Commit @170507f071808f3c3c2d412fc29430e16c464b68

jiwoo 2023-07-18

이지우 - XSS 필터링 처리 : 기존 인터셉터 정규식 수정, 사용자 게시글 상세에 unscript 적용

인터셉터 정규식. '<' , '>'안에 한글만 입력하도록 처리. smstxt 등 몇몇 파라미터는 필터링 예외
게시글 상세 unscript 적용. 공지사항, 1:1문의, 이벤트 상세 이동시 파라미터의 '<', '>'와 같은 XSS 취약한
단어들은 replaceAll 처리

@170507f071808f3c3c2d412fc29430e16c464b68

105898c

170507f

src/main/java/itn/com/cmm/interceptor/InterceptorHandler.java

--- src/main/java/itn/com/cmm/interceptor/InterceptorHandler.java

+++ src/main/java/itn/com/cmm/interceptor/InterceptorHandler.java

...	...	@@ -49,12 +49,15 @@
49	49	&& !name.toLowerCase().contains("info2list")
50	50	&& !name.toLowerCase().contains("info3list")
51	51	&& !name.toLowerCase().contains("info4list")
	52	+ && !name.toLowerCase().contains("nttcn")
52	53	) {
53	54	//파라미터 중에 URL 주소를 넘겨주는 부분이 있어서 해당 부분에것 select~, update~, delete~ 로 시작하는 주소경로가 있어서 제외처리를 하였음
54	55	String[] values = request.getParameterValues(name);
55	56
56	57	//HTML 태그 관련 부분이 들어있으면 필터링 해주는 정규식 <> ~ </> 구문 찾아줌
57		- Pattern regex = Pattern.compile("<(/)?([a-zA-Z])(\\\\s[a-zA-Z]=[^>])?(\\\\s)(/)?>");
	58	+ //Pattern regex = Pattern.compile("<(/)?([a-zA-Z])(\\\\s[a-zA-Z]=[^>])?(\\\\s)(/)?>");
	59	+ //23.7.18 이지우 - XSS 필터링을 위한 정규식 수정
	60	+ Pattern regex = Pattern.compile("<[^ㄱ-ㅎㅏ-ㅣ가-힣<>]+>");
58	61	for (String value : values) {
59	62
60	63	//정규식과 동일한 패턴인지 비교해준다.

105898c

170507f

src/main/java/itn/let/cop/bbs/web/EgovBBSManageController.java

--- src/main/java/itn/let/cop/bbs/web/EgovBBSManageController.java

+++ src/main/java/itn/let/cop/bbs/web/EgovBBSManageController.java


 		ret = ret.replaceAll("<(F|f)(O|o)(R|r)(M|m)", "&lt;form");
 		ret = ret.replaceAll("</(F|f)(O|o)(R|r)(M|m)", "&lt;form");
 
-		//ret = ret.replaceAll("<", "&lt;");
+		ret = ret.replaceAll("<", "&lt;");
+		ret = ret.replaceAll(">", "&gt;");
 		ret = ret.replaceAll("alert", "");
 		//ret = ret.replaceAll("iframe", "");
 		

 			@RequestParam Map<String, Object> commandMap,
 			RedirectAttributes redirectAttributes) throws Exception {
 		
+		//XSS 태그 필터링 처리
+		boardVO.setBbsId(unscript(boardVO.getBbsId()));
+		boardVO.setSeCmmnCdId(unscript(boardVO.getSeCmmnCdId()));
+		boardVO.setFrstRegisterId(unscript(boardVO.getFrstRegisterId()));
+		boardVO.setSearchBgnDe(unscript(boardVO.getSearchBgnDe()));
+		boardVO.setSearchEndDe(unscript(boardVO.getSearchEndDe()));
+		boardVO.setSearchSortCnd(unscript(boardVO.getSearchSortCnd()));
+		boardVO.setSearchSortOrd(unscript(boardVO.getSearchSortOrd()));
+		boardVO.setSearchCnd(unscript(boardVO.getSearchCnd()));
+		boardVO.setSearchWrd(unscript(boardVO.getSearchWrd()));
+		
+		
 		BoardMasterVO bmVO = new BoardMasterVO();
 		if("".equals(boardVO.getBbsId())) { //검색에서 조회시 nttid로 마스터 조회
 			bmVO = bbsAttrbService.selectBbsIdByNttId(boardVO);

 			ModelMap model,
 			@RequestParam Map<String, Object> commandMap,
 			RedirectAttributes redirectAttributes) throws Exception {
+		
+		//XSS 태그 필터링 처리
+		boardVO.setBbsId(unscript(boardVO.getBbsId()));
+		boardVO.setSeCmmnCdId(unscript(boardVO.getSeCmmnCdId()));
+		boardVO.setFrstRegisterId(unscript(boardVO.getFrstRegisterId()));
+		boardVO.setSearchBgnDe(unscript(boardVO.getSearchBgnDe()));
+		boardVO.setSearchEndDe(unscript(boardVO.getSearchEndDe()));
+		boardVO.setSearchSortCnd(unscript(boardVO.getSearchSortCnd()));
+		boardVO.setSearchSortOrd(unscript(boardVO.getSearchSortOrd()));
+		boardVO.setSearchCnd(unscript(boardVO.getSearchCnd()));
+		boardVO.setSearchWrd(unscript(boardVO.getSearchWrd()));
 		
 		BoardMasterVO bmVO = new BoardMasterVO();
 		

