bonus
/
smart_archives_service
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

非法值校验

This commit is contained in:
cwchen 2025-09-30 09:32:26 +08:00
parent 677d735889
commit 9629141734
3 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bonus-common/src/main/java/com/bonus/common/utils/SafeUtil.java
View File

@ -22,7 +22,7 @@ public class SafeUtil {
// 危险字符和编码 // 危险字符和编码
public final static String DANGEROUS_CHARS = public final static String DANGEROUS_CHARS =
"(<.*>|\\[.*\\]|\\(.*\\)|\".*\"|'.*'|@|!|\\$|;|\\||/)" + "(<.*>|\\[.*\\]|\\(.*\\)|\".*\"|'.*'|@|%|!|\\$|;|\\||/)" +
"|(%3[cdef]|%2[bf2789]|%5[bd]|%3b|%28|%29)" + "|(%3[cdef]|%2[bf2789]|%5[bd]|%3b|%28|%29)" +
"|(\\\\x3[cdef]|\\\\x2[bf27])" + "|(\\\\x3[cdef]|\\\\x2[bf27])" +
"|(data:text/html|base64|document\\.|window\\.|location\\.|cookie)"; "|(data:text/html|base64|document\\.|window\\.|location\\.|cookie)";

1
bonus-framework/src/main/java/com/bonus/framework/interceptor/XssCheck.java
View File

@ -72,6 +72,7 @@ public class XssCheck {
// 其他特殊字符 // 其他特殊字符
XSS_PATTERNS.add(Pattern.compile("@.*", Pattern.CASE_INSENSITIVE)); // @符号 XSS_PATTERNS.add(Pattern.compile("@.*", Pattern.CASE_INSENSITIVE)); // @符号
XSS_PATTERNS.add(Pattern.compile("!.*", Pattern.CASE_INSENSITIVE)); // 感叹号 XSS_PATTERNS.add(Pattern.compile("!.*", Pattern.CASE_INSENSITIVE)); // 感叹号
XSS_PATTERNS.add(Pattern.compile("%", Pattern.CASE_INSENSITIVE)); // %
// 十六进制编码 // 十六进制编码
XSS_PATTERNS.add(Pattern.compile("\\\\x3c", Pattern.CASE_INSENSITIVE)); // < 的十六进制 XSS_PATTERNS.add(Pattern.compile("\\\\x3c", Pattern.CASE_INSENSITIVE)); // < 的十六进制

1
bonus-framework/src/main/java/com/bonus/framework/interceptor/XssRequestWrapper.java
View File

@ -76,6 +76,7 @@ public class XssRequestWrapper extends HttpServletRequestWrapper {
// 其他特殊字符 // 其他特殊字符
XSS_PATTERNS.add(Pattern.compile("@.*", Pattern.CASE_INSENSITIVE)); // @符号 XSS_PATTERNS.add(Pattern.compile("@.*", Pattern.CASE_INSENSITIVE)); // @符号
XSS_PATTERNS.add(Pattern.compile("!.*", Pattern.CASE_INSENSITIVE)); // 感叹号 XSS_PATTERNS.add(Pattern.compile("!.*", Pattern.CASE_INSENSITIVE)); // 感叹号
XSS_PATTERNS.add(Pattern.compile("%", Pattern.CASE_INSENSITIVE)); // %
// 十六进制编码 // 十六进制编码
XSS_PATTERNS.add(Pattern.compile("\\\\x3c", Pattern.CASE_INSENSITIVE)); // < 的十六进制 XSS_PATTERNS.add(Pattern.compile("\\\\x3c", Pattern.CASE_INSENSITIVE)); // < 的十六进制