File name
Commit message
Commit date
File name
Commit message
Commit date
File name
Commit message
Commit date
File name
Commit message
Commit date
File name
Commit message
Commit date
File name
Commit message
Commit date
File name
Commit message
Commit date
File name
Commit message
Commit date
package itn.let.mjo.msgcampain.web;
import java.lang.reflect.Field;
public class MjonVOParamXssValues {
/**
* Build URI from VO and Host, Path
*
* @param paramObj VO
* @param host Host
* @param path Path
* @return URI
* @throws IllegalAccessException
* @throws IllegalArgumentException
*/
public int buildUri(Object paramObj) {
int XssCnt = buildParamMap(paramObj);
return XssCnt;
}
/**
* Build MultiValueMap - VO에 담긴 모든 변수의 값을 확인
*
* @param paramObj VO
* @return MultiValueMap
* @throws IllegalAccessException
* @throws IllegalArgumentException
*/
private int buildParamMap(Object paramObj) {
int XssCnt = 0;
for(Field field : paramObj.getClass().getDeclaredFields()) { // 각 변수를 하나씩 불러옴
field.setAccessible(true);
Object value;
try {
value = field.get(paramObj);
if(value != null) {
String paramValue = value.toString(); //변수 값을 받아옴
//String paramName = field.getName();
int cnt = cleanXSS(paramValue); //XSS 체크해보기
XssCnt = XssCnt + cnt;
}
} catch (IllegalArgumentException e) {
throw new IllegalArgumentException("IllegalArgumentException Error ::: " + e);
} catch (IllegalAccessException e) {
throw new IllegalArgumentException("IllegalArgumentException Error ::: " + e);
}
}
return XssCnt;
}
/**
* Get values from fields of VO *
* @param field
* @param clazz
* @param obj
* @return
*/
/* private Object getValueFromField(Field field, Class<?> clazz, Object obj) {
for(Method method : clazz.getMethods()) {
String methodName = method.getName();
if( (methodName.startsWith("get") && methodName.length() == field.getName().length() + 3)
|| (methodName.startsWith("is") && methodName.length() == field.getName().length() + 2) ) {
if(methodName.toLowerCase().endsWith(field.getName().toLowerCase())) {
try {
return method.invoke(obj);
} catch (Exception e) {
e.printStackTrace();
}
}
}
}
return null;
}*/
/**
* XSS 문자열이 있는지 체크
* @param field
* @param clazz
* @param obj
* @return
*/
private int cleanXSS(String test_str) {
String test_str_low= test_str.toLowerCase();
int cnt = 0;
if(test_str_low.contains("union")||
test_str_low.contains("select") ||
test_str_low.contains("insert") ||
test_str_low.contains("drop") ||
test_str_low.contains("update") ||
test_str_low.contains("delete") ||
test_str_low.contains("join") ||
test_str_low.contains("from") ||
test_str_low.contains("where") ||
test_str_low.contains("substr") ||
test_str_low.contains("user_tables")||
test_str_low.contains("script")||
test_str_low.contains("<")||
test_str_low.contains(">")||
test_str_low.contains("alert")||
test_str_low.contains("javascript")||
test_str_low.contains("=")||
test_str_low.contains("!")||
test_str_low.contains("or")||
test_str_low.contains("user_tables")||
test_str_low.contains("\\(")||
test_str_low.contains("\\)")||
test_str_low.contains("user_tables")||
test_str_low.contains("<") ||
test_str_low.contains("\"") ||
test_str_low.contains("%") ||
test_str_low.contains("()") ||
test_str_low.contains("+") ||
test_str_low.contains("%") ||
test_str_low.contains(">")
)
{
/*try {
context.getRequestDispatcher("/blank.do").forward(request, response);
} catch (ServletException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}*/
/*test_str = test_str_low;
test_str = test_str.replaceAll("union", "q-union");
test_str = test_str.replaceAll("select", "q-select");
test_str = test_str.replaceAll("insert", "q-insert");
test_str = test_str.replaceAll("drop", "q-drop");
test_str = test_str.replaceAll("update", "q-update");
test_str = test_str.replaceAll("delete", "q-delete");
test_str = test_str.replaceAll("and", "q-and");
test_str = test_str.replaceAll("or", "q-or");
test_str = test_str.replaceAll("join", "q-join");
test_str = test_str.replaceAll("substr", "q-substr");
test_str = test_str.replaceAll("from", "q-from");
test_str = test_str.replaceAll("where", "q-where");
test_str = test_str.replaceAll("declare", "q-declare");
test_str = test_str.replaceAll("openrowset", "q-openrowset");
test_str = test_str.replaceAll("user_tables","q-user_tables");
test_str = test_str.replaceAll("user_tab_columns","q-user_tab_columns");
test_str = test_str.replaceAll("table_name","q-table_name");
test_str = test_str.replaceAll("column_name","q-column_name");
test_str = test_str.replaceAll("row_num","q-row_num");*/
//xss 문자열이 포함되어 있으면 카운트 함
cnt++;
}
return cnt ;
}
}