Commit @14a693ed4ecfa5d940e518b81234d9276dbceebf

rosewiper 2023-10-20

카톡발송 > 알림톡 설정 하단 FAQ 내용에 태그 오류 개선

@14a693ed4ecfa5d940e518b81234d9276dbceebf

53747d5

14a693e

src/main/java/itn/let/kakao/user/stepInfo/web/KakaoStepInfoController.java

--- src/main/java/itn/let/kakao/user/stepInfo/web/KakaoStepInfoController.java

+++ src/main/java/itn/let/kakao/user/stepInfo/web/KakaoStepInfoController.java


 	@Resource(name = "EgovFileMngService")
 	private EgovFileMngService fileService;
 	
-	
+
 	/**
 	* @Method Name : selectKaKaoStepInfo
 	* @Project : mjon

 		searchVO.setBbsId(boardVO.getBbsId());
 		BoardMasterVO bbsMasterInfo = bbsAttrbService.selectBBSMasterInf(searchVO);
 		
+		/**
+		 * FAQ 타이틀 및 내용에 대한 XSS 변환 태그 원복
+		 * faqUnscript() 를 이용하여 디비에 변환 태그로 되어있는 코드를 다시 원복 시킴
+		 * ret.replaceAll("&lt;", "<").replaceAll("&gt;", ">");
+		 * 
+		 * */
+		for(int i=0; i<resultList.size(); i++) {
+			
+			String nttSj = resultList.get(i).getNttSj();
+			String nttCn = resultList.get(i).getNttCn();
+			
+			nttSj = faqUnscript(nttSj);
+			nttCn = faqUnscript(nttCn);
+			
+			resultList.get(i).setNttSj(nttSj);
+			resultList.get(i).setNttCn(nttCn);
+			
+		}
+		
 		model.addAttribute("bbsMasterInfo", bbsMasterInfo);
 		model.addAttribute("resultList", resultList);
 		model.addAttribute("resultCnt", map.get("resultCnt"));

 		
 		return "/web/kakao/intrd/KakaoAllimtalkIntro";
 	}
+	
+	
+	/**
+	 * XSS 방지 처리.
+	 *
+	 * @param data
+	 * @return
+	 */
+	protected String faqUnscript(String data) {
+		if (data == null || data.trim().equals("")) {
+			return "";
+		}
+
+		String ret = data;
+
+		ret = ret.replaceAll("<(S|s)(C|c)(R|r)(I|i)(P|p)(T|t)", "&lt;script");
+		ret = ret.replaceAll("</(S|s)(C|c)(R|r)(I|i)(P|p)(T|t)", "&lt;/script");
+
+		ret = ret.replaceAll("<(O|o)(B|b)(J|j)(E|e)(C|c)(T|t)", "&lt;object");
+		ret = ret.replaceAll("</(O|o)(B|b)(J|j)(E|e)(C|c)(T|t)", "&lt;/object");
+
+		ret = ret.replaceAll("<(A|a)(P|p)(P|p)(L|l)(E|e)(T|t)", "&lt;applet");
+		ret = ret.replaceAll("</(A|a)(P|p)(P|p)(L|l)(E|e)(T|t)", "&lt;/applet");
+
+		ret = ret.replaceAll("<(E|e)(M|m)(B|b)(E|e)(D|d)", "&lt;embed");
+		ret = ret.replaceAll("</(E|e)(M|m)(B|b)(E|e)(D|d)", "&lt;embed");
+
+		ret = ret.replaceAll("<(F|f)(O|o)(R|r)(M|m)", "&lt;form");
+		ret = ret.replaceAll("</(F|f)(O|o)(R|r)(M|m)", "&lt;form");
+
+		//ret = ret.replaceAll("<", "&lt;");
+		//ret = ret.replaceAll(">", "&gt;");
+		ret = ret.replaceAll("alert", "");
+		ret = ret.replaceAll("iframe", "");
+		
+		ret = ret.replaceAll("&lt;", "<").replaceAll("&gt;", ">");
+		ret = ret.replaceAll("&#40;", "\\(").replaceAll("&#41;", "\\)");
+		ret = ret.replaceAll("'", "&#39;");
+		ret = ret.replaceAll("eval\\((.*)\\)", "");
+		ret = ret.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
+		ret = ret.replaceAll("script", "");
+		
+		return ret;
+	}
+	
+	
+	
 }

