somang4819/itsm_ysm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

게시글 특수 문자 처리 관련 보완

Browse Source
This commit is contained in:
KNKIM 2021-12-15 16:20:18 +09:00
parent 94a0289760
commit b7bbba23ee
11 changed files with 79 additions and 288 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
src/main/java/egovframework/com/cmm/filter/HTMLTagFilter.java
View File

@ -1,46 +0,0 @@
/*
* Copyright 2008-2009 MOPAS(MINISTRY OF SECURITY AND PUBLIC ADMINISTRATION).
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package egovframework.com.cmm.filter;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
public class HTMLTagFilter implements Filter{
@SuppressWarnings("unused")
private FilterConfig config;
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
chain.doFilter(new HTMLTagFilterRequestWrapper((HttpServletRequest)request), response);
}
public void init(FilterConfig config) throws ServletException {
this.config = config;
}
public void destroy() {
}
}

195
src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java
View File

@ -1,195 +0,0 @@
/*
* Copyright 2008-2009 MOPAS(MINISTRY OF SECURITY AND PUBLIC ADMINISTRATION).
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package egovframework.com.cmm.filter;
import java.util.Map;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
/**
*
* HTMLTagFilterRequestWrapper
* @author 공통컴포넌트 팀 신용호
* @since 2018.03.21
* @version 1.0
* @see
*
* <pre>
* << 개정이력(Modification Information) >>
*
* 수정일 수정자 수정내용
* ------- -------- ---------------------------
* 2018.03.21 신용호 getParameterMap()구현 추가
* 2019.01.31 신용호 whiteList 태그 추가
*
*/
public class HTMLTagFilterRequestWrapper extends HttpServletRequestWrapper {
// Tag 화이트 리스트 ( 허용할 태그 등록 )
static private String[] whiteListTag = { "<p>","</p>","<br />" };
public HTMLTagFilterRequestWrapper(HttpServletRequest request) {
super(request);
}
public String[] getParameterValues(String parameter) {
String[] values = super.getParameterValues(parameter);
if(values==null){
return null;
}
for (int i = 0; i < values.length; i++) {
if (values[i] != null) {
values[i] = getSafeParamData(values[i]);
//System.out.println( "[HTMLTagFilter getParameterValues] "+ parameter + "===>>>"+values[i] );
} else {
values[i] = null;
}
}
return values;
}
public String getParameter(String parameter) {
String value = super.getParameter(parameter);
if(value==null){
return null;
}
value = getSafeParamData(value);
//System.out.println( "[HTMLTagFilter getParameter] "+ parameter + "===>>>"+value );
return value;
}
/**
* Map으로 바인딩된 경우를 처리한다.
*
* @return Map - String Type Key / String배열타입 값
*/
public Map<String, String[]> getParameterMap() {
Map<String, String[]> valueMap = super.getParameterMap();
String[] values;
for( String key : valueMap.keySet() ){
values = valueMap.get(key);
for (int i = 0; i < values.length; i++) {
if (values[i] != null) {
values[i] = getSafeParamData(values[i]);
//System.out.println( "[HTMLTagFilter getParameterMap] "+ key + "===>>>"+values[i] );
} else {
values[i] = null;
}
}
//System.out.println( String.format("키 : %s, 값 : %s", key, valueMap.get(key)) );
}
return valueMap;
}
private String getSafeParamData(String value) {
/*
StringBuffer strBuff = new StringBuffer();
for (int i = 0; i < value.length(); i++) {
char c = value.charAt(i);
switch (c) {
case '<':
if ( checkNextWhiteListTag(i, value) == false )
strBuff.append("&lt;");
else
strBuff.append(c);
//System.out.println("checkNextWhiteListTag = "+checkNextWhiteListTag(i, value));
break;
case '>':
if ( checkPrevWhiteListTag(i, value) == false )
strBuff.append("&gt;");
else
strBuff.append(c);
//System.out.println("checkPrevWhiteListTag = "+checkPrevWhiteListTag(i, value));
break;
case '&':
strBuff.append("&amp;");
break;
case '"':
strBuff.append("&quot;");
break;
case '\'':
strBuff.append("&apos;");
break;
default:
strBuff.append(c);
break;
}
}
value = strBuff.toString();
*/
// SQL INJECTION 취약점 보완
value = value.replaceAll("\\s+[o|O][r|R]\\s+", " o-r ");
value = value.replaceAll("\\s+[a|A][n|N][d|D]\\s+", " a-n-d ");
return value;
}
private boolean checkNextWhiteListTag(int index, String data) {
String extractData = "";
//int beginIndex = 0;
int endIndex = 0;
for(String whiteListData: whiteListTag) {
//System.out.println("===>>> whiteListData="+whiteListData);
endIndex = index+whiteListData.length();
if ( data.length() > endIndex )
extractData = data.substring(index, endIndex);
else
extractData = "";
//System.out.println("extractData="+extractData);
if ( whiteListData.equals(extractData) ) return true; // whiteList 대상으로 판정
}
return false;
}
private boolean checkPrevWhiteListTag(int index, String data) {
String extractData = "";
int beginIndex = 0;
int endIndex = 0;
for(String whiteListData: whiteListTag) {
//System.out.println("===>>> whiteListData="+whiteListData);
beginIndex = index-whiteListData.length()+1;
endIndex = index+1;
//System.out.println(" range ["+beginIndex+" ~ "+endIndex+"]");
if ( beginIndex >= 0 )
extractData = data.substring(beginIndex, endIndex);
else
extractData = "";
//System.out.println("extractData="+extractData);
if ( whiteListData.equals(extractData) ) return true; // whiteList 대상으로 판정
}
return false;
}
}

