
  89.         img_atts.add("alt");
  90.         vAllowed.put("img", img_atts);
  91.  
  92.         final ArrayList<String> no_atts = new ArrayList<String>();
  93.         vAllowed.put("b", no_atts);
  94.         vAllowed.put("strong", no_atts);
  95.         vAllowed.put("i", no_atts);
  96.         vAllowed.put("em", no_atts);
  97.  
  98.         vSelfClosingTags = new String[]{"img"};
  99.         vNeedClosingTags = new String[]{"a", "b", "strong", "i", "em"};
  100.         vDisallowed = new String[]{};
  101.         vAllowedProtocols = new String[]{"http", "mailto", "https"}; // no ftp.
  102.         vProtocolAtts = new String[]{"src", "href"};
  103.         vRemoveBlanks = new String[]{"a", "b", "strong", "i", "em"};
  104.         vAllowedEntities = new String[]{"amp", "gt", "lt", "quot"};
  105.         stripComment = true;
  106.         encodeQuotes = true;
  107.         alwaysMakeTags = true;
  108.     }
  109.  
  110.     /** Set debug flag to true. Otherwise use default settings. See the default constructor.
  111.      *
  112.      * @param debug turn debug on with a true argument
  113.      */
  114.     public HTMLFilter(final boolean debug) {
  115.         this();
  116.         vDebug = debug;
  117.  
  118.     }
  119.  
  120.     /** Map-parameter configurable constructor.
  121.      *
  122.      * @param conf map containing configuration. keys match field names.
  123.      */
  124.     @SuppressWarnings("unchecked")
  125.     public HTMLFilter(final Map<String,Object> conf) {
  126.  
  127.         assert conf.containsKey("vAllowed") : "configuration requires vAllowed";
  128.         assert conf.containsKey("vSelfClosingTags") : "configuration requires vSelfClosingTags";
  129.         assert conf.containsKey("vNeedClosingTags") : "configuration requires vNeedClosingTags";
  130.         assert conf.containsKey("vDisallowed") : "configuration requires vDisallowed";
  131.         assert conf.containsKey("vAllowedProtocols") : "configuration requires vAllowedProtocols";
  132.         assert conf.containsKey("vProtocolAtts") : "configuration requires vProtocolAtts";
  133.         assert conf.containsKey("vRemoveBlanks") : "configuration requires vRemoveBlanks";
  134.         assert conf.containsKey("vAllowedEntities") : "configuration requires vAllowedEntities";
  135.  
  136.         vAllowed = Collections.unmodifiableMap((HashMap<String, List<String>>) conf.get("vAllowed"));
  137.         vSelfClosingTags = (String[]) conf.get("vSelfClosingTags");
  138.         vNeedClosingTags = (String[]) conf.get("vNeedClosingTags");
  139.         vDisallowed = (String[]) conf.get("vDisallowed");
  140.         vAllowedProtocols = (String[]) conf.get("vAllowedProtocols");
  141.         vProtocolAtts = (String[]) conf.get("vProtocolAtts");
  142.         vRemoveBlanks = (String[]) conf.get("vRemoveBlanks");
  143.         vAllowedEntities = (String[]) conf.get("vAllowedEntities");
  144.         stripComment =  conf.containsKey("stripComment") ? (Boolean) conf.get("stripComment") : true;
  145.         encodeQuotes = conf.containsKey("encodeQuotes") ? (Boolean) conf.get("encodeQuotes") : true;
  146.         alwaysMakeTags = conf.containsKey("alwaysMakeTags") ? (Boolean) conf.get("alwaysMakeTags") : true;
  147.     }
  148.  
  149.     private void reset() {
  150.         vTagCounts.clear();
  151.     }
  152.  
  153.     private void debug(final String msg) {
  154.         if (vDebug) {
  155.             log.info(msg);
  156.         }
  157.     }
  158.  
  159.     //---------------------------------------------------------------
  160.     // my versions of some PHP library functions
  161.     public static String chr(final int decimal) {
  162.         return String.valueOf((char) decimal);
  163.     }
  164.  
  165.     public static String htmlSpecialChars(final String s) {
  166.         String result = s;
  167.         result = regexReplace(P_AMP, "&amp;", result);
  168.         result = regexReplace(P_QUOTE, "&quot;", result);
  169.         result = regexReplace(P_LEFT_ARROW, "&lt;", result);
  170.         result = regexReplace(P_RIGHT_ARROW, "&gt;", result);
  171.         return result;
  172.     }
  173.  
