60 lines
1.7 KiB
Java
60 lines
1.7 KiB
Java
package com.interplug.qcast.config.json;
|
|
|
|
import com.fasterxml.jackson.core.SerializableString;
|
|
import com.fasterxml.jackson.core.io.CharacterEscapes;
|
|
import com.fasterxml.jackson.core.io.SerializedString;
|
|
import org.apache.commons.lang3.StringEscapeUtils;
|
|
|
|
/**
|
|
* <pre>
|
|
* xss 방어
|
|
*
|
|
* </pre>
|
|
*
|
|
* @author KimYoungHyun (youngh.kim@kt.com)
|
|
*/
|
|
public class HtmlCharacterEscapes extends CharacterEscapes {
|
|
|
|
private static final long serialVersionUID = 2432838078852295950L;
|
|
private final int[] asciiEscapes;
|
|
|
|
/**
|
|
* xss 방지를 위해 escape 처리
|
|
*/
|
|
public HtmlCharacterEscapes() {
|
|
asciiEscapes = CharacterEscapes.standardAsciiEscapesForJSON();
|
|
asciiEscapes['<'] = CharacterEscapes.ESCAPE_CUSTOM;
|
|
asciiEscapes['>'] = CharacterEscapes.ESCAPE_CUSTOM;
|
|
asciiEscapes['&'] = CharacterEscapes.ESCAPE_CUSTOM;
|
|
asciiEscapes['\''] = CharacterEscapes.ESCAPE_CUSTOM;
|
|
asciiEscapes['\"'] = CharacterEscapes.ESCAPE_CUSTOM;
|
|
asciiEscapes['('] = CharacterEscapes.ESCAPE_CUSTOM;
|
|
asciiEscapes[')'] = CharacterEscapes.ESCAPE_CUSTOM;
|
|
asciiEscapes['#'] = CharacterEscapes.ESCAPE_CUSTOM;
|
|
}
|
|
|
|
@Override
|
|
public int[] getEscapeCodesForAscii() {
|
|
return asciiEscapes;
|
|
}
|
|
|
|
@Override
|
|
public SerializableString getEscapeSequence(int ch) {
|
|
SerializedString serializedString = null;
|
|
char charAt = (char) ch;
|
|
|
|
// emoji(Emoticons) character
|
|
if (Character.isHighSurrogate(charAt) || Character.isLowSurrogate(charAt)) {
|
|
StringBuilder sb = new StringBuilder();
|
|
sb.append("\\u");
|
|
sb.append(String.format("%04x", ch));
|
|
serializedString = new SerializedString(sb.toString());
|
|
} else {
|
|
serializedString = new SerializedString(StringEscapeUtils.escapeHtml4(Character.toString(charAt)));
|
|
}
|
|
|
|
return serializedString;
|
|
}
|
|
|
|
}
|