diff --git a/src/main/java/com/rymcu/forest/util/XssUtils.java b/src/main/java/com/rymcu/forest/util/XssUtils.java index 6760653..e102398 100644 --- a/src/main/java/com/rymcu/forest/util/XssUtils.java +++ b/src/main/java/com/rymcu/forest/util/XssUtils.java @@ -17,10 +17,11 @@ import java.util.regex.Pattern; * @packageName com.rymcu.forest.util */ public class XssUtils { - private static final String regex = "(
[\\s|\\S]+?
)|([\\s|\\S]+?)"; + private static final String REGEX_CODE = "(
[\\s|\\S]+?
)|([\\s|\\S]+?)"; /** * 滤除content中的危险 HTML 代码, 主要是脚本代码, 滚动字幕代码以及脚本事件处理代码 + * * @param content 需要滤除的字符串 * @return 过滤的结果 */ @@ -49,33 +50,54 @@ public class XssUtils { } public static String filterHtmlCode(String content) { - if(StringUtils.isBlank(content)) { - return content; + if (StringUtils.isBlank(content)) { + return content; } // 拿到匹配的pre标签List - List resultFindAll = ReUtil.findAll(regex, content, 0, new ArrayList<>()); + List resultFindAll = ReUtil.findAll(REGEX_CODE, content, 0, new ArrayList<>()); // size大于0,就做替换 if (resultFindAll.size() > 0) { - // 生成一个待替换唯一字符串 - String preTagReplace = UUID.randomUUID().toString() + System.currentTimeMillis(); - // 判断替换字符串是否唯一 - while (ReUtil.findAll(preTagReplace, content, 0, new ArrayList<>()).size() > 0) { - preTagReplace = UUID.randomUUID().toString() + System.currentTimeMillis(); - } - Pattern pattern = Pattern.compile(preTagReplace); + String uniqueUUID = searchUniqueUUID(content); + + // 替换所有$为uniqueUUID + content = ReUtil.replaceAll(content, "\\$", uniqueUUID); + + // pre标签替换字符串 + String replaceStr = uniqueUUID + uniqueUUID; + // 替换pre标签内容 - String preFilter = ReUtil.replaceAll(content, regex, preTagReplace); + String preFilter = ReUtil.replaceAll(content, REGEX_CODE, replaceStr); + // 拦截xss final String[] filterResult = {replaceHtmlCode(preFilter)}; // 依次将替换后的pre标签换回来 - resultFindAll.forEach(obj -> filterResult[0] = ReUtil.replaceFirst(pattern, filterResult[0], obj)); - return filterResult[0]; + Pattern pattern = Pattern.compile(replaceStr); + resultFindAll.forEach(obj -> { + obj = ReUtil.replaceAll(obj, "\\$", uniqueUUID); + filterResult[0] = ReUtil.replaceFirst(pattern, filterResult[0], obj); + }); + + // 将$换回来 + return ReUtil.replaceAll(filterResult[0], uniqueUUID, "$"); } else { return replaceHtmlCode(content); } } + /** + * @param content 待查找内容 + * @return + */ + public static String searchUniqueUUID(String content) { + // 生成一个待替换唯一字符串 + String uniqueUUID = UUID.randomUUID().toString(); + // 判断替换字符串是否唯一 + while (ReUtil.findAll(uniqueUUID, content, 0, new ArrayList<>()).size() > 0) { + uniqueUUID = UUID.randomUUID().toString(); + } + return uniqueUUID; + + } + } - - diff --git a/src/test/java/com/rymcu/forest/utils/TestFileMd5.java b/src/test/java/com/rymcu/forest/utils/TestFileMd5.java deleted file mode 100644 index 17fe9f0..0000000 --- a/src/test/java/com/rymcu/forest/utils/TestFileMd5.java +++ /dev/null @@ -1,30 +0,0 @@ -package com.rymcu.forest.utils; - -import org.junit.jupiter.api.Test; -import org.springframework.beans.factory.annotation.Value; -import org.springframework.boot.test.context.SpringBootTest; -import org.springframework.core.io.Resource; -import org.springframework.util.DigestUtils; - -import static org.junit.jupiter.api.Assertions.assertEquals; - -// 仅运行指定类 -@SpringBootTest(classes = TestFileMd5.class) -public class TestFileMd5 { - - - @Value("classpath:1.txt") - private Resource testFile; - - /** - * c6c26c7e8a5eb493b14e84bd91df60e3 - * d41d8cd98f00b204e9800998ecf8427e - * - * @throws Exception - */ - @Test - public void test() throws Exception { - String md5 = DigestUtils.md5DigestAsHex(testFile.getInputStream()); - assertEquals("202cb962ac59075b964b07152d234b70", md5); - } -}