49
src/main/java/nlib/bbs/service/ArticleVO.java
View File

@ -83,28 +83,31 @@ public class ArticleVO extends PagingVO {
return articleId;
}
public void setArticleId(String articleId) {
this.articleId = StringUtil.getSafeParamData(articleId);
// 쿼리 조건으로 사용되는 항목에 대하여 SQL 인젝션으로 처리될만한 문자 강체 치환 처리
this.articleId = StringUtil.getValidCodeString(articleId);
}
public String getMngOrgCd() {
return mngOrgCd;
}
public void setMngOrgCd(String mngOrgCd) {
this.mngOrgCd = StringUtil.getSafeParamData(mngOrgCd);
// 쿼리 조건으로 사용되는 항목에 대하여 SQL 인젝션으로 처리될만한 문자 강체 치환 처리
this.mngOrgCd = StringUtil.getValidCodeString(mngOrgCd);
}
public String getBdType() {
return bdType;
}
public void setBdType(String bdType) {
this.bdType = StringUtil.getSafeParamData(bdType);
}
public String getTitle() {
return title;
this.bdType = bdType;
}
public String getUnescapeTitle() {
return StringEscapeUtils.unescapeHtml(title);
}
public String getTitle() {
return title;
}
public void setTitle(String title) {
this.title = StringUtil.getSafeParamData(title);
this.title = title;
}
public String getContent() {
return content;
@ -116,25 +119,25 @@ public class ArticleVO extends PagingVO {
return notiYn;
}
public void setNotiYn(String notiYn) {
this.notiYn = StringUtil.getSafeParamData(notiYn);
this.notiYn = notiYn;
}
public String getOpenYn() {
return openYn;
}
public void setOpenYn(String openYn) {
this.openYn = StringUtil.getSafeParamData(openYn);
this.openYn = openYn;
}
public String getPostStartDate() {
return postStartDate;
}
public void setPostStartDate(String postStartDate) {
this.postStartDate = StringUtil.getSafeParamData(postStartDate);
this.postStartDate = postStartDate;
}
public String getPostEndDate() {
return postEndDate;
}
public void setPostEndDate(String postEndDate) {
this.postEndDate = StringUtil.getSafeParamData(postEndDate);
this.postEndDate = postEndDate;
}
public int getViewCnt() {
return viewCnt;
@ -146,13 +149,13 @@ public class ArticleVO extends PagingVO {
return bdAttachFileId;
}
public void setBdAttachFileId(String bdAttachFileId) {
this.bdAttachFileId = StringUtil.getSafeParamData(bdAttachFileId);
this.bdAttachFileId = bdAttachFileId;
}
public String getRegId() {
return regId;
}
public void setRegId(String regId) {
this.regId = StringUtil.getSafeParamData(regId);
this.regId = regId;
}
public String getRegDd() {
return regDd;
@ -192,7 +195,7 @@ public class ArticleVO extends PagingVO {
return searchType;
}
public void setSearchType(String searchType) {
this.searchType = StringUtil.getSafeParamData(searchType);
this.searchType = searchType;
}
public String getSearchKeyword() {
return searchKeyword;
@ -201,7 +204,7 @@ public class ArticleVO extends PagingVO {
return StringUtil.getSqlSearchKeyword(searchKeyword);
}
public void setSearchKeyword(String searchKeyword) {
this.searchKeyword = StringUtil.getSafeParamData(searchKeyword);
this.searchKeyword = searchKeyword;
}
public String getAttachYn() {
return attachYn;
@ -213,13 +216,13 @@ public class ArticleVO extends PagingVO {
return mngOrgNm;
}
public void setMngOrgNm(String mngOrgNm) {
this.mngOrgNm = StringUtil.getSafeParamData(mngOrgNm);
this.mngOrgNm = mngOrgNm;
}
public String getBdTypeName() {
return bdTypeName;
}
public void setBdTypeName(String bdTypeName) {
this.bdTypeName = StringUtil.getSafeParamData(bdTypeName);
this.bdTypeName = bdTypeName;
}
public List<AttachFileVO> getAttachFiles() {
return attachFiles;
@ -250,7 +253,7 @@ public class ArticleVO extends PagingVO {
}
public void setQuestionType(String questionType) {
this.questionType = StringUtil.getSafeParamData(questionType);
this.questionType = questionType;
}
public String getQuestionTypeName() {
@ -258,7 +261,7 @@ public class ArticleVO extends PagingVO {
}
public void setQuestionTypeName(String questionTypeName) {
this.questionTypeName = StringUtil.getSafeParamData(questionTypeName);
this.questionTypeName = questionTypeName;
}
public String getAnswer() {
@ -282,7 +285,8 @@ public class ArticleVO extends PagingVO {
}
public void setSearchMbInfoId(String searchMbInfoId) {
this.searchMbInfoId = StringUtil.getSafeParamData(searchMbInfoId);
// 쿼리 조건으로 사용되는 항목에 대하여 SQL 인젝션으로 처리될만한 문자 강체 치환 처리
this.searchMbInfoId = StringUtil.getValidCodeString(searchMbInfoId);
}
public String getSecretYn() {
@ -297,8 +301,9 @@ public class ArticleVO extends PagingVO {
return loginedMbInfoId;
}
public void setLoginedMbInfoId(String mbInfoId) {
this.loginedMbInfoId = mbInfoId;
public void setLoginedMbInfoId(String loginedMbInfoId) {
// 쿼리 조건으로 사용되는 항목에 대하여 SQL 인젝션으로 처리될만한 문자 강체 치환 처리
this.loginedMbInfoId = StringUtil.getValidCodeString(loginedMbInfoId);
}
public String getMyQnaYn() {

