From 64a30c75390a62cf8c885210e382ca98898a6e89 Mon Sep 17 00:00:00 2001 From: KNKIM Date: Tue, 30 Nov 2021 11:07:30 +0900 Subject: [PATCH] =?UTF-8?q?=EC=9B=B9=20=EC=9E=85=EB=A0=A5=EB=B3=80?= =?UTF-8?q?=EC=88=98=20=EB=B3=B4=EC=95=88=20=EC=B2=98=EB=A6=AC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/main/java/nlib/bbs/service/ArticleVO.java | 34 +++---- src/main/java/nlib/util/StringUtil.java | 88 +++++++++++++++++++ 2 files changed, 105 insertions(+), 17 deletions(-) diff --git a/src/main/java/nlib/bbs/service/ArticleVO.java b/src/main/java/nlib/bbs/service/ArticleVO.java index 14e694a0..83f364d8 100644 --- a/src/main/java/nlib/bbs/service/ArticleVO.java +++ b/src/main/java/nlib/bbs/service/ArticleVO.java @@ -76,25 +76,25 @@ public class ArticleVO extends PagingVO { return articleId; } public void setArticleId(String articleId) { - this.articleId = articleId; + this.articleId = StringUtil.getSafeParamData(articleId); } public String getMngOrgCd() { return mngOrgCd; } public void setMngOrgCd(String mngOrgCd) { - this.mngOrgCd = mngOrgCd; + this.mngOrgCd = StringUtil.getSafeParamData(mngOrgCd); } public String getBdType() { return bdType; } public void setBdType(String bdType) { - this.bdType = bdType; + this.bdType = StringUtil.getSafeParamData(bdType); } public String getTitle() { return title; } public void setTitle(String title) { - this.title = title; + this.title = StringUtil.getSafeParamData(title); } public String getContent() { return content; @@ -106,25 +106,25 @@ public class ArticleVO extends PagingVO { return notiYn; } public void setNotiYn(String notiYn) { - this.notiYn = notiYn; + this.notiYn = StringUtil.getSafeParamData(notiYn); } public String getOpenYn() { return openYn; } public void setOpenYn(String openYn) { - this.openYn = openYn; + this.openYn = StringUtil.getSafeParamData(openYn); } public String getPostStartDate() { return postStartDate; } public void setPostStartDate(String postStartDate) { - this.postStartDate = postStartDate; + this.postStartDate = StringUtil.getSafeParamData(postStartDate); } public String getPostEndDate() { return postEndDate; } public void setPostEndDate(String postEndDate) { - this.postEndDate = postEndDate; + this.postEndDate = StringUtil.getSafeParamData(postEndDate); } public int getViewCnt() { return viewCnt; @@ -136,13 +136,13 @@ public class ArticleVO extends PagingVO { return bdAttachFileId; } public void setBdAttachFileId(String bdAttachFileId) { - this.bdAttachFileId = bdAttachFileId; + this.bdAttachFileId = StringUtil.getSafeParamData(bdAttachFileId); } public String getRegId() { return regId; } public void setRegId(String regId) { - this.regId = regId; + this.regId = StringUtil.getSafeParamData(regId); } public String getRegDd() { return regDd; @@ -178,7 +178,7 @@ public class ArticleVO extends PagingVO { return searchType; } public void setSearchType(String searchType) { - this.searchType = searchType; + this.searchType = StringUtil.getSafeParamData(searchType); } public String getSearchKeyword() { return searchKeyword; @@ -187,7 +187,7 @@ public class ArticleVO extends PagingVO { return StringUtil.getSqlSearchKeyword(searchKeyword); } public void setSearchKeyword(String searchKeyword) { - this.searchKeyword = searchKeyword; + this.searchKeyword = StringUtil.getSafeParamData(searchKeyword); } public String getAttachYn() { return attachYn; @@ -199,13 +199,13 @@ public class ArticleVO extends PagingVO { return mngOrgNm; } public void setMngOrgNm(String mngOrgNm) { - this.mngOrgNm = mngOrgNm; + this.mngOrgNm = StringUtil.getSafeParamData(mngOrgNm); } public String getBdTypeName() { return bdTypeName; } public