diff --git a/ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssClean.java b/ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssClean.java new file mode 100644 index 0000000..4ada4a7 --- /dev/null +++ b/ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssClean.java @@ -0,0 +1,17 @@ +package com.volvo.ai.analytic.center.constant; + +import javax.validation.Constraint; +import javax.validation.Payload; +import java.lang.annotation.*; + +@Target({ElementType.FIELD, ElementType.PARAMETER, ElementType.TYPE}) +@Retention(RetentionPolicy.RUNTIME) +@Documented +@Constraint(validatedBy = XssValidator.class) +public @interface XssClean { + String message() default "当前字符串存在xss注入"; + + Class[] groups() default {}; + + Class[] payload() default {}; +} diff --git a/ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssValidator.java b/ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssValidator.java new file mode 100644 index 0000000..67b6330 --- /dev/null +++ b/ai-analytic-center-api/src/main/java/com/volvo/ai/analytic/center/constant/XssValidator.java @@ -0,0 +1,44 @@ +package com.volvo.ai.analytic.center.constant; + +import com.alibaba.cloud.commons.lang.StringUtils; +import lombok.extern.slf4j.Slf4j; + +import javax.validation.ConstraintValidator; +import javax.validation.ConstraintValidatorContext; +import java.util.regex.Pattern; + + +@Slf4j +public class XssValidator implements ConstraintValidator { + + private static final Pattern SCRIPT_PATTERN = Pattern.compile("", Pattern.CASE_INSENSITIVE); + private static final Pattern TAG_PATTERN = Pattern.compile("<[^>]*>", Pattern.CASE_INSENSITIVE); + private static final Pattern SRC_PATTERN = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + private static final Pattern SRC_CASE_PATTERN = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + private static final Pattern SCRIPT_END_PATTERN = Pattern.compile("", Pattern.CASE_INSENSITIVE); + private static final Pattern SCRIPT_START_PATTERN = Pattern.compile("", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + private static final Pattern EVAL_PATTERN = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + private static final Pattern EXPRESSION_PATTERN = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + private static final Pattern JAVA_SCRIPT_PATTERN = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE); + private static final Pattern VB_SCRIPT_PATTERN = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE); + private static final Pattern ONLOAD_PATTERN = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + private static final Pattern IMG_PATTERN = Pattern.compile("<(.*?)img(.*?)src=(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + @Override + public boolean isValid(String s, ConstraintValidatorContext constraintValidatorContext) { + if (StringUtils.isBlank(s)) { + return true; + } + return !containXss(s); + } + + + private static boolean containXss(String s) { + return SCRIPT_PATTERN.matcher(s).find() || SRC_PATTERN.matcher(s).find() || SRC_CASE_PATTERN.matcher(s).find() || + // Remove any lonesome tag Remove any lonesome