25
src/main/java/nlib/util/StringUtil.java
View File

@ -269,12 +269,29 @@ public class StringUtil extends StringUtils {
if(isNotEmpty(str)) {
String ret = str.replaceAll("\\%", "\\\\%");
return ret.replaceAll("_", "\\\\_");
ret = ret.replaceAll("_", "\\\\_");
ret = ret.replaceAll("'", "\\\\'");;
return ret;
}
return str;
}
public static String getValidCodeString(String str) {
if(isNotEmpty(str)) {
String ret = str.replaceAll("'", "");
ret = ret.replaceAll(" ", "");
ret = ret.replaceAll("\t", "");;
ret = ret.replaceAll("\n", "");;
ret = ret.replaceAll("\r", "");;
return ret;
}
return str;
}
/**
* 날짜 문자열(YYYYMMDD)을 받아서 화면 출력용 날짜 형식 문자열(YYYY-MM-DD)로 리턴한다.
@ -364,8 +381,8 @@ public class StringUtil extends StringUtils {
strBuff.append(c);
//System.out.println("checkPrevWhiteListTag = "+checkPrevWhiteListTag(i, value));
break;
case '&':
strBuff.append("&amp;");
case ' ':
strBuff.append("&nbsp;");
break;
case '"':
strBuff.append("&quot;");
@ -380,7 +397,7 @@ public class StringUtil extends StringUtils {
}
value = strBuff.toString();
// SQL INJECTION 취약점 보완
value = value.replaceAll("\\s+[o|O][r|R]\\s+", " o-r ");
value = value.replaceAll("\\s+[a|A][n|N][d|D]\\s+", " a-n-d ");