  174.     //---------------------------------------------------------------
  175.     /**
  176.      * given a user submitted input String, filter out any invalid or restricted
  177.      * html.
  178.      *
  179.      * @param input text (i.e. submitted by a user) than may contain html
  180.      * @return "clean" version of input, with only valid, whitelisted html elements allowed
  181.      */
  182.     public String filter(final String input) {
  183.         reset();
  184.         String s = input;
  185.  
  186.         debug("************************************************");
  187.         debug("              INPUT: " + input);
  188.  
  189.         s = escapeComments(s);
  190.         debug("     escapeComments: " + s);
  191.  
  192.         s = balanceHTML(s);
  193.         debug("        balanceHTML: " + s);
  194.  
  195.         s = checkTags(s);
  196.         debug("          checkTags: " + s);
  197.  
  198.         s = processRemoveBlanks(s);
  199.         debug("processRemoveBlanks: " + s);
  200.  
  201.         s = validateEntities(s);
  202.         debug("    validateEntites: " + s);
  203.  
  204.         debug("************************************************\n\n");
  205.         return s;
  206.     }
  207.  
  208.     public boolean isAlwaysMakeTags(){
  209.         return alwaysMakeTags;
  210.     }
  211.  
  212.     public boolean isStripComments(){
  213.         return stripComment;
  214.     }
  215.  
  216.     private String escapeComments(final String s) {
  217.         final Matcher m = P_COMMENTS.matcher(s);
  218.         final StringBuffer buf = new StringBuffer();
  219.         if (m.find()) {
  220.             final String match = m.group(1); //(.*?)
  221.             m.appendReplacement(buf, Matcher.quoteReplacement("<!--" + htmlSpecialChars(match) + "-->"));
  222.         }
  223.         m.appendTail(buf);
  224.  
  225.         return buf.toString();
  226.     }
  227.  
  228.     private String balanceHTML(String s) {
  229.         if (alwaysMakeTags) {
  230.             //
  231.             // try and form html
  232.             //
  233.             s = regexReplace(P_END_ARROW, "", s);
  234.             s = regexReplace(P_BODY_TO_END, "<$1>", s);
  235.             s = regexReplace(P_XML_CONTENT, "$1<$2", s);
  236.  
  237.         } else {
  238.             //
  239.             // escape stray brackets
  240.             //
  241.             s = regexReplace(P_STRAY_LEFT_ARROW, "&lt;$1", s);
  242.             s = regexReplace(P_STRAY_RIGHT_ARROW, "$1$2&gt;<", s);
  243.  
  244.             //
  245.             // the last regexp causes '<>' entities to appear
  246.             // (we need to do a lookahead assertion so that the last bracket can
  247.             // be used in the next pass of the regexp)
  248.             //
  249.             s = regexReplace(P_BOTH_ARROWS, "", s);
  250.         }
  251.  
  252.         return s;
  253.     }
  254.  
  255.     private String checkTags(String s) {
  256.         Matcher m = P_TAGS.matcher(s);
  257.  
  258.         final StringBuffer buf = new StringBuffer();
  259.         while (m.find()) {
  260.             String replaceStr = m.group(1);
  261.             replaceStr = processTag(replaceStr);
  262.             m.appendReplacement(buf, Matcher.quoteReplacement(replaceStr));
  263.         }
  264.         m.appendTail(buf);
  265.  
  266.         s = buf.toString();
  267.  
  268.         // these get tallied in processTag
  269.         // (remember to reset before subsequent calls to filter method)
  270.         for (String key : vTagCounts.keySet()) {
  271.             for (int ii = 0; ii < vTagCounts.get(key); ii++) {
  272.                 s += "</" + key + ">";
  273.             }
  274.         }
  275.  
  276.         return s;
  277.     }
  278.  
