xss攻击的修复方案:对输入的数据进行html转义,使其不会识别为可执行脚本,例如:String result = HtmlUtils.htmlEscape(source);根据白名单的标签和属性对数据进行过滤
xss攻击的修复方案:
对输入的数据进行html转义,使其不会识别为可执行脚本,例如:
String result = HtmlUtils.htmlEscape(source);
根据白名单的标签和属性对数据进行过滤,对可执行的脚本进行清除,例如:
<!-- https://mvnrepository.com/artifact/org.jsoup/jsoup -->
<dependency>
<groupId>org.jsoup</groupId>
<artifactId>jsoup</artifactId>
<version>1.13.1</version>
</dependency>
String result = Jsoup.clean(source, Whitelist.basic());
//默认的基础白名单配置
public static Whitelistbasic(){
return new Whitelist()
.addTags(
"a","b","blockquote","br","cite","code","dd","dL","dt","em",
"i","Li","oL","p","pre","q","small","span","strike","strong","sub"
"sup","U","uL")
.addAttributes(tag:"a", ...attributes:"href")
.addAttributes(tag:”bLockquote", ...attributes:"cite")
.addAttributes(tag:"q", ...attritoutes:"cite")
.addProtocols(tag:"a", attribute:"href", ...potocols:"ftp", "Http", "https", "mailto")
.addProtocols(tag:"bLockquote", attribute:"cite", ...protocolo:"http", "https")
.addProtocols(tag:"cite",attribute:"cite", ...protocols:"http", "https")
.addEnforcedAttribute(tag:"a",attribute:"rel",value:"nofollow")
;
}
--结束END--
本文标题: xss攻击如何修复
本文链接: https://www.lsjlt.com/news/116159.html(转载时请注明来源链接)
有问题或投稿请发送至: 邮箱/279061341@qq.com QQ/279061341
下载Word文档到电脑,方便收藏和打印~
2024-04-27
2024-04-27
2024-04-27
2024-04-27
2024-04-27
2024-04-27
2024-04-27
2024-04-27
2024-04-27
2024-04-27
回答
回答
回答
回答
回答
回答
回答
回答
回答
回答
0