From b7bbba23ee9855170c4e514c08e0223b44ff47ca Mon Sep 17 00:00:00 2001 From: KNKIM Date: Wed, 15 Dec 2021 16:20:18 +0900 Subject: [PATCH] =?UTF-8?q?=EA=B2=8C=EC=8B=9C=EA=B8=80=20=ED=8A=B9?= =?UTF-8?q?=EC=88=98=20=EB=AC=B8=EC=9E=90=20=EC=B2=98=EB=A6=AC=20=EA=B4=80?= =?UTF-8?q?=EB=A0=A8=20=EB=B3=B4=EC=99=84?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../com/cmm/filter/HTMLTagFilter.java | 46 ----- .../filter/HTMLTagFilterRequestWrapper.java | 195 ------------------ src/main/java/nlib/bbs/service/ArticleVO.java | 49 +++-- src/main/java/nlib/util/StringUtil.java | 25 ++- .../WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp | 6 +- .../webapp/WEB-INF/jsp/nlib/bbs/listQnas.jsp | 2 +- .../jsp/nlib/bbs/selectAncmntArticle.jsp | 12 +- .../WEB-INF/jsp/nlib/bbs/selectQnaArticle.jsp | 10 +- src/main/webapp/WEB-INF/jsp/nlib/cmm/home.jsp | 4 +- .../webapp/WEB-INF/tiles/tiles-layout.jsp | 14 +- src/main/webapp/WEB-INF/web.xml | 4 +- 11 files changed, 79 insertions(+), 288 deletions(-) delete mode 100644 src/main/java/egovframework/com/cmm/filter/HTMLTagFilter.java delete mode 100644 src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java diff --git a/src/main/java/egovframework/com/cmm/filter/HTMLTagFilter.java b/src/main/java/egovframework/com/cmm/filter/HTMLTagFilter.java deleted file mode 100644 index 551d57aa..00000000 --- a/src/main/java/egovframework/com/cmm/filter/HTMLTagFilter.java +++ /dev/null @@ -1,46 +0,0 @@ -/* - * Copyright 2008-2009 MOPAS(MINISTRY OF SECURITY AND PUBLIC ADMINISTRATION). - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package egovframework.com.cmm.filter; - -import java.io.IOException; - -import javax.servlet.Filter; -import javax.servlet.FilterChain; -import javax.servlet.FilterConfig; -import javax.servlet.ServletException; -import javax.servlet.ServletRequest; -import javax.servlet.ServletResponse; -import javax.servlet.http.HttpServletRequest; - -public class HTMLTagFilter implements Filter{ - - @SuppressWarnings("unused") - private FilterConfig config; - - public void doFilter(ServletRequest request, ServletResponse response, - FilterChain chain) throws IOException, ServletException { - - chain.doFilter(new HTMLTagFilterRequestWrapper((HttpServletRequest)request), response); - } - - public void init(FilterConfig config) throws ServletException { - this.config = config; - } - - public void destroy() { - - } -} diff --git a/src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java b/src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java deleted file mode 100644 index 23ab172c..00000000 --- a/src/main/java/egovframework/com/cmm/filter/HTMLTagFilterRequestWrapper.java +++ /dev/null @@ -1,195 +0,0 @@ -/* - * Copyright 2008-2009 MOPAS(MINISTRY OF SECURITY AND PUBLIC ADMINISTRATION). - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package egovframework.com.cmm.filter; - -import java.util.Map; - -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletRequestWrapper; - -/** -* -* HTMLTagFilterRequestWrapper -* @author 공통컴포넌트 팀 신용호 -* @since 2018.03.21 -* @version 1.0 -* @see -* -* 
-* << 개정이력(Modification Information) >>
-*
-*   수정일              수정자              수정내용
-*  -------      --------    ---------------------------
-*   2018.03.21  신용호              getParameterMap()구현 추가
-*   2019.01.31  신용호              whiteList 태그 추가
-*
-*/
-
-public class HTMLTagFilterRequestWrapper extends HttpServletRequestWrapper {
-
-	// Tag 화이트 리스트 ( 허용할 태그 등록 )
-	static private String[] whiteListTag = { "
","
","
" };
-	
-	public HTMLTagFilterRequestWrapper(HttpServletRequest request) {
-		super(request);
-	}
-
-	public String[] getParameterValues(String parameter) {
-
-		String[] values = super.getParameterValues(parameter);
-		
-		if(values==null){
-			return null;			
-		}
-		
-		for (int i = 0; i < values.length; i++) {