  279.     private String processRemoveBlanks(final String s) {
  280.         String result = s;
  281.         for (String tag : vRemoveBlanks) {
  282.             if(!P_REMOVE_PAIR_BLANKS.containsKey(tag)){
  283.                 P_REMOVE_PAIR_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?></" + tag + ">"));
  284.             }
  285.             result = regexReplace(P_REMOVE_PAIR_BLANKS.get(tag), "", result);
  286.             if(!P_REMOVE_SELF_BLANKS.containsKey(tag)){
  287.                 P_REMOVE_SELF_BLANKS.putIfAbsent(tag, Pattern.compile("<" + tag + "(\\s[^>]*)?/>"));
  288.             }
  289.             result = regexReplace(P_REMOVE_SELF_BLANKS.get(tag), "", result);
  290.         }
  291.  
  292.         return result;
  293.     }
  294.  
  295.     private static String regexReplace(final Pattern regex_pattern, final String replacement, final String s) {
  296.         Matcher m = regex_pattern.matcher(s);
  297.         return m.replaceAll(replacement);
  298.     }
  299.  
  300.     private String processTag(final String s) {
  301.         // ending tags
  302.         Matcher m = P_END_TAG.matcher(s);
  303.         if (m.find()) {
  304.             final String name = m.group(1).toLowerCase();
  305.             if (allowed(name)) {
  306.                 if (!inArray(name, vSelfClosingTags)) {
  307.                     if (vTagCounts.containsKey(name)) {
  308.                         vTagCounts.put(name, vTagCounts.get(name) - 1);
  309.                         return "</" + name + ">";
  310.                     }
  311.                 }
  312.             }
  313.         }
  314.  
  315.         // starting tags
  316.         m = P_START_TAG.matcher(s);
  317.         if (m.find()) {
  318.             final String name = m.group(1).toLowerCase();
  319.             final String body = m.group(2);
  320.             String ending = m.group(3);
  321.  
  322.             //debug( "in a starting tag, name='" + name + "'; body='" + body + "'; ending='" + ending + "'" );
  323.             if (allowed(name)) {
  324.                 String params = "";
  325.  
  326.                 final Matcher m2 = P_QUOTED_ATTRIBUTES.matcher(body);
  327.                 final Matcher m3 = P_UNQUOTED_ATTRIBUTES.matcher(body);
  328.                 final List<String> paramNames = new ArrayList<String>();
  329.                 final List<String> paramValues = new ArrayList<String>();
  330.                 while (m2.find()) {
  331.                     paramNames.add(m2.group(1)); //([a-z0-9]+)
  332.                     paramValues.add(m2.group(3)); //(.*?)
  333.                 }
  334.                 while (m3.find()) {
  335.                     paramNames.add(m3.group(1)); //([a-z0-9]+)
  336.                     paramValues.add(m3.group(3)); //([^\"\\s']+)
  337.                 }
  338.  
  339.                 String paramName, paramValue;
  340.                 for (int ii = 0; ii < paramNames.size(); ii++) {
  341.                     paramName = paramNames.get(ii).toLowerCase();
  342.                     paramValue = paramValues.get(ii);
  343.  
  344. //          debug( "paramName='" + paramName + "'" );
  345. //          debug( "paramValue='" + paramValue + "'" );
  346. //          debug( "allowed? " + vAllowed.get( name ).contains( paramName ) );
  347.  
  348.                     if (allowedAttribute(name, paramName)) {
  349.                         if (inArray(paramName, vProtocolAtts)) {
  350.                             paramValue = processParamProtocol(paramValue);
  351.                         }
  352.                         params += " " + paramName + "=\"" + paramValue + "\"";
  353.                     }
  354.                 }
  355.  
  356.                 if (inArray(name, vSelfClosingTags)) {
  357.                     ending = " /";
  358.                 }
  359.  
  360.                 if (inArray(name, vNeedClosingTags)) {
  361.                     ending = "";
  362.                 }
  363.  
  364.                 if (ending == null || ending.length() < 1) {
  365.                     if (vTagCounts.containsKey(name)) {
  366.                         vTagCounts.put(name, vTagCounts.get(name) + 1);
  367.                     } else {
  368.                         vTagCounts.put(name, 1);
  369.                     }
  370.                 } else {
  371.                     ending = " /";
  372.                 }
  373.                 return "<" + name + params + ending + ">";
  374.             } else {
  375.                 return "";
  376.             }
  377.         }
  378.  
  379.         // comments
  380.         m = P_COMMENT.matcher(s);
  381.         if (!stripComment && m.find()) {
  382.             return  "<" + m.group() + ">";
  383.         }
  384.  
  385.         return "";
  386.     }
  387.  