6
src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp
View File

@ -61,7 +61,7 @@ var isModified = false;
var oEditors = [];
$(window.document).ready(function() {
fn_setPageTitle("<c:out value='${pageTitle}'/>");
fn_setPageTitle("<c:out value='${pageTitle}' escapeXml='false' />");
if(!gfn_isEmpty('<c:out value="${message}"/>')) {
alert("<c:out value='${message}'/>");
@ -322,7 +322,7 @@ function fn_downloadFile(attachFileId, fileSn) {
<li class="wt-title fl">
<div class="w-tit">제목 <span class="required">*</span></div>
<div class="w-form">
<input type="text" name="title" id="title" title="제목" value="<c:out value='${searchArticle.unescapeTitle}'/>" size="100" maxlength="200" class="grid-1" placeholder="제목을 입력하세요." required />
<input type="text" name="title" id="title" title="제목" value="<c:out value='${searchArticle.title}' escapeXml='false' />" size="100" maxlength="200" class="grid-1" placeholder="제목을 입력하세요." required />
</div>
</li>
<li class="wt-secret fl check">
@ -342,7 +342,7 @@ function fn_downloadFile(attachFileId, fileSn) {
<li class="wt-question">
<div class="w-tit">내용 <span class="required">*</span></div>
<div class="w-form">
<textarea name="content" id="content" cols="80" rows="10" placeholder="질문하실 내용을 입력하세요." style="width:100%;min-width:260px;"><c:out value='${searchArticle.content}'/></textarea>
<textarea name="content" id="content" cols="80" rows="10" placeholder="질문하실 내용을 입력하세요." style="width:100%;min-width:260px;"><c:out value='${searchArticle.unescapedContent}' escapeXml='false' /></textarea>
</div>
</li>
</ul>

2
src/main/webapp/WEB-INF/jsp/nlib/bbs/listQnas.jsp
View File

@ -152,7 +152,7 @@
var li = $('<tr class="tableTrData" />');
li.append($('<td />').attr('class', 't-num').html(obj.rno));
li.append($('<td />').attr('class', 't-tit').html("<a href=\"javascript:void(0)\" onclick=\"fn_viewDetail('" + obj.articleId + "','" + obj.secretYn + "','" + obj.myQnaYn + "')\">" +
obj.unescapeTitle +
obj.title +
(obj.secretYn == "Y" ? '<img src="/images/icon/icon-password.png" alt="자물쇠 아이콘">&nbsp;' : '') +
"</a>"));
li.append($('<td />').attr('class', 't-writer').html(obj.regNmSec));

12
src/main/webapp/WEB-INF/jsp/nlib/bbs/selectAncmntArticle.jsp
View File

@ -31,12 +31,12 @@
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
<%@ taglib prefix="validator" uri="http://www.springmodules.org/tags/commons-validator" %>
<c:set var="pageTitle"><c:out value='${article.title}'/></c:set>
<c:set var="pageTitle">공지사항 - 상세조회</c:set>
<script>
$( document ).ready(function() {
fn_setPageTitle("<c:out value='${pageTitle}'/>");
fn_setPageTitle("<c:out value='${article.title}' />");
if(!gfn_isEmpty("<c:out value='${message}'/>")) {
alert("<c:out value='${message}'/>");
@ -80,10 +80,10 @@ function fn_downloadFile(attachFileId, fileSn) {
<ul class="loc">
<li>HOME</li>
<li>고객지원</li>
<li class="on">공지사항 - 상세조회</li>
<li class="on"><c:out value='${pageTitle }'/></li>
</ul>
<div class="tit">
<h2><span>공지사항 - 상세조회</span></h2>
<h2><span><c:out value='${pageTitle }'/></span></h2>
</div>
</div>
<div class="arr"><img src="/images/icon/icon-join-arr2.png" alt=""></div>
@ -94,7 +94,7 @@ function fn_downloadFile(attachFileId, fileSn) {
<div class="contents-frame inner-center">
<div class="view-notice">
<div class="view-tit">
<h2><span class="type"><c:if test='${article.notiYn == "Y"}'><span>공지</span></c:if></span><c:out value='${article.title}'/>
<h2><span class="type"><c:if test='${article.notiYn == "Y"}'><span>공지</span></c:if></span><c:out value='${article.title}' escapeXml='false' />
</h2>
<span class="v-info">
<em><c:out value='${article.regNm }'/></em>
@ -121,7 +121,7 @@ function fn_downloadFile(attachFileId, fileSn) {
<div class="view-body">
<div class="view-con">
<div class="view-txt">
<c:out value='${article.content}' escapeXml="false" />
<c:out value='${article.content}' />
</div>
</div>
<ul class="attachments">