 			RedirectAttributes redirectAttributes) throws Exception {
 		
 		
+		//XSS 태그 필터링 처리
+		boardVO.setBbsId(unscript(boardVO.getBbsId()));
+		boardVO.setSeCmmnCdId(unscript(boardVO.getSeCmmnCdId()));
+		boardVO.setFrstRegisterId(unscript(boardVO.getFrstRegisterId()));
+		boardVO.setSearchBgnDe(unscript(boardVO.getSearchBgnDe()));
+		boardVO.setSearchEndDe(unscript(boardVO.getSearchEndDe()));
+		boardVO.setSearchSortCnd(unscript(boardVO.getSearchSortCnd()));
+		boardVO.setSearchSortOrd(unscript(boardVO.getSearchSortOrd()));
+		boardVO.setSearchCnd(unscript(boardVO.getSearchCnd()));
+		boardVO.setSearchWrd(unscript(boardVO.getSearchWrd()));
+		
+		
 		BoardMasterVO bmVO = new BoardMasterVO();
 		if("".equals(boardVO.getBbsId())) { //검색에서 조회시 nttid로 마스터 조회
 			bmVO = bbsAttrbService.selectBbsIdByNttId(boardVO);

Add a comment

Open 0
Closed 0

List

...	...	@@ -233,7 +233,8 @@
233	233	ret = ret.replaceAll("<(F\|f)(O\|o)(R\|r)(M\|m)", "<form");
234	234	ret = ret.replaceAll("</(F\|f)(O\|o)(R\|r)(M\|m)", "<form");
235	235
236		- //ret = ret.replaceAll("<", "<");
	236	+ ret = ret.replaceAll("<", "<");
	237	+ ret = ret.replaceAll(">", ">");
237	238	ret = ret.replaceAll("alert", "");
238	239	//ret = ret.replaceAll("iframe", "");
239	240
...	...	@@ -1815,6 +1816,18 @@
1815	1816	@RequestParam Map<String, Object> commandMap,
1816	1817	RedirectAttributes redirectAttributes) throws Exception {
1817	1818
	1819	+ //XSS 태그 필터링 처리
	1820	+ boardVO.setBbsId(unscript(boardVO.getBbsId()));
	1821	+ boardVO.setSeCmmnCdId(unscript(boardVO.getSeCmmnCdId()));
	1822	+ boardVO.setFrstRegisterId(unscript(boardVO.getFrstRegisterId()));
	1823	+ boardVO.setSearchBgnDe(unscript(boardVO.getSearchBgnDe()));
	1824	+ boardVO.setSearchEndDe(unscript(boardVO.getSearchEndDe()));
	1825	+ boardVO.setSearchSortCnd(unscript(boardVO.getSearchSortCnd()));
	1826	+ boardVO.setSearchSortOrd(unscript(boardVO.getSearchSortOrd()));
	1827	+ boardVO.setSearchCnd(unscript(boardVO.getSearchCnd()));
	1828	+ boardVO.setSearchWrd(unscript(boardVO.getSearchWrd()));
	1829	+
	1830	+
1818	1831	BoardMasterVO bmVO = new BoardMasterVO();
1819	1832	if("".equals(boardVO.getBbsId())) { //검색에서 조회시 nttid로 마스터 조회
1820	1833	bmVO = bbsAttrbService.selectBbsIdByNttId(boardVO);
...	...	@@ -1958,6 +1971,17 @@
1958	1971	ModelMap model,
1959	1972	@RequestParam Map<String, Object> commandMap,
1960	1973	RedirectAttributes redirectAttributes) throws Exception {
	1974	+
	1975	+ //XSS 태그 필터링 처리
	1976	+ boardVO.setBbsId(unscript(boardVO.getBbsId()));
	1977	+ boardVO.setSeCmmnCdId(unscript(boardVO.getSeCmmnCdId()));
	1978	+ boardVO.setFrstRegisterId(unscript(boardVO.getFrstRegisterId()));
	1979	+ boardVO.setSearchBgnDe(unscript(boardVO.getSearchBgnDe()));
	1980	+ boardVO.setSearchEndDe(unscript(boardVO.getSearchEndDe()));
	1981	+ boardVO.setSearchSortCnd(unscript(boardVO.getSearchSortCnd()));
	1982	+ boardVO.setSearchSortOrd(unscript(boardVO.getSearchSortOrd()));
	1983	+ boardVO.setSearchCnd(unscript(boardVO.getSearchCnd()));
	1984	+ boardVO.setSearchWrd(unscript(boardVO.getSearchWrd()));
1961	1985
1962	1986	BoardMasterVO bmVO = new BoardMasterVO();
1963	1987
...	...	@@ -4432,6 +4456,18 @@
4432	4456	RedirectAttributes redirectAttributes) throws Exception {
4433	4457
4434	4458
	4459	+ //XSS 태그 필터링 처리
	4460	+ boardVO.setBbsId(unscript(boardVO.getBbsId()));
	4461	+ boardVO.setSeCmmnCdId(unscript(boardVO.getSeCmmnCdId()));
	4462	+ boardVO.setFrstRegisterId(unscript(boardVO.getFrstRegisterId()));
	4463	+ boardVO.setSearchBgnDe(unscript(boardVO.getSearchBgnDe()));
	4464	+ boardVO.setSearchEndDe(unscript(boardVO.getSearchEndDe()));
	4465	+ boardVO.setSearchSortCnd(unscript(boardVO.getSearchSortCnd()));
	4466	+ boardVO.setSearchSortOrd(unscript(boardVO.getSearchSortOrd()));
	4467	+ boardVO.setSearchCnd(unscript(boardVO.getSearchCnd()));
	4468	+ boardVO.setSearchWrd(unscript(boardVO.getSearchWrd()));
	4469	+
	4470	+
4435	4471	BoardMasterVO bmVO = new BoardMasterVO();
4436	4472	if("".equals(boardVO.getBbsId())) { //검색에서 조회시 nttid로 마스터 조회
4437	4473	bmVO = bbsAttrbService.selectBbsIdByNttId(boardVO);

Delete comment