diff --git a/src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java b/src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java index 6bde4167..23ab172c 100644 --- a/src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java +++ b/src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java @@ -108,6 +108,8 @@ public class HTMLTagFilterRequestWrapper extends HttpServletRequestWrapper { } private String getSafeParamData(String value) { + + /* StringBuffer strBuff = new StringBuffer(); for (int i = 0; i < value.length(); i++) { @@ -143,6 +145,7 @@ public class HTMLTagFilterRequestWrapper extends HttpServletRequestWrapper { } value = strBuff.toString(); + */ // SQL INJECTION 취약점 보완 value = value.replaceAll("\\s+[o|O][r|R]\\s+", " o-r "); diff --git a/src/main/java/nlib/bbs/service/ArticleVO.java b/src/main/java/nlib/bbs/service/ArticleVO.java index 6e919161..cd8b8cb3 100644 --- a/src/main/java/nlib/bbs/service/ArticleVO.java +++ b/src/main/java/nlib/bbs/service/ArticleVO.java @@ -100,6 +100,9 @@ public class ArticleVO extends PagingVO { public String getTitle() { return title; } + public String getUnescapeTitle() { + return StringEscapeUtils.unescapeHtml(title); + } public void setTitle(String title) { this.title = StringUtil.getSafeParamData(title); } diff --git a/src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp b/src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp index 20ef1738..af59fb59 100644 --- a/src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp +++ b/src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp @@ -314,7 +314,7 @@ function fn_downloadFile(attachFileId, fileSn) {