|
@@ -35,10 +35,10 @@ import jakarta.servlet.http.HttpServletRequest;
|
|
|
|
|
|
public class WebXssRequestFilter extends GenericFilterBean {
|
|
|
|
|
|
- final static Logger _logger = LoggerFactory.getLogger(GenericFilterBean.class);
|
|
|
+ static final Logger _logger = LoggerFactory.getLogger(WebXssRequestFilter.class);
|
|
|
|
|
|
- final static ConcurrentHashMap <String,String> skipUrlMap = new ConcurrentHashMap <String,String>();
|
|
|
- final static ConcurrentHashMap <String,String> skipParameterName = new ConcurrentHashMap <String,String>();
|
|
|
+ static final ConcurrentHashMap <String,String> skipUrlMap = new ConcurrentHashMap <>();
|
|
|
+ static final ConcurrentHashMap <String,String> skipParameterName = new ConcurrentHashMap <>();
|
|
|
|
|
|
static {
|
|
|
//add or update
|
|
@@ -74,24 +74,24 @@ public class WebXssRequestFilter extends GenericFilterBean {
|
|
|
boolean isWebXss = false;
|
|
|
HttpServletRequest request= ((HttpServletRequest)servletRequest);
|
|
|
if(_logger.isTraceEnabled()) {WebContext.printRequest(request);}
|
|
|
- if(skipUrlMap.containsKey(request.getRequestURI().substring(request.getContextPath().length()))) {
|
|
|
- isWebXss = false;
|
|
|
+ String requestURL =request.getRequestURI().substring(request.getContextPath().length());
|
|
|
+ if(skipUrlMap.containsKey(requestURL)) {
|
|
|
+ _logger.trace("skip URL {}",requestURL);
|
|
|
}else {
|
|
|
Enumeration<String> parameterNames = request.getParameterNames();
|
|
|
while (parameterNames.hasMoreElements()) {
|
|
|
- String key = (String) parameterNames.nextElement();
|
|
|
- if(skipParameterName.containsKey(key)) {continue;}
|
|
|
-
|
|
|
- String value = request.getParameter(key);
|
|
|
- _logger.trace("parameter name "+key +" , value " + value);
|
|
|
- String tempValue = value;
|
|
|
- if(!StringEscapeUtils.escapeHtml4(tempValue).equals(value)
|
|
|
- ||tempValue.toLowerCase().indexOf("script")>-1
|
|
|
- ||tempValue.toLowerCase().replace(" ", "").indexOf("eval(")>-1) {
|
|
|
- isWebXss = true;
|
|
|
- _logger.error("parameter name "+key +" , value " + value
|
|
|
- + ", contains dangerous content ! ");
|
|
|
- break;
|
|
|
+ String key = parameterNames.nextElement();
|
|
|
+ if(!skipParameterName.containsKey(key)) {
|
|
|
+ String value = request.getParameter(key);
|
|
|
+ _logger.trace("parameter name {} , value {}" , key, value);
|
|
|
+ String tempValue = value;
|
|
|
+ if(!StringEscapeUtils.escapeHtml4(tempValue).equals(value)
|
|
|
+ ||tempValue.toLowerCase().indexOf("script")>-1
|
|
|
+ ||tempValue.toLowerCase().replace(" ", "").indexOf("eval(")>-1) {
|
|
|
+ isWebXss = true;
|
|
|
+ _logger.error("parameter name {} , value {}, contains dangerous content ! ",key,value);
|
|
|
+ break;
|
|
|
+ }
|
|
|
}
|
|
|
}
|
|
|
}
|