java清除xss漏洞关键字

拼命小孩

于 2023-09-13 19:30:00 发布

阅读量363

点赞数

文章标签： tomcat java 开发语言

本文链接：https://blog.csdn.net/wpf416533938/article/details/132854964

版权

private static String cleanXSS(String value) {
    if (StringUtils.isNotBlank(value)) {
        value = value.replaceAll("<", "＜");
        value = value.replaceAll(">", "＞");
        value = value.replaceAll("'", "＇");
        value = value.replaceAll("script", "");
        value = value.replaceAll("alert", "");
        value = value.replaceAll("javascript", "");
        value = value.replaceAll("javasc", "");
        value = value.replaceAll(";", "﹔");
        value = value.replaceAll("&", "＆");
        value = value.replaceAll("#", "＃");
        value = value.replaceAll("html", "");
        value = value.replaceAll("\\[", "");
        value = value.replaceAll("wget", "wg?t");// "c"→"?"
        value = value.replaceAll(".ini", "");// "c"→"?"
        value = value.replaceAll("powershell", "pow?rsh?ll");// "c"→"?"
        value = value.replaceAll("select", "sele?t");// "c"→"?"
        value = value.replaceAll("truncate", "trun?ate");// "c"→"?"
        value = value.replaceAll("exec", "exe?");// "c"→"?"
        value = value.replaceAll("join", "j?in");// "o"→"?"
        value = value.replaceAll("union", "uni?n");// "o"→"?"
        value = value.replaceAll("drop", "dr?p");// "o"→"?"
        value = value.replaceAll("count", "c?unt");// "o"→"?"
        value = value.replaceAll("insert", "ins?rt");// "e"→"?"
        value = value.replaceAll("update", "updat?");// "e"→"?"
        value = value.replaceAll("delete", "d?l?t?");// "e"→"?"
        value = value.replaceAll("script", "s?ript");// "c"→"?"
        value = value.replaceAll("cookie", "c??kie");// "o"→"?"
        value = value.replaceAll("iframe", "ifram?");// "e"→"?"
        value = value.replaceAll("onmouseover", "?nmous?ov?r");// "e"→"?"
        value = value.replaceAll("onmousemove", "?nmous?mov?");// "e"→"?"*/
        value = value.replaceAll("onclick", "");
        value = value.replaceAll("prompt", "");
        value = value.replaceAll("onmouseenter", "");
        value = value.replaceAll("confirm", "");
        value = value.replaceAll("eval", "");
        value = value.replaceAll("onerror", "");// "e"→"?"*/
    }
    return value;
}