whyclxw
2024-04-28 b25b814a949d2065a61fd3167206ffb51a57af65
src/main/java/com/whyc/filter/XssHttpServletRequestWrapper.java
@@ -136,7 +136,7 @@
            value = ESAPI.encoder().canonicalize(value);
            // 避免空字符串
            value = value.replaceAll(" ", "");
            //value = value.replaceAll(" ", "");
            // 删除 '
            value = value.replaceAll("'","");
@@ -180,8 +180,8 @@
            value = scriptPattern.matcher(value).replaceAll("");
            // 避免 onXX= 表达式
            scriptPattern = compile("on.*(.*?)=", CASE_INSENSITIVE | MULTILINE | DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
            /*scriptPattern = compile("on.*(.*?)=", CASE_INSENSITIVE | MULTILINE | DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");*/
        }
        return value;