  388.     private String processParamProtocol(String s) {
  389.         s = decodeEntities(s);
  390.         final Matcher m = P_PROTOCOL.matcher(s);
  391.         if (m.find()) {
  392.             final String protocol = m.group(1);
  393.             if (!inArray(protocol, vAllowedProtocols)) {
  394.                 // bad protocol, turn into local anchor link instead
  395.                 s = "#" + s.substring(protocol.length() + 1, s.length());
  396.                 if (s.startsWith("#//")) {
  397.                     s = "#" + s.substring(3, s.length());
  398.                 }
  399.             }
  400.         }
  401.  
  402.         return s;
  403.     }
  404.  
  405.     private String decodeEntities(String s) {
  406.         StringBuffer buf = new StringBuffer();
  407.  
  408.         Matcher m = P_ENTITY.matcher(s);
  409.         while (m.find()) {
  410.             final String match = m.group(1);
  411.             final int decimal = Integer.decode(match).intValue();
  412.             m.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal)));
  413.         }
  414.         m.appendTail(buf);
  415.         s = buf.toString();
  416.  
  417.         buf = new StringBuffer();
  418.         m = P_ENTITY_UNICODE.matcher(s);
  419.         while (m.find()) {
  420.             final String match = m.group(1);
  421.             final int decimal = Integer.valueOf(match, 16).intValue();
  422.             m.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal)));
  423.         }
  424.         m.appendTail(buf);
  425.         s = buf.toString();
  426.  
  427.         buf = new StringBuffer();
  428.         m = P_ENCODE.matcher(s);
  429.         while (m.find()) {
  430.             final String match = m.group(1);
  431.             final int decimal = Integer.valueOf(match, 16).intValue();
  432.             m.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal)));
  433.         }
  434.         m.appendTail(buf);
  435.         s = buf.toString();
  436.  
  437.         s = validateEntities(s);
  438.         return s;
  439.     }
  440.  
  441.     private String validateEntities(final String s) {
  442.         StringBuffer buf = new StringBuffer();
  443.  
  444.         // validate entities throughout the string
  445.         Matcher m = P_VALID_ENTITIES.matcher(s);
  446.         while (m.find()) {
  447.             final String one = m.group(1); //([^&;]*)
  448.             final String two = m.group(2); //(?=(;|&|$))
  449.             m.appendReplacement(buf, Matcher.quoteReplacement(checkEntity(one, two)));
  450.         }
  451.         m.appendTail(buf);
  452.  
  453.         return encodeQuotes(buf.toString());
  454.     }
  455.  
  456.     private String encodeQuotes(final String s){
  457.         if(encodeQuotes){
  458.             StringBuffer buf = new StringBuffer();
  459.             Matcher m = P_VALID_QUOTES.matcher(s);
  460.             while (m.find()) {
  461.                 final String one = m.group(1); //(>|^)
  462.                 final String two = m.group(2); //([^<]+?)
  463.                 final String three = m.group(3); //(<|$)
  464.                 m.appendReplacement(buf, Matcher.quoteReplacement(one + regexReplace(P_QUOTE, "&quot;", two) + three));
  465.             }
  466.             m.appendTail(buf);
  467.             return buf.toString();
  468.         }else{
  469.             return s;
  470.         }
  471.     }
  472.  
  473.     private String checkEntity(final String preamble, final String term) {
  474.  
  475.         return ";".equals(term) && isValidEntity(preamble)
  476.                 ? '&' + preamble
  477.                 : "&amp;" + preamble;
  478.     }
  479.  
  480.     private boolean isValidEntity(final String entity) {
  481.         return inArray(entity, vAllowedEntities);
  482.     }
  483.  
  484.     private static boolean inArray(final String s, final String[] array) {
  485.         for (String item : array) {
  486.             if (item != null && item.equals(s)) {
  487.                 return true;
  488.             }
  489.         }
  490.         return false;
  491.     }
  492.  
  493.     private boolean allowed(final String name) {
  494.         return (vAllowed.isEmpty() || vAllowed.containsKey(name)) && !inArray(name, vDisallowed);
  495.     }
  496.  
  497.     private boolean allowedAttribute(final String name, final String paramName) {
  498.         return allowed(name) && (vAllowed.isEmpty() || vAllowed.get(name).contains(paramName));
  499.     }
  500. }

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/繁依Fanyi0/article/detail/150427
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号