添加XSS过滤
This commit is contained in:
parent
ba7860c2d4
commit
279f96ffa4
|
@ -295,9 +295,7 @@ public class MCmsAction extends net.mingsoft.cms.action.BaseAction {
|
|||
|
||||
Map<String, Object> map = new HashMap<>();
|
||||
// 读取请求字段
|
||||
Map<String, String[]> field = request.getParameterMap();
|
||||
// 文章字段集合
|
||||
Map<String, Object> articleFieldName = new HashMap<String, Object>();
|
||||
Map<String, Object> field = BasicUtil.assemblyRequestMap();
|
||||
// 自定义字段集合
|
||||
Map<String, String> diyFieldName = new HashMap<String, String>();
|
||||
CategoryEntity column = null; // 当前栏目
|
||||
|
@ -330,9 +328,9 @@ public class MCmsAction extends net.mingsoft.cms.action.BaseAction {
|
|||
|
||||
// 遍历取字段集合
|
||||
if (field != null) {
|
||||
for (Map.Entry<String, String[]> entry : field.entrySet()) {
|
||||
for (Map.Entry<String, Object> entry : field.entrySet()) {
|
||||
if (entry != null) {
|
||||
String value = entry.getValue()[0]; // 处理由get方法请求中文乱码问题
|
||||
String value = entry.getValue().toString(); // 处理由get方法请求中文乱码问题
|
||||
if (ObjectUtil.isNull(value)) {
|
||||
continue;
|
||||
}
|
||||
|
@ -380,7 +378,7 @@ public class MCmsAction extends net.mingsoft.cms.action.BaseAction {
|
|||
} catch (IOException e1) {
|
||||
e1.printStackTrace();
|
||||
}
|
||||
Map<String, Object> searchMap = BasicUtil.assemblyRequestMap();
|
||||
Map<String, Object> searchMap = field;
|
||||
searchMap.forEach((k,v)->{
|
||||
//sql注入过滤
|
||||
if(sqlFilter(v.toString())){
|
||||
|
|
|
@ -90,17 +90,16 @@ public class WebConfig implements WebMvcConfigurer {
|
|||
return beanTypeAutoProxyCreator;
|
||||
}
|
||||
//XSS过滤器
|
||||
// @Bean
|
||||
// public FilterRegistrationBean xssFilterRegistration() {
|
||||
// XSSEscapeFilter xssFilter = new XSSEscapeFilter();
|
||||
// FilterRegistrationBean registration = new FilterRegistrationBean(xssFilter);
|
||||
// xssFilter.excludes.add(".*file/upload.do");
|
||||
// xssFilter.excludes.add(".*/jsp/editor.do");
|
||||
// xssFilter.excludes.add(".*/?(jpg|js|css|gif|png|ico)$");
|
||||
// xssFilter.excludes.add("/");
|
||||
// registration.addUrlPatterns("/*");
|
||||
// return registration;
|
||||
// }
|
||||
@Bean
|
||||
public FilterRegistrationBean xssFilterRegistration() {
|
||||
XSSEscapeFilter xssFilter = new XSSEscapeFilter();
|
||||
FilterRegistrationBean registration = new FilterRegistrationBean(xssFilter);
|
||||
xssFilter.includes.add(".*/search.do");
|
||||
registration.setName("XSSFilter");
|
||||
registration.addUrlPatterns("/*");
|
||||
registration.setOrder(Ordered.HIGHEST_PRECEDENCE);
|
||||
return registration;
|
||||
}
|
||||
|
||||
/**
|
||||
* RequestContextListener注册
|
||||
|
|
|
@ -12,7 +12,7 @@
|
|||
<div class="ms-content-main-list" id="ms-content-search">
|
||||
<div class="ms-content-main-div">
|
||||
<div class="ms-content-main-div-prompt">您搜索的关键字
|
||||
<span>{ms:search.basic_title/}</span>
|
||||
<span>{ms:search.content_title/}</span>
|
||||
<!-- 共7个结果 -->
|
||||
</div>
|
||||
<ul class="ms-content-main-ul">
|
||||
|
|
Loading…
Reference in New Issue