-			if (values[i] != null) {
-				values[i] = getSafeParamData(values[i]);
-				//System.out.println( "[HTMLTagFilter getParameterValues] "+ parameter + "===>>>"+values[i] );
-			} else {
-				values[i] = null;
-			}
-		}
-
-		return values;
-	}
-
-	public String getParameter(String parameter) {
-		
-		String value = super.getParameter(parameter);
-		
-		if(value==null){
-			return null;
-		}
-		
-		value = getSafeParamData(value);
-		//System.out.println( "[HTMLTagFilter getParameter] "+ parameter + "===>>>"+value );
-		return value;
-	}
-
-	/**
-	 * Map으로 바인딩된 경우를 처리한다.
-	 *
-	 * @return  Map - String Type Key / String배열타입 값
-	 */
-    public Map getParameterMap() {
-    	Map valueMap = super.getParameterMap();
-
-    	String[] values;
-    	for( String key : valueMap.keySet() ){
-    		values = valueMap.get(key);
-
-    		for (int i = 0; i < values.length; i++) {			
-    			if (values[i] != null) {				
-    				values[i] = getSafeParamData(values[i]);
-    				//System.out.println( "[HTMLTagFilter getParameterMap] "+ key + "===>>>"+values[i] );
-    			} else {
-    				values[i] = null;
-    			}
-    		}
-    		
-            //System.out.println( String.format("키 : %s, 값 : %s", key, valueMap.get(key)) );
-        }
-
-    	return valueMap;
-    }
-    
-	private String getSafeParamData(String value) {
-		
-		/*
-		StringBuffer strBuff = new StringBuffer();
-
-		for (int i = 0; i < value.length(); i++) {
-			char c = value.charAt(i);
-			switch (c) {
-			case '<':
-				if ( checkNextWhiteListTag(i, value) == false )
-					strBuff.append("<");
-				else 
-					strBuff.append(c);
-				//System.out.println("checkNextWhiteListTag = "+checkNextWhiteListTag(i, value));
-				break;
-			case '>':
-				if ( checkPrevWhiteListTag(i, value) == false )
-					strBuff.append(">");
-				else 
-					strBuff.append(c);
-				//System.out.println("checkPrevWhiteListTag = "+checkPrevWhiteListTag(i, value));
-				break;
-			case '&':
-				strBuff.append("&");
-				break;
-			case '"':
-				strBuff.append(""");
-				break;
-			case '\'':
-				strBuff.append("'");
-				break;	
-			default:
-				strBuff.append(c);
-				break;
-			}
-		}
-		
-		value = strBuff.toString();
-		*/
-		
-		// SQL INJECTION 취약점 보완 
-		value = value.replaceAll("\\s+[o|O][r|R]\\s+", " o-r ");
-		value = value.replaceAll("\\s+[a|A][n|N][d|D]\\s+", " a-n-d ");
-		
-		return value;
-	}
-	
-	private boolean checkNextWhiteListTag(int index, String data) {
-		String extractData = "";
-		//int beginIndex = 0;
-		int endIndex = 0;
-		for(String whiteListData: whiteListTag) {
-		    //System.out.println("===>>> whiteListData="+whiteListData);
-			endIndex = index+whiteListData.length();
-		    if ( data.length() > endIndex )
-		    	extractData = data.substring(index, endIndex);
-		    else
-		    	extractData = "";
-		    //System.out.println("extractData="+extractData);
-		    if ( whiteListData.equals(extractData) ) return true; // whiteList 대상으로 판정
-		}
-		
-		return false;
-	}
-	
-	private boolean checkPrevWhiteListTag(int index, String data) {
-		String extractData = "";
-		int beginIndex = 0;
-		int endIndex = 0;
-		for(String whiteListData: whiteListTag) {
-		    //System.out.println("===>>> whiteListData="+whiteListData);
-			beginIndex = index-whiteListData.length()+1;
-			endIndex = index+1;
-		    //System.out.println("  range ["+beginIndex+" ~ "+endIndex+"]");
-		    if ( beginIndex >= 0 )
-		    	extractData = data.substring(beginIndex, endIndex);
-		    else
-		    	extractData = "";
-		    //System.out.println("extractData="+extractData);
-		    if ( whiteListData.equals(extractData) ) return true; // whiteList 대상으로 판정
-		}
-		
-		return false;
-	}
-
-}
\ No newline at end of file
diff --git a/src/main/java/nlib/bbs/service/ArticleVO.java b/src/main/java/nlib/bbs/service/ArticleVO.java
