Merge branch 'master' of http://docs.nculture.org:30000/nculture/iams.nlib

pom.xml

@@ -386,6 +386,13 @@
 		    <version>3.3.2</version>
 		</dependency>
 		
+		<!-- OWASP HTML Sanitizer -->
+        <dependency>
+            <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
+            <artifactId>owasp-java-html-sanitizer</artifactId>
+            <version>20211018.2</version>
+        </dependency>
+        
     </dependencies>
 
     <build>

src/main/java/nlib/cmm/fileupload/FileUploadController.java

@@ -71,11 +71,6 @@ public class FileUploadController extends NlibCommonController {
 	 */
 	private String FILEUPLOAD_BASE_PATH = NlibProperty.getProperty("fileupload.base.path");
 	
-	/**
-	 * 첨부파일 임시 저장 위치 
-	 */
-	private String FILEUPLOAD_TEMP_SUBPATH = NlibProperty.getProperty("fileupload.temp.subpath");
-
 	/**
 	 * 경로 부적합 오류 메시지 
 	 */

src/main/java/nlib/util/StringUtil.java

@@ -13,6 +13,8 @@ import java.util.Base64.Encoder;
 import java.util.Locale;
 
 import org.apache.commons.lang3.StringUtils;
+import org.owasp.html.HtmlPolicyBuilder;
+import org.owasp.html.PolicyFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -383,6 +385,33 @@ public class StringUtil extends StringUtils {
 		return value;
 	}
 	
+	/**
+	 * XSS 등의 공격으로 부터 보안성 유지를 위해서 HTML 허용된 태그와 속성만으로 HTML을 재구성하여 리턴한다.
+	 * 
+	 * @param html
+	 * @return
+	 */
+	private static String sanitizeHtml(String html) {
+
+    	PolicyFactory policy = new HtmlPolicyBuilder()
+    			  .allowAttributes("src", "align", "title").onElements("img")
+      			  .allowAttributes("href", "title").onElements("a")
+      			  .allowAttributes("class", "height", "width", "style").globally()
+      			  .allowUrlProtocols("http","https","mailto","tel")
+      			  .allowElements(
+      			    "a", "label", 
+      			    "h1", "h2", "h3", "h4", "h5", "h6",
+      			    "p", "i", "b", "u", "strong", "em", "small", "big", "pre", "code",
+      			    "cite", "samp", "sub", "sup", "strike", "center", "blockquote",
+      			    "hr", "br", "col", "font", "span", "div", "img",
+      			    "ul", "ol", "li", "dd", "dt", "dl", "tbody", "thead", "tfoot",
+      			    "table", "td", "th", "tr", "colgroup", "fieldset", "legend"
+      			  )
+      			  .toFactory();
+    	
+    	return policy.sanitize(html);
+	}
+	
 	// Tag 화이트 리스트 ( 허용할 태그 등록 )
 	static String[] whiteListTag = { "<p>","</p>","<br />" };
 		

src/main/resources/nlib/nlib.properties

@@ -108,6 +108,9 @@ fileupload.base.path = /nfs_nas_dev/uac/nlib
 # \uc6b4\uc601\uc11c\ubc84 
 #fileupload.base.path = /nfs_nas/uac/nlib
 
+# \ubb3b\uace0\ub2f5\ud558\uae30 \uac8c\uc2dc\ud310 \uc11c\ube0c\uc704\uce58 : \ucca8\ubd80\ud30c\uc77c \ucd5c\uc0c1\uc704 \uc704\uce58 \uc774\ud558\uc758 \uc704\uce58 \uc815\ubcf4\ub97c \uc124\uc815 
+fileupload.bbs.qna.subpath = /qna
+
 # \ucd5c\ub300 \ud30c\uc77c \ud06c\uae30 (MB) 
 fileupload.max.mbsize = 10
 # \ucd5c\ub300 \ud30c\uc77c \uac1c\uc218 
@@ -116,12 +119,6 @@ fileupload.max.files = 5
 fileupload.acceptable.ext = .jpg,.jpe,.jpge,.bmp,.gif,.png,.hwp,.hwpx,.pdf,.xls,.xlsx,.ppt,.pptx,.doc,.docx,.txt             
 
 
-# \uc784\uc2dc \uc800\uc7a5 \uc704\uce58 
-fileupload.temp.subpath = /temp
-
-# \ubb3b\uace0\ub2f5\ud558\uae30 \uac8c\uc2dc\ud310 \uc11c\ube0c\uc704\uce58 : \ucca8\ubd80\ud30c\uc77c \ucd5c\uc0c1\uc704 \uc704\uce58 \uc774\ud558\uc758 \uc704\uce58 \uc815\ubcf4\ub97c \uc124\uc815 
-fileupload.bbs.qna.subpath = /qna
-
 #----------------------------------------
 # \uc774\uba54\uc77c \ud15c\ud50c\ub9bf \uacbd\ub85c
 #----------------------------------------