somang4819/itsm_ysm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

웹 입력변수 보안 처리

Browse Source
This commit is contained in:
KNKIM 2021-11-30 11:07:30 +09:00
parent 5bb41f7859
commit 64a30c7539
2 changed files with 105 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
src/main/java/nlib/bbs/service/ArticleVO.java
View File

@ -76,25 +76,25 @@ public class ArticleVO extends PagingVO {
return articleId; return articleId;
} }
public void setArticleId(String articleId) { public void setArticleId(String articleId) {
this.articleId = articleId; this.articleId = StringUtil.getSafeParamData(articleId);
} }
public String getMngOrgCd() { public String getMngOrgCd() {
return mngOrgCd; return mngOrgCd;
} }
public void setMngOrgCd(String mngOrgCd) { public void setMngOrgCd(String mngOrgCd) {
this.mngOrgCd = mngOrgCd; this.mngOrgCd = StringUtil.getSafeParamData(mngOrgCd);
} }
public String getBdType() { public String getBdType() {
return bdType; return bdType;
} }
public void setBdType(String bdType) { public void setBdType(String bdType) {
this.bdType = bdType; this.bdType = StringUtil.getSafeParamData(bdType);
} }
public String getTitle() { public String getTitle() {
return title; return title;
} }
public void setTitle(String title) { public void setTitle(String title) {
this.title = title; this.title = StringUtil.getSafeParamData(title);
} }
public String getContent() { public String getContent() {
return content; return content;
@ -106,25 +106,25 @@ public class ArticleVO extends PagingVO {
return notiYn; return notiYn;
} }
public void setNotiYn(String notiYn) { public void setNotiYn(String notiYn) {
this.notiYn = notiYn; this.notiYn = StringUtil.getSafeParamData(notiYn);
} }
public String getOpenYn() { public String getOpenYn() {
return openYn; return openYn;
} }
public void setOpenYn(String openYn) { public void setOpenYn(String openYn) {
this.openYn = openYn; this.openYn = StringUtil.getSafeParamData(openYn);
} }
public String getPostStartDate() { public String getPostStartDate() {
return postStartDate; return postStartDate;
} }
public void setPostStartDate(String postStartDate) { public void setPostStartDate(String postStartDate) {
this.postStartDate = postStartDate; this.postStartDate = StringUtil.getSafeParamData(postStartDate);
} }
public String getPostEndDate() { public String getPostEndDate() {
return postEndDate; return postEndDate;
} }
public void setPostEndDate(String postEndDate) { public void setPostEndDate(String postEndDate) {
this.postEndDate = postEndDate; this.postEndDate = StringUtil.getSafeParamData(postEndDate);
} }
public int getViewCnt() { public int getViewCnt() {
return viewCnt; return viewCnt;
@ -136,13 +136,13 @@ public class ArticleVO extends PagingVO {
return bdAttachFileId; return bdAttachFileId;
} }
public void setBdAttachFileId(String bdAttachFileId) { public void setBdAttachFileId(String bdAttachFileId) {
this.bdAttachFileId = bdAttachFileId; this.bdAttachFileId = StringUtil.getSafeParamData(bdAttachFileId);
} }
public String getRegId() { public String getRegId() {
return regId; return regId;
} }
public void setRegId(String regId) { public void setRegId(String regId) {
this.regId = regId; this.regId = StringUtil.getSafeParamData(regId);
} }
public String getRegDd() { public String getRegDd() {
return regDd; return regDd;
@ -178,7 +178,7 @@ public class ArticleVO extends PagingVO {
return searchType; return searchType;
} }
public void setSearchType(String searchType) { public void setSearchType(String searchType) {
this.searchType = searchType; this.searchType = StringUtil.getSafeParamData(searchType);
} }
public String getSearchKeyword() { public String getSearchKeyword() {
return searchKeyword; return searchKeyword;
@ -187,7 +187,7 @@ public class ArticleVO extends PagingVO {
return StringUtil.getSqlSearchKeyword(searchKeyword); return StringUtil.getSqlSearchKeyword(searchKeyword);
} }
public void setSearchKeyword(String searchKeyword) { public void setSearchKeyword(String searchKeyword) {
this.searchKeyword = searchKeyword; this.searchKeyword = StringUtil.getSafeParamData(searchKeyword);
} }
public String getAttachYn() { public String getAttachYn() {
return attachYn; return attachYn;
@ -199,13 +199,13 @@ public class ArticleVO extends PagingVO {
return mngOrgNm; return mngOrgNm;
} }
public void setMngOrgNm(String mngOrgNm) { public void setMngOrgNm(String mngOrgNm) {
this.mngOrgNm = mngOrgNm; this.mngOrgNm = StringUtil.getSafeParamData(mngOrgNm);
} }
public String getBdTypeName() { public String getBdTypeName() {
return bdTypeName; return bdTypeName;
} }
public void setBdTypeName(String bdTypeName) { public void setBdTypeName(String bdTypeName) {
this.bdTypeName = bdTypeName; this.bdTypeName = StringUtil.getSafeParamData(bdTypeName);
} }
public List<AttachFileVO> getAttachFiles() { public List<AttachFileVO> getAttachFiles() {
return attachFiles; return attachFiles;
@ -236,7 +236,7 @@ public class ArticleVO extends PagingVO {
} }
public void setQuestionType(String questionType) { public void setQuestionType(String questionType) {
this.questionType = questionType; this.questionType = StringUtil.getSafeParamData(questionType);
} }
public String getQuestionTypeName() { public String getQuestionTypeName() {
@ -244,7 +244,7 @@ public class ArticleVO extends PagingVO {
} }
public void setQuestionTypeName(String questionTypeName) { public void setQuestionTypeName(String questionTypeName) {
this.questionTypeName = questionTypeName; this.questionTypeName = StringUtil.getSafeParamData(questionTypeName);
} }
public String getAnswer() { public String getAnswer() {
@ -268,7 +268,7 @@ public class ArticleVO extends PagingVO {
} }
public void setSearchMbInfoId(String searchMbInfoId) { public void setSearchMbInfoId(String searchMbInfoId) {
this.searchMbInfoId = searchMbInfoId; this.searchMbInfoId = StringUtil.getSafeParamData(searchMbInfoId);
} }
public String getSecretYn() { public String getSecretYn() {

