From 11b8e77034a19891397430d002a57eff99fda236 Mon Sep 17 00:00:00 2001
From: KNKIM <knkim@digitalship.co.kr>
Date: Tue, 21 Dec 2021 15:41:16 +0900
Subject: [PATCH] =?UTF-8?q?HTML=20Sanitizer=20=EA=B8=B0=EB=8A=A5=20?=
 =?UTF-8?q?=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pom.xml                                 |  7 ++++++
 src/main/java/nlib/util/StringUtil.java | 29 +++++++++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/pom.xml b/pom.xml
index 0d45b2f8..62dfa4e5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -385,6 +385,13 @@
 		    <artifactId>commons-lang3</artifactId>
 		    <version>3.3.2</version>
 		</dependency>
+		
+		<!-- OWASP HTML Sanitizer -->
+        <dependency>
+            <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
+            <artifactId>owasp-java-html-sanitizer</artifactId>
+            <version>20211018.2</version>
+        </dependency>
         
     </dependencies>
 
diff --git a/src/main/java/nlib/util/StringUtil.java b/src/main/java/nlib/util/StringUtil.java
index bc84b24d..24959c4d 100644
--- a/src/main/java/nlib/util/StringUtil.java
+++ b/src/main/java/nlib/util/StringUtil.java
@@ -13,6 +13,8 @@ import java.util.Base64.Encoder;
 import java.util.Locale;
 
 import org.apache.commons.lang3.StringUtils;
+import org.owasp.html.HtmlPolicyBuilder;
+import org.owasp.html.PolicyFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -383,6 +385,33 @@ public class StringUtil extends StringUtils {
 		return value;
 	}
 	
+	/**
+	 * XSS 등의 공격으로 부터 보안성 유지를 위해서 HTML 허용된 태그와 속성만으로 HTML을 재구성하여 리턴한다.
+	 * 
+	 * @param html
+	 * @return
+	 */
+	private static String sanitizeHtml(String html) {
+
+    	PolicyFactory policy = new HtmlPolicyBuilder()
+    			  .allowAttributes("src", "align", "title").onElements("img")
+      			  .allowAttributes("href", "title").onElements("a")
+      			  .allowAttributes("class", "height", "width", "style").globally()
+      			  .allowUrlProtocols("http","https","mailto","tel")
+      			  .allowElements(
+      			    "a", "label", 
+      			    "h1", "h2", "h3", "h4", "h5", "h6",
+      			    "p", "i", "b", "u", "strong", "em", "small", "big", "pre", "code",
+      			    "cite", "samp", "sub", "sup", "strike", "center", "blockquote",
+      			    "hr", "br", "col", "font", "span", "div", "img",
+      			    "ul", "ol", "li", "dd", "dt", "dl", "tbody", "thead", "tfoot",
+      			    "table", "td", "th", "tr", "colgroup", "fieldset", "legend"
+      			  )
+      			  .toFactory();
+    	
+    	return policy.sanitize(html);
+	}
+	
 	// Tag 화이트 리스트 ( 허용할 태그 등록 )
 	static String[] whiteListTag = { "<p>","</p>","<br />" };