index cd8b8cb3..cf39686c 100644
--- a/src/main/java/nlib/bbs/service/ArticleVO.java
+++ b/src/main/java/nlib/bbs/service/ArticleVO.java
@@ -83,28 +83,31 @@ public class ArticleVO extends PagingVO {
 		return articleId;
 	}
 	public void setArticleId(String articleId) {
-		this.articleId = StringUtil.getSafeParamData(articleId);
+		// 쿼리 조건으로 사용되는 항목에 대하여 SQL 인젝션으로 처리될만한 문자 강체 치환 처리 
+		this.articleId = StringUtil.getValidCodeString(articleId);
 	}
 	public String getMngOrgCd() {
 		return mngOrgCd;
 	}
 	public void setMngOrgCd(String mngOrgCd) {
-		this.mngOrgCd = StringUtil.getSafeParamData(mngOrgCd);
+		// 쿼리 조건으로 사용되는 항목에 대하여 SQL 인젝션으로 처리될만한 문자 강체 치환 처리 
+		this.mngOrgCd = StringUtil.getValidCodeString(mngOrgCd);
 	}
 	public String getBdType() {
 		return bdType;
 	}
 	public void setBdType(String bdType) {
-		this.bdType = StringUtil.getSafeParamData(bdType);
-	}
-	public String getTitle() {
-		return title;
+		this.bdType = bdType;
 	}
 	public String getUnescapeTitle() {
 		return StringEscapeUtils.unescapeHtml(title);
 	}
+	public String getTitle() {
+		return title;
+	}
+
 	public void setTitle(String title) {
-		this.title = StringUtil.getSafeParamData(title);
+		this.title = title;
 	}
 	public String getContent() {
 		return content;
@@ -116,25 +119,25 @@ public class ArticleVO extends PagingVO {
 		return notiYn;
 	}
 	public void setNotiYn(String notiYn) {
-		this.notiYn = StringUtil.getSafeParamData(notiYn);
+		this.notiYn = notiYn;
 	}
 	public String getOpenYn() {
 		return openYn;
 	}
 	public void setOpenYn(String openYn) {
-		this.openYn = StringUtil.getSafeParamData(openYn);
+		this.openYn = openYn;
 	}
 	public String getPostStartDate() {
 		return postStartDate;
 	}
 	public void setPostStartDate(String postStartDate) {
-		this.postStartDate = StringUtil.getSafeParamData(postStartDate);
+		this.postStartDate = postStartDate;
 	}
 	public String getPostEndDate() {
 		return postEndDate;
 	}
 	public void setPostEndDate(String postEndDate) {
-		this.postEndDate = StringUtil.getSafeParamData(postEndDate);
+		this.postEndDate = postEndDate;
 	}
 	public int getViewCnt() {
 		return viewCnt;
@@ -146,13 +149,13 @@ public class ArticleVO extends PagingVO {
 		return bdAttachFileId;
 	}
 	public void setBdAttachFileId(String bdAttachFileId) {
-		this.bdAttachFileId = StringUtil.getSafeParamData(bdAttachFileId);
+		this.bdAttachFileId = bdAttachFileId;
 	}
 	public String getRegId() {
 		return regId;
 	}
 	public void setRegId(String regId) {
-		this.regId = StringUtil.getSafeParamData(regId);
+		this.regId = regId;
 	}
 	public String getRegDd() {
 		return regDd;
@@ -192,7 +195,7 @@ public class ArticleVO extends PagingVO {
 		return searchType;
 	}
 	public void setSearchType(String searchType) {
-		this.searchType = StringUtil.getSafeParamData(searchType);
+		this.searchType = searchType;
 	}
 	public String getSearchKeyword() {
 		return searchKeyword;
@@ -201,7 +204,7 @@ public class ArticleVO extends PagingVO {
 		return StringUtil.getSqlSearchKeyword(searchKeyword);
 	}
 	public void setSearchKeyword(String searchKeyword) {
-		this.searchKeyword = StringUtil.getSafeParamData(searchKeyword);
+		this.searchKeyword = searchKeyword;
 	}
 	public String getAttachYn() {
 		return attachYn;
@@ -213,13 +216,13 @@ public class ArticleVO extends PagingVO {
 		return mngOrgNm;
 	}
 	public void setMngOrgNm(String mngOrgNm) {
-		this.mngOrgNm = StringUtil.getSafeParamData(mngOrgNm);
+		this.mngOrgNm = mngOrgNm;
 	}
 	public String getBdTypeName() {
 		return bdTypeName;
 	}
 	public void setBdTypeName(String bdTypeName) {
-		this.bdTypeName = StringUtil.getSafeParamData(bdTypeName);
+		this.bdTypeName = bdTypeName;
 	}
 	public List getAttachFiles() {
 		return attachFiles;
@@ -250,7 +253,7 @@ public class ArticleVO extends PagingVO {
 	}
 
