xss漏洞修复思路

最新推荐文章于 2024-09-20 20:59:18 发布

你可拉倒吧

最新推荐文章于 2024-09-20 20:59:18 发布

阅读量2.6k

点赞数

文章标签： xss

本文链接：https://blog.csdn.net/qq_35794278/article/details/88239936

版权

java高级专栏收录该内容

4 篇文章 0 订阅

订阅专栏

public static String htmlSecurityEscape(String str) {
        if (str == null) {
            return null;
        } else {
            StringBuilder sb = null;
            int len = str.length();

            try {
                for(int i = 0; i < len; ++i) {
                    char ch = str.charAt(i);
                    switch(ch) {
                    case '"':
                        if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }

                        sb.append("&quot;");
                        break;
                    case '&':
                        int in = str.indexOf(59, i + 1);
                        if (in != -1 && in - i < 9 && str.substring(i + 1, in).indexOf(38) == -1) {
                            if (sb != null) {
                                sb.append(ch);
                            }
                            break;
                        }

                        if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }

                        sb.append("&amp;");
                        break;
                    case '\'':
                        if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }

                        sb.append("&#39;");
                        break;
                    case '*':
                        if (i + 1 < str.length() && str.charAt(i + 1) == '/') {
                            if (sb == null) {
                                sb = new StringBuilder(str.length() << 1);
                                sb.append(str, 0, i);
                            }

                            sb.append("&#42;&#47;");
                            ++i;
                        } else if (sb != null) {
                            sb.append(ch);
                        }
                        break;
                    case '/':
                        if (i + 1 < str.length() && str.charAt(i + 1) == '*') {
                            if (sb == null) {
                                sb = new StringBuilder(str.length() << 1);
                                sb.append(str, 0, i);
                            }

                            sb.append("&#47;&#42;");
                            ++i;
                        } else if (sb != null) {
                            sb.append(ch);
                        }
                        break;
                    case '<':
                        if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }

                        sb.append("&lt;");
                        break;
                    case '>':
                        if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }

                        sb.append("&gt;");
                        break;
                    case '\\':
                        if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }

                        sb.append("\\&shy;");
                        break;
                    default:
                        if (Character.getDirectionality(ch) != 2 && Character.getDirectionality(ch) != 16 && Character.getDirectionality(ch) != 17) {
                            if (sb != null) {
                                sb.append(ch);
                            }
                        } else if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }
                    }
                }
            } catch (Exception var6) {
                var6.printStackTrace();
                System.err.println(str);
            }

            return null != sb ? sb.toString() : str;
        }
    }