somang4819/itsm_ysm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

웹 입력변수 보안 처리

Browse Source
This commit is contained in:
KNKIM 2021-11-30 11:07:30 +09:00
parent 5bb41f7859
commit 64a30c7539
2 changed files with 105 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
src/main/java/nlib/bbs/service/ArticleVO.java
View File

@ -76,25 +76,25 @@ public class ArticleVO extends PagingVO {
return articleId;
}
public void setArticleId(String articleId) {
this.articleId = articleId;
this.articleId = StringUtil.getSafeParamData(articleId);
}
public String getMngOrgCd() {
return mngOrgCd;
}
public void setMngOrgCd(String mngOrgCd) {
this.mngOrgCd = mngOrgCd;
this.mngOrgCd = StringUtil.getSafeParamData(mngOrgCd);
}
public String getBdType() {
return bdType;
}
public void setBdType(String bdType) {
this.bdType = bdType;
this.bdType = StringUtil.getSafeParamData(bdType);
}
public String getTitle() {
return title;
}
public void setTitle(String title) {
this.title = title;
this.title = StringUtil.getSafeParamData(title);
}
public String getContent() {
return content;
@ -106,25 +106,25 @@ public class ArticleVO extends PagingVO {
return notiYn;
}
public void setNotiYn(String notiYn) {
this.notiYn = notiYn;
this.notiYn = StringUtil.getSafeParamData(notiYn);
}
public String getOpenYn() {
return openYn;
}
public void setOpenYn(String openYn) {
this.openYn = openYn;
this.openYn = StringUtil.getSafeParamData(openYn);
}
public String getPostStartDate() {
return postStartDate;
}
public void setPostStartDate(String postStartDate) {
this.postStartDate = postStartDate;
this.postStartDate = StringUtil.getSafeParamData(postStartDate);
}
public String getPostEndDate() {
return postEndDate;
}
public void setPostEndDate(String postEndDate) {
this.postEndDate = postEndDate;
this.postEndDate = StringUtil.getSafeParamData(postEndDate);
}
public int getViewCnt() {
return viewCnt;
@ -136,13 +136,13 @@ public class ArticleVO extends PagingVO {
return bdAttachFileId;
}
public void setBdAttachFileId(String bdAttachFileId) {
this.bdAttachFileId = bdAttachFileId;
this.bdAttachFileId = StringUtil.getSafeParamData(bdAttachFileId);
}
public String getRegId() {
return regId;
}
public void setRegId(String regId) {
this.regId = regId;
this.regId = StringUtil.getSafeParamData(regId);
}
public String getRegDd() {
return regDd;
@ -178,7 +178,7 @@ public class ArticleVO extends PagingVO {
return searchType;
}
public void setSearchType(String searchType) {
this.searchType = searchType;
this.searchType = StringUtil.getSafeParamData(searchType);
}
public String getSearchKeyword() {
return searchKeyword;
@ -187,7 +187,7 @@ public class ArticleVO extends PagingVO {
return StringUtil.getSqlSearchKeyword(searchKeyword);
}
public void setSearchKeyword(String searchKeyword) {
this.searchKeyword = searchKeyword;
this.searchKeyword = StringUtil.getSafeParamData(searchKeyword);
}
public String getAttachYn() {
return attachYn;
@ -199,13 +199,13 @@ public class ArticleVO extends PagingVO {
return mngOrgNm;
}
public void setMngOrgNm(String mngOrgNm) {
this.mngOrgNm = mngOrgNm;
this.mngOrgNm = StringUtil.getSafeParamData(mngOrgNm);
}
public String getBdTypeName() {
return bdTypeName;
}
public void setBdTypeName(String bdTypeName) {
this.bdTypeName = bdTypeName;
this.bdTypeName = StringUtil.getSafeParamData(bdTypeName);
}
public List<AttachFileVO> getAttachFiles() {
return attachFiles;
@ -236,7 +236,7 @@ public class ArticleVO extends PagingVO {
}
public void setQuestionType(String questionType) {
this.questionType = questionType;
this.questionType = StringUtil.getSafeParamData(questionType);
}
public String getQuestionTypeName() {
@ -244,7 +244,7 @@ public class ArticleVO extends PagingVO {
}
public void setQuestionTypeName(String questionTypeName) {
this.questionTypeName = questionTypeName;
this.questionTypeName = StringUtil.getSafeParamData(questionTypeName);
}
public String getAnswer() {
@ -268,7 +268,7 @@ public class ArticleVO extends PagingVO {
}
public void setSearchMbInfoId(String searchMbInfoId) {
this.searchMbInfoId = searchMbInfoId;
this.searchMbInfoId = StringUtil.getSafeParamData(searchMbInfoId);
}
public String getSecretYn() {

88
src/main/java/nlib/util/StringUtil.java
View File

@ -338,4 +338,92 @@ public class StringUtil extends StringUtils {
} return name;
}
public static String getSafeParamData(String value) {
if(value == null || value.length() < 1) return value;
StringBuffer strBuff = new StringBuffer();
for (int i = 0; i < value.length(); i++) {
char c = value.charAt(i);
switch (c) {
case '<':
if ( checkNextWhiteListTag(i, value) == false )
strBuff.append("&lt;");
else
strBuff.append(c);
//System.out.println("checkNextWhiteListTag = "+checkNextWhiteListTag(i, value));
break;
case '>':
if ( checkPrevWhiteListTag(i, value) == false )
strBuff.append("&gt;");
else
strBuff.append(c);
//System.out.println("checkPrevWhiteListTag = "+checkPrevWhiteListTag(i, value));
break;
case '&':
strBuff.append("&amp;");
break;
case '"':
strBuff.append("&quot;");
break;
case '\'':
strBuff.append("&apos;");
break;
default:
strBuff.append(c);
break;
}
}
value = strBuff.toString();
// SQL INJECTION 취약점 보완
value = value.replaceAll("\\s+[o|O][r|R]\\s+", " o-r ");
value = value.replaceAll("\\s+[a|A][n|N][d|D]\\s+", " a-n-d ");
return value;
}
// Tag 화이트 리스트 ( 허용할 태그 등록 )
static String[] whiteListTag = { "<p>","</p>","<br />" };
private static boolean checkNextWhiteListTag(int index, String data) {
String extractData = "";
//int beginIndex = 0;
int endIndex = 0;
for(String whiteListData: whiteListTag) {
//System.out.println("===>>> whiteListData="+whiteListData);
endIndex = index+whiteListData.length();
if ( data.length() > endIndex )
extractData = data.substring(index, endIndex);
else
extractData = "";
//System.out.println("extractData="+extractData);
if ( whiteListData.equals(extractData) ) return true; // whiteList 대상으로 판정
}
return false;
}
private static boolean checkPrevWhiteListTag(int index, String data) {
String extractData = "";
int beginIndex = 0;
int endIndex = 0;
for(String whiteListData: whiteListTag) {
//System.out.println("===>>> whiteListData="+whiteListData);
beginIndex = index-whiteListData.length()+1;
endIndex = index+1;
//System.out.println(" range ["+beginIndex+" ~ "+endIndex+"]");
if ( beginIndex >= 0 )
extractData = data.substring(beginIndex, endIndex);
else
extractData = "";
//System.out.println("extractData="+extractData);
if ( whiteListData.equals(extractData) ) return true; // whiteList 대상으로 판정
}
return false;
}
}