 	public void setQuestionType(String questionType) {
-		this.questionType = StringUtil.getSafeParamData(questionType);
+		this.questionType = questionType;
 	}
 
 	public String getQuestionTypeName() {
@@ -258,7 +261,7 @@ public class ArticleVO extends PagingVO {
 	}
 
 	public void setQuestionTypeName(String questionTypeName) {
-		this.questionTypeName = StringUtil.getSafeParamData(questionTypeName);
+		this.questionTypeName = questionTypeName;
 	}
 
 	public String getAnswer() {
@@ -282,7 +285,8 @@ public class ArticleVO extends PagingVO {
 	}
 
 	public void setSearchMbInfoId(String searchMbInfoId) {
-		this.searchMbInfoId = StringUtil.getSafeParamData(searchMbInfoId);
+		// 쿼리 조건으로 사용되는 항목에 대하여 SQL 인젝션으로 처리될만한 문자 강체 치환 처리 
+		this.searchMbInfoId = StringUtil.getValidCodeString(searchMbInfoId);
 	}
 
 	public String getSecretYn() {
@@ -297,8 +301,9 @@ public class ArticleVO extends PagingVO {
 		return loginedMbInfoId;
 	}
 
-	public void setLoginedMbInfoId(String mbInfoId) {
-		this.loginedMbInfoId = mbInfoId;
+	public void setLoginedMbInfoId(String loginedMbInfoId) {
+		// 쿼리 조건으로 사용되는 항목에 대하여 SQL 인젝션으로 처리될만한 문자 강체 치환 처리 
+		this.loginedMbInfoId = StringUtil.getValidCodeString(loginedMbInfoId);
 	}
 
 	public String getMyQnaYn() {
diff --git a/src/main/java/nlib/util/StringUtil.java b/src/main/java/nlib/util/StringUtil.java
index 6a102bef..086c34e5 100644
--- a/src/main/java/nlib/util/StringUtil.java
+++ b/src/main/java/nlib/util/StringUtil.java
@@ -269,12 +269,29 @@ public class StringUtil extends StringUtils {
 
 		if(isNotEmpty(str)) {
 			String ret = str.replaceAll("\\%", "\\\\%");
-			return ret.replaceAll("_", "\\\\_");
+			ret = ret.replaceAll("_", "\\\\_");
+			ret = ret.replaceAll("'", "\\\\'");;
+			
+			return ret;
 	    }
 		
 		return str;
 	}
 	
+	public static String getValidCodeString(String str) {
+
+		if(isNotEmpty(str)) {
+			String ret = str.replaceAll("'", "");
+			ret = ret.replaceAll(" ", "");
+			ret = ret.replaceAll("\t", "");;
+			ret = ret.replaceAll("\n", "");;
+			ret = ret.replaceAll("\r", "");;
+			
+			return ret;
+	    }
+		
+		return str;
+	}
 
