ak
/
msopen
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!232 添加XSS过滤器 

Merge pull request !232 from 灰色DT/5.0.1
This commit is contained in:
铭飞 2020-05-13 18:09:39 +08:00 committed by Gitee
parent 8c1c762d51 279f96ffa4
commit 0abf45c4f6
3 changed files with 19 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/main/java/net/mingsoft/cms/action/web/MCmsAction.java
View File

@ -295,9 +295,7 @@ public class MCmsAction extends net.mingsoft.cms.action.BaseAction {
Map<String, Object> map = new HashMap<>();
// 读取请求字段
Map<String, String[]> field = request.getParameterMap();
// 文章字段集合
Map<String, Object> articleFieldName = new HashMap<String, Object>();
Map<String, Object> field = BasicUtil.assemblyRequestMap();
// 自定义字段集合
Map<String, String> diyFieldName = new HashMap<String, String>();
CategoryEntity column = null; // 当前栏目
@ -330,9 +328,9 @@ public class MCmsAction extends net.mingsoft.cms.action.BaseAction {
// 遍历取字段集合
if (field != null) {
for (Map.Entry<String, String[]> entry : field.entrySet()) {
for (Map.Entry<String, Object> entry : field.entrySet()) {
if (entry != null) {
String value = entry.getValue()[0]; // 处理由get方法请求中文乱码问题
String value = entry.getValue().toString(); // 处理由get方法请求中文乱码问题
if (ObjectUtil.isNull(value)) {
continue;
}
@ -380,7 +378,7 @@ public class MCmsAction extends net.mingsoft.cms.action.BaseAction {
} catch (IOException e1) {
e1.printStackTrace();
}
Map<String, Object> searchMap = BasicUtil.assemblyRequestMap();
Map<String, Object> searchMap = field;
searchMap.forEach((k,v)->{
//sql注入过滤
if(sqlFilter(v.toString())){

23
src/main/java/net/mingsoft/config/WebConfig.java
View File

@ -89,18 +89,17 @@ public class WebConfig implements WebMvcConfigurer {
beanTypeAutoProxyCreator.setInterceptorNames("druidStatInterceptor");
return beanTypeAutoProxyCreator;
}
// XSS过滤器
// @Bean
// public FilterRegistrationBean xssFilterRegistration() {
// XSSEscapeFilter xssFilter = new XSSEscapeFilter();
// FilterRegistrationBean registration = new FilterRegistrationBean(xssFilter);
// xssFilter.excludes.add(".*file/upload.do");
// xssFilter.excludes.add(".*/jsp/editor.do");
// xssFilter.excludes.add(".*/?(jpg|js|css|gif|png|ico)$");
// xssFilter.excludes.add("/");
// registration.addUrlPatterns("/*");
// return registration;
// }
//XSS过滤器
@Bean
public FilterRegistrationBean xssFilterRegistration() {
XSSEscapeFilter xssFilter = new XSSEscapeFilter();
FilterRegistrationBean registration = new FilterRegistrationBean(xssFilter);
xssFilter.includes.add(".*/search.do");
registration.setName("XSSFilter");
registration.addUrlPatterns("/*");
registration.setOrder(Ordered.HIGHEST_PRECEDENCE);
return registration;
}
/**
* RequestContextListener注册

8
src/main/webapp/templets/1/default/search.htm
View File

@ -12,7 +12,7 @@
<div class="ms-content-main-list" id="ms-content-search">
<div class="ms-content-main-div">
<div class="ms-content-main-div-prompt">您搜索的关键字
<span>{ms:search.basic_title/}</span>
<span>{ms:search.content_title/}</span>
<!-- 共7个结果 -->
</div>
<ul class="ms-content-main-ul">
@ -55,12 +55,12 @@ new Vue({
pageNo = pageNo -1==0 ? 1 : pageNo-1;//上一页
}
window.location.href="{ms:global.host/}/cms/1/search.do?basic_title={ms:search.basic_title/}&pageNo="+pageNo;
window.event.returnValue=false;
window.event.returnValue=false;
},
//首页和尾页
indexAndLast:function(pageNo){
window.location.href="{ms:global.host/}/cms/1/search.do?basic_title={ms:search.basic_title/}&pageNo="+pageNo;
window.event.returnValue=false;
window.event.returnValue=false;
},
},
})
@ -68,4 +68,4 @@ new Vue({
$('.ms-content-main-page').remove();
$('.ms-content-main-ul').before("<div class='ms-content-main-div-nothing'>没找到相关记录</div>")
}
</script>
</script>