88
src/main/java/nlib/util/StringUtil.java
View File

@ -338,4 +338,92 @@ public class StringUtil extends StringUtils {
} return name; } return name;
} }
public static String getSafeParamData(String value) {
if(value == null || value.length() < 1) return value;
StringBuffer strBuff = new StringBuffer();
for (int i = 0; i < value.length(); i++) {
char c = value.charAt(i);
switch (c) {
case '<':
if ( checkNextWhiteListTag(i, value) == false )
strBuff.append("&lt;");
else
strBuff.append(c);
//System.out.println("checkNextWhiteListTag = "+checkNextWhiteListTag(i, value));
break;
case '>':
if ( checkPrevWhiteListTag(i, value) == false )
strBuff.append("&gt;");
else
strBuff.append(c);
//System.out.println("checkPrevWhiteListTag = "+checkPrevWhiteListTag(i, value));
break;
case '&':
strBuff.append("&amp;");
break;
case '"':
strBuff.append("&quot;");
break;
case '\'':
strBuff.append("&apos;");
break;
default:
strBuff.append(c);
break;
}
}
value = strBuff.toString();
// SQL INJECTION 취약점 보완
value = value.replaceAll("\\s+[o|O][r|R]\\s+", " o-r ");
value = value.replaceAll("\\s+[a|A][n|N][d|D]\\s+", " a-n-d ");
return value;
}
// Tag 화이트 리스트 ( 허용할 태그 등록 )
static String[] whiteListTag = { "<p>","</p>","<br />" };
private static boolean checkNextWhiteListTag(int index, String data) {
String extractData = "";
//int beginIndex = 0;
int endIndex = 0;
for(String whiteListData: whiteListTag) {
//System.out.println("===>>> whiteListData="+whiteListData);
endIndex = index+whiteListData.length();
if ( data.length() > endIndex )
extractData = data.substring(index, endIndex);
else
extractData = "";
//System.out.println("extractData="+extractData);
if ( whiteListData.equals(extractData) ) return true; // whiteList 대상으로 판정
}
return false;
}
private static boolean checkPrevWhiteListTag(int index, String data) {
String extractData = "";
int beginIndex = 0;
int endIndex = 0;
for(String whiteListData: whiteListTag) {
//System.out.println("===>>> whiteListData="+whiteListData);
beginIndex = index-whiteListData.length()+1;
endIndex = index+1;
//System.out.println(" range ["+beginIndex+" ~ "+endIndex+"]");
if ( beginIndex >= 0 )
extractData = data.substring(beginIndex, endIndex);
else
extractData = "";
//System.out.println("extractData="+extractData);
if ( whiteListData.equals(extractData) ) return true; // whiteList 대상으로 판정
}
return false;
}
} }