 	/**
 	 * 날짜 문자열(YYYYMMDD)을 받아서 화면 출력용 날짜 형식 문자열(YYYY-MM-DD)로 리턴한다. 
@@ -364,8 +381,8 @@ public class StringUtil extends StringUtils {
 					strBuff.append(c);
 				//System.out.println("checkPrevWhiteListTag = "+checkPrevWhiteListTag(i, value));
 				break;
-			case '&':
-				strBuff.append("&");
+			case ' ':
+				strBuff.append(" ");
 				break;
 			case '"':
 				strBuff.append(""");
@@ -380,7 +397,7 @@ public class StringUtil extends StringUtils {
 		}
 		
 		value = strBuff.toString();
-		
+
 		// SQL INJECTION 취약점 보완 
 		value = value.replaceAll("\\s+[o|O][r|R]\\s+", " o-r ");
 		value = value.replaceAll("\\s+[a|A][n|N][d|D]\\s+", " a-n-d ");
diff --git a/src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp b/src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp
index 4d77e0d6..48bce6e1 100644
--- a/src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp
+++ b/src/main/webapp/WEB-INF/jsp/nlib/bbs/insertQnaForm.jsp
@@ -61,7 +61,7 @@ var isModified = false;
 var oEditors = [];
 
 $(window.document).ready(function() {
-	fn_setPageTitle("");
+	fn_setPageTitle("");
 	
     if(!gfn_isEmpty('')) {
         alert("");
@@ -322,7 +322,7 @@ function fn_downloadFile(attachFileId, fileSn) {
                                             
  • 
                                                 
    제목 *
    
                                                 
    
-                                                    
+                                                    
                                                 
    
                                             
    • 
                                             
  • 
@@ -342,7 +342,7 @@ function fn_downloadFile(attachFileId, fileSn) {
                                             
  • 
                                                 
    내용 *
    
                                                 
    
-                                                    
+                                                    
                                                 
    
                                             
    • 
                                         
diff --git a/src/main/webapp/WEB-INF/jsp/nlib/bbs/listQnas.jsp b/src/main/webapp/WEB-INF/jsp/nlib/bbs/listQnas.jsp
index ba841f4a..c8858456 100644
--- a/src/main/webapp/WEB-INF/jsp/nlib/bbs/listQnas.jsp
+++ b/src/main/webapp/WEB-INF/jsp/nlib/bbs/listQnas.jsp
@@ -152,7 +152,7 @@
                  var li = $('');
                  li.append($('').attr('class', 't-num').html(obj.rno));   
                  li.append($('').attr('class', 't-tit').html("" +
-                         obj.unescapeTitle + 
+                         obj.title + 
                          (obj.secretYn == "Y" ? '자물쇠 아이콘 ' : '') +
                          ""));
                  li.append($('').attr('class', 't-writer').html(obj.regNmSec));
diff --git a/src/main/webapp/WEB-INF/jsp/nlib/bbs/selectAncmntArticle.jsp b/src/main/webapp/WEB-INF/jsp/nlib/bbs/selectAncmntArticle.jsp
index fe65de30..c11e4529 100644
--- a/src/main/webapp/WEB-INF/jsp/nlib/bbs/selectAncmntArticle.jsp
+++ b/src/main/webapp/WEB-INF/jsp/nlib/bbs/selectAncmntArticle.jsp
@@ -31,12 +31,12 @@
 <%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
 <%@ taglib prefix="validator" uri="http://www.springmodules.org/tags/commons-validator" %>
 
-
+공지사항 - 상세조회
 
 
diff --git a/src/main/webapp/WEB-INF/web.xml b/src/main/webapp/WEB-INF/web.xml
index 44335315..08830000 100644
--- a/src/main/webapp/WEB-INF/web.xml
+++ b/src/main/webapp/WEB-INF/web.xml
@@ -19,10 +19,10 @@
 		encodingFilter
 		*.do
 	
+	 
 	
 		HTMLTagFilter
-		egovframework.com.cmm.filter.HTMLTagFilter
-         
+        egovframework.rte.ptl.mvc.filter.HTMLTagFilter 
 	
 	
 		HTMLTagFilter