void setBdTypeName(String bdTypeName) { - this.bdTypeName = bdTypeName; + this.bdTypeName = StringUtil.getSafeParamData(bdTypeName); } public List getAttachFiles() { return attachFiles; @@ -236,7 +236,7 @@ public class ArticleVO extends PagingVO { } public void setQuestionType(String questionType) { - this.questionType = questionType; + this.questionType = StringUtil.getSafeParamData(questionType); } public String getQuestionTypeName() { @@ -244,7 +244,7 @@ public class ArticleVO extends PagingVO { } public void setQuestionTypeName(String questionTypeName) { - this.questionTypeName = questionTypeName; + this.questionTypeName = StringUtil.getSafeParamData(questionTypeName); } public String getAnswer() { @@ -268,7 +268,7 @@ public class ArticleVO extends PagingVO { } public void setSearchMbInfoId(String searchMbInfoId) { - this.searchMbInfoId = searchMbInfoId; + this.searchMbInfoId = StringUtil.getSafeParamData(searchMbInfoId); } public String getSecretYn() { diff --git a/src/main/java/nlib/util/StringUtil.java b/src/main/java/nlib/util/StringUtil.java index 8f135ed6..a93095ed 100644 --- a/src/main/java/nlib/util/StringUtil.java +++ b/src/main/java/nlib/util/StringUtil.java @@ -338,4 +338,92 @@ public class StringUtil extends StringUtils { } return name; } + public static String getSafeParamData(String value) { + + if(value == null || value.length() < 1) return value; + + StringBuffer strBuff = new StringBuffer(); + + for (int i = 0; i < value.length(); i++) { + char c = value.charAt(i); + switch (c) { + case '<': + if ( checkNextWhiteListTag(i, value) == false ) + strBuff.append("<"); + else + strBuff.append(c); + //System.out.println("checkNextWhiteListTag = "+checkNextWhiteListTag(i, value)); + break; + case '>': + if ( checkPrevWhiteListTag(i, value) == false ) + strBuff.append(">"); + else + strBuff.append(c); + //System.out.println("checkPrevWhiteListTag = "+checkPrevWhiteListTag(i, value)); + break; + case '&': + strBuff.append("&"); + break; + case '"': + strBuff.append("""); + break; + case '\'': + strBuff.append("'"); + break; + default: + strBuff.append(c); + break; + } + } + + value = strBuff.toString(); + + // SQL INJECTION 취약점 보완 + value = value.replaceAll("\\s+[o|O][r|R]\\s+", " o-r "); + value = value.replaceAll("\\s+[a|A][n|N][d|D]\\s+", " a-n-d "); + + return value; + } + + // Tag 화이트 리스트 ( 허용할 태그 등록 ) + static String[] whiteListTag = { "

","

","
" }; + + private static boolean checkNextWhiteListTag(int index, String data) { + String extractData = ""; + //int beginIndex = 0; + int endIndex = 0; + for(String whiteListData: whiteListTag) { + //System.out.println("===>>> whiteListData="+whiteListData); + endIndex = index+whiteListData.length(); + if ( data.length() > endIndex ) + extractData = data.substring(index, endIndex); + else + extractData = ""; + //System.out.println("extractData="+extractData); + if ( whiteListData.equals(extractData) ) return true; // whiteList 대상으로 판정 + } + + return false; + } + + private static boolean checkPrevWhiteListTag(int index, String data) { + String extractData = ""; + int beginIndex = 0; + int endIndex = 0; + for(String whiteListData: whiteListTag) { + //System.out.println("===>>> whiteListData="+whiteListData); + beginIndex = index-whiteListData.length()+1; + endIndex = index+1; + //System.out.println(" range ["+beginIndex+" ~ "+endIndex+"]"); + if ( beginIndex >= 0 ) + extractData = data.substring(beginIndex, endIndex); + else + extractData = ""; + //System.out.println("extractData="+extractData); + if ( whiteListData.equals(extractData) ) return true; // whiteList 대상으로 판정 + } + + return false; + } + }