Add a comment

Open 0
Closed 0

List

...	...	@@ -43,7 +43,7 @@
43	43	@Resource(name = "EgovFileMngService")
44	44	private EgovFileMngService fileService;
45	45
46		-
	46	+
47	47	/**
48	48	* @Method Name : selectKaKaoStepInfo
49	49	* @Project : mjon
...	...	@@ -122,6 +122,25 @@
122	122	searchVO.setBbsId(boardVO.getBbsId());
123	123	BoardMasterVO bbsMasterInfo = bbsAttrbService.selectBBSMasterInf(searchVO);
124	124
	125	+ /**
	126	+ * FAQ 타이틀 및 내용에 대한 XSS 변환 태그 원복
	127	+ * faqUnscript() 를 이용하여 디비에 변환 태그로 되어있는 코드를 다시 원복 시킴
	128	+ * ret.replaceAll("<", "<").replaceAll(">", ">");
	129	+ *
	130	+ * */
	131	+ for(int i=0; i<resultList.size(); i++) {
	132	+
	133	+ String nttSj = resultList.get(i).getNttSj();
	134	+ String nttCn = resultList.get(i).getNttCn();
	135	+
	136	+ nttSj = faqUnscript(nttSj);
	137	+ nttCn = faqUnscript(nttCn);
	138	+
	139	+ resultList.get(i).setNttSj(nttSj);
	140	+ resultList.get(i).setNttCn(nttCn);
	141	+
	142	+ }
	143	+
125	144	model.addAttribute("bbsMasterInfo", bbsMasterInfo);
126	145	model.addAttribute("resultList", resultList);
127	146	model.addAttribute("resultCnt", map.get("resultCnt"));
...	...	@@ -146,4 +165,51 @@
146	165
147	166	return "/web/kakao/intrd/KakaoAllimtalkIntro";
148	167	}
	168	+
	169	+
	170	+ /**
	171	+ * XSS 방지 처리.
	172	+ *
	173	+ * @param data
	174	+ * @return
	175	+ */
	176	+ protected String faqUnscript(String data) {
	177	+ if (data == null \|\| data.trim().equals("")) {
	178	+ return "";
	179	+ }
	180	+
	181	+ String ret = data;
	182	+
	183	+ ret = ret.replaceAll("<(S\|s)(C\|c)(R\|r)(I\|i)(P\|p)(T\|t)", "<script");
	184	+ ret = ret.replaceAll("</(S\|s)(C\|c)(R\|r)(I\|i)(P\|p)(T\|t)", "</script");
	185	+
	186	+ ret = ret.replaceAll("<(O\|o)(B\|b)(J\|j)(E\|e)(C\|c)(T\|t)", "<object");
	187	+ ret = ret.replaceAll("</(O\|o)(B\|b)(J\|j)(E\|e)(C\|c)(T\|t)", "</object");
	188	+
	189	+ ret = ret.replaceAll("<(A\|a)(P\|p)(P\|p)(L\|l)(E\|e)(T\|t)", "<applet");
	190	+ ret = ret.replaceAll("</(A\|a)(P\|p)(P\|p)(L\|l)(E\|e)(T\|t)", "</applet");
	191	+
	192	+ ret = ret.replaceAll("<(E\|e)(M\|m)(B\|b)(E\|e)(D\|d)", "<embed");
	193	+ ret = ret.replaceAll("</(E\|e)(M\|m)(B\|b)(E\|e)(D\|d)", "<embed");
	194	+
	195	+ ret = ret.replaceAll("<(F\|f)(O\|o)(R\|r)(M\|m)", "<form");
	196	+ ret = ret.replaceAll("</(F\|f)(O\|o)(R\|r)(M\|m)", "<form");
	197	+
	198	+ //ret = ret.replaceAll("<", "<");
	199	+ //ret = ret.replaceAll(">", ">");
	200	+ ret = ret.replaceAll("alert", "");
	201	+ ret = ret.replaceAll("iframe", "");
	202	+
	203	+ ret = ret.replaceAll("<", "<").replaceAll(">", ">");
	204	+ ret = ret.replaceAll("(", "\\(").replaceAll(")", "\\)");
	205	+ ret = ret.replaceAll("'", "'");
	206	+ ret = ret.replaceAll("eval\\((.*)\\)", "");
	207	+ ret = ret.replaceAll("[\\\"\\\'][\\s]javascript:(.)[\\\"\\\']", "\"\"");
	208	+ ret = ret.replaceAll("script", "");
	209	+
	210	+ return ret;
	211	+ }
	212	+
	213	+
	214	+
149	215	}

Delete comment