xyz.erupt.core.util.SecurityUtil Maven / Gradle / Ivy
package xyz.erupt.core.util;
import org.apache.commons.lang3.StringUtils;
import xyz.erupt.core.exception.EruptWebApiRuntimeException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
import java.nio.charset.StandardCharsets;
import java.util.regex.Pattern;
/**
* @author YuePeng
* date 2019-10-30.
*/
public class SecurityUtil {
// xss跨站脚本检测
public static boolean xssInspect(String value) {
if (StringUtils.isNotBlank(value)) {
// 避免script 标签
Pattern scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);
if (scriptPattern.matcher(value).matches()) {
return true;
}
// 避免src形式的表达式
scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\'(.*?)\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
if (scriptPattern.matcher(value).matches()) {
return true;
}
if (scriptPattern.matcher(value).matches()) {
return true;
}
scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
if (scriptPattern.matcher(value).matches()) {
return true;
}
// 删除单个的 标签
scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);
if (scriptPattern.matcher(value).matches()) {
return true;
}
// 删除单个的