ak
/
msopen
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!232 添加XSS过滤器 

Merge pull request !232 from 灰色DT/5.0.1
This commit is contained in:
铭飞 2020-05-13 18:09:39 +08:00 committed by Gitee
parent 8c1c762d51 279f96ffa4
commit 0abf45c4f6
3 changed files with 19 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/main/java/net/mingsoft/cms/action/web/MCmsAction.java
View File

@ -295,9 +295,7 @@ public class MCmsAction extends net.mingsoft.cms.action.BaseAction {
Map<String, Object> map = new HashMap<>(); Map<String, Object> map = new HashMap<>();
// 读取请求字段 // 读取请求字段
Map<String, String[]> field = request.getParameterMap(); Map<String, Object> field = BasicUtil.assemblyRequestMap();
// 文章字段集合
Map<String, Object> articleFieldName = new HashMap<String, Object>();
// 自定义字段集合 // 自定义字段集合
Map<String, String> diyFieldName = new HashMap<String, String>(); Map<String, String> diyFieldName = new HashMap<String, String>();
CategoryEntity column = null; // 当前栏目 CategoryEntity column = null; // 当前栏目
@ -330,9 +328,9 @@ public class MCmsAction extends net.mingsoft.cms.action.BaseAction {
// 遍历取字段集合 // 遍历取字段集合
if (field != null) { if (field != null) {
for (Map.Entry<String, String[]> entry : field.entrySet()) { for (Map.Entry<String, Object> entry : field.entrySet()) {
if (entry != null) { if (entry != null) {
String value = entry.getValue()[0]; // 处理由get方法请求中文乱码问题 String value = entry.getValue().toString(); // 处理由get方法请求中文乱码问题
if (ObjectUtil.isNull(value)) { if (ObjectUtil.isNull(value)) {
continue; continue;
} }
@ -380,7 +378,7 @@ public class MCmsAction extends net.mingsoft.cms.action.BaseAction {
} catch (IOException e1) { } catch (IOException e1) {
e1.printStackTrace(); e1.printStackTrace();
} }
Map<String, Object> searchMap = BasicUtil.assemblyRequestMap(); Map<String, Object> searchMap = field;
searchMap.forEach((k,v)->{ searchMap.forEach((k,v)->{
//sql注入过滤 //sql注入过滤
if(sqlFilter(v.toString())){ if(sqlFilter(v.toString())){

23
src/main/java/net/mingsoft/config/WebConfig.java
View File

@ -89,18 +89,17 @@ public class WebConfig implements WebMvcConfigurer {
beanTypeAutoProxyCreator.setInterceptorNames("druidStatInterceptor"); beanTypeAutoProxyCreator.setInterceptorNames("druidStatInterceptor");
return beanTypeAutoProxyCreator; return beanTypeAutoProxyCreator;
} }
// XSS过滤器 //XSS过滤器
// @Bean @Bean
// public FilterRegistrationBean xssFilterRegistration() { public FilterRegistrationBean xssFilterRegistration() {
// XSSEscapeFilter xssFilter = new XSSEscapeFilter(); XSSEscapeFilter xssFilter = new XSSEscapeFilter();
// FilterRegistrationBean registration = new FilterRegistrationBean(xssFilter); FilterRegistrationBean registration = new FilterRegistrationBean(xssFilter);
// xssFilter.excludes.add(".*file/upload.do"); xssFilter.includes.add(".*/search.do");
// xssFilter.excludes.add(".*/jsp/editor.do"); registration.setName("XSSFilter");
// xssFilter.excludes.add(".*/?(jpg|js|css|gif|png|ico)$"); registration.addUrlPatterns("/*");
// xssFilter.excludes.add("/"); registration.setOrder(Ordered.HIGHEST_PRECEDENCE);
// registration.addUrlPatterns("/*"); return registration;
// return registration; }
// }
/** /**
* RequestContextListener注册 * RequestContextListener注册

2
src/main/webapp/templets/1/default/search.htm
View File

@ -12,7 +12,7 @@
<div class="ms-content-main-list" id="ms-content-search"> <div class="ms-content-main-list" id="ms-content-search">
<div class="ms-content-main-div"> <div class="ms-content-main-div">
<div class="ms-content-main-div-prompt">您搜索的关键字 <div class="ms-content-main-div-prompt">您搜索的关键字
<span>{ms:search.basic_title/}</span> <span>{ms:search.content_title/}</span>
<!-- 共7个结果 --> <!-- 共7个结果 -->
</div> </div>
<ul class="ms-content-main-ul"> <ul class="ms-content-main-ul">