10
src/main/webapp/WEB-INF/jsp/nlib/bbs/selectQnaArticle.jsp
View File

@ -36,7 +36,7 @@
<script>
$( document ).ready(function() {
fn_setPageTitle("<c:out value='${pageTitle}'/>");
fn_setPageTitle("<c:out value='${article.title}' />", "");
if(!gfn_isEmpty("<c:out value='${message}'/>")) {
alert("<c:out value='${message}'/>");
@ -114,9 +114,7 @@ function fn_downloadFile(attachFileId, fileSn) {
<h2>
<span class="type">
<c:if test='${article.answerYn == "Y"}'><span>답변완료</span></c:if>
</span>
<c:out value='${article.unescapeTitle}'/>
<span>
</span><c:out value='${article.title}' escapeXml="false" /><span>
<c:if test='${article.secretYn == "Y"}'>
<img src="/images/icon/icon-secret.png" alt="자물쇠 아이콘">
</c:if>
@ -146,7 +144,9 @@ function fn_downloadFile(attachFileId, fileSn) {
<div class="view-body">
<div class="view-con">
<div class="view-txt">
<p><c:out value='${article.content}' escapeXml="false" /></p>
<p>
<c:out value='${article.unescapedContent}' escapeXml="false" />
</p>
</div>
</div>
<c:if test='${article.answerYn == "Y"}'>

4
src/main/webapp/WEB-INF/jsp/nlib/cmm/home.jsp
View File

@ -386,7 +386,7 @@ function fn_listPops(typeDivCd) {
<a href="javascript:void(0)" onclick="fn_viewAncmnt('<c:out value='${itemAncmnt.articleId}'/>')">
<div class="box"><p><c:out value='${fn:substring(itemAncmnt.regDd,8,10) }'/></p><p> <c:out value='${fn:substring(itemAncmnt.regDd,2,4) }'/>.<c:out value='${fn:substring(itemAncmnt.regDd,5,7) }'/></p></div>
<div class="text">
<p><c:if test='${itemAncmnt.notiYn == "Y"}'>[공지]</c:if><c:out value='${itemAncmnt.title}'/>
<p><c:if test='${itemAncmnt.notiYn == "Y"}'>[공지]</c:if><c:out value='${itemAncmnt.title}' escapeXml='false' />
<c:if test='${itemAncmnt.attachYn == "Y"}'><img src="/images/icon/icon-file.png" class="file" alt="파일 아이콘"></c:if></p>
</div>
</a>
@ -403,7 +403,7 @@ function fn_listPops(typeDivCd) {
<a href="javascript:void(0)" onclick="fn_viewQna('<c:out value='${itemQna.articleId}'/>', '<c:out value='${itemQna.secretYn}'/>', '<c:out value='${itemQna.myQnaYn}'/>')">
<div class="box"><p><c:out value='${fn:substring(itemQna.regDd,8,10) }'/></p><p> <c:out value='${fn:substring(itemQna.regDd,2,4) }'/>.<c:out value='${fn:substring(itemQna.regDd,5,7) }'/></p></div>
<div class="text">
<p><c:out value='${itemQna.title}'/>
<p><c:out value='${itemQna.title}' escapeXml='false' />
<c:if test='${itemQna.secretYn == "Y"}'><img src="/images/icon/icon-password.png" class="pw" alt="잠금 아이콘"></c:if>
</p>
</div>

14
src/main/webapp/WEB-INF/tiles/tiles-layout.jsp
View File

@ -42,8 +42,18 @@ String councilDnsHost = (String)session.getAttribute("councilDnsHost");
<script>
// 제목 설정
function fn_setPageTitle(title) {
document.title = title + " - <c:out value='${councilNm }'/> 소장자료관";
function fn_setPageTitle(title, suffix) {
var newTitle = title;
if(typeof suffix == "undefined") {
newTitle += " - <c:out value='${councilNm }'/> 소장자료관";
} else {
title += " " + suffix;
}
<%
// ESCAPE된 DB데이터에서 제목설정 페이지 JAVASCRIPT에서 ESCAPE가 한번 더 될 수 있으므로 2번 수행
%>
document.title = gfn_unescapeHtml(gfn_unescapeHtml(newTitle));
}
</script>

4
src/main/webapp/WEB-INF/web.xml
View File

@ -19,10 +19,10 @@
<filter-name>encodingFilter</filter-name>
<url-pattern>*.do</url-pattern>
</filter-mapping>
<filter>
<filter-name>HTMLTagFilter</filter-name>
<filter-class>egovframework.com.cmm.filter.HTMLTagFilter</filter-class>
<!-- <filter-class>egovframework.rte.ptl.mvc.filter.HTMLTagFilter</filter-class> -->
<filter-class>egovframework.rte.ptl.mvc.filter.HTMLTagFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>HTMLTagFilter</filter-name>