diff --git a/common/src/main/java/com/jeesite/common/codec/EncodeUtils.java b/common/src/main/java/com/jeesite/common/codec/EncodeUtils.java index fb13350b..8f69f0f1 100644 --- a/common/src/main/java/com/jeesite/common/codec/EncodeUtils.java +++ b/common/src/main/java/com/jeesite/common/codec/EncodeUtils.java @@ -192,7 +192,7 @@ public class EncodeUtils { private static final List xssPatterns = ListUtils.newArrayList( Pattern.compile("(<\\s*(script|link|style|iframe)([\\s\\S]*?)(>|<\\/\\s*\\1\\s*>))|()", Pattern.CASE_INSENSITIVE), Pattern.compile("\\s*(href|src)\\s*=\\s*(\"\\s*(javascript|vbscript):[^\"]+\"|'\\s*(javascript|vbscript):[^']+'|(javascript|vbscript):[^\\s]+)\\s*(?=>)", Pattern.CASE_INSENSITIVE), - Pattern.compile("\\s*on[a-z]+\\s*=\\s*(\"[^\"]+\"|'[^']+'|[^\\s]+)\\s*(?=>)", Pattern.CASE_INSENSITIVE), + Pattern.compile("\\s*/?\\s*on[a-zA-Z]+\\s*=\\s*(['\"]?)(.*?)\\1(?=\\s|>|/>)", Pattern.CASE_INSENSITIVE), Pattern.compile("(eval\\((.*?)\\)|expression\\((.*?)\\))", Pattern.CASE_INSENSITIVE), Pattern.compile("^(javascript:|vbscript:)", Pattern.CASE_INSENSITIVE) ); diff --git a/common/src/test/java/com/jeesite/test/codec/EncodeUtilsTest.java b/common/src/test/java/com/jeesite/test/codec/EncodeUtilsTest.java index de24d4f0..73039d3f 100644 --- a/common/src/test/java/com/jeesite/test/codec/EncodeUtilsTest.java +++ b/common/src/test/java/com/jeesite/test/codec/EncodeUtilsTest.java @@ -14,37 +14,49 @@ import com.jeesite.common.codec.EncodeUtils; public class EncodeUtilsTest { public static void main(String[] args) { - EncodeUtils.xssFilter("1 你好 我还在。"); - EncodeUtils.xssFilter("2 你好 加粗文字我还在。"); - EncodeUtils.xssFilter("3 你好 \">加粗文字我还在。"); - EncodeUtils.xssFilter("4 你好 加粗文字我还在。"); - EncodeUtils.xssFilter("5 你好 我还在。"); - EncodeUtils.xssFilter("14 你好 eval(abc)我还在。"); - EncodeUtils.xssFilter("15 你好 expression(abc)我还在。"); - EncodeUtils.xssFilter("16 你好 我还在。"); - EncodeUtils.xssFilter("17 你好 我还在。"); - EncodeUtils.xssFilter("18 你好 我还在。"); - EncodeUtils.xssFilter("19 你好 hello我还在。"); - EncodeUtils.xssFilter("20 你好 hello我还在。"); - EncodeUtils.xssFilter("21 你好 hello我还在。"); - EncodeUtils.xssFilter("22 你好 hello我还在。"); - EncodeUtils.xssFilter("23 你好 hello我还在。"); - EncodeUtils.xssFilter("24 你好 ?abc=def&hello=123&world={\"a\":1}我还在。"); - EncodeUtils.xssFilter("25 你好 ?abc=def&hello=123&world={'a':1}我还在。"); - EncodeUtils.sqlFilter("1 你好 select * from xxx where abc=def and 1=1我还在。"); - EncodeUtils.sqlFilter("2 你好 insert into xxx values(1,2,3,4,5)我还在。"); - EncodeUtils.sqlFilter("3 你好 delete from xxx我还在。"); - EncodeUtils.sqlFilter("4 a.audit_result asc,case when 1 like case when length(database())=6 then 1 else exp(111) end then 1 else 1/0 end", "orderBy"); - EncodeUtils.sqlFilter("5 if(1=2,1,SLEEP(10)), if(mid(database(),{},1)=\\\"{}\\\",a.id,a.login_name)", "orderBy"); - EncodeUtils.sqlFilter("6 a.audit_result asc, b.audit_result2 desc, b.AuditResult3 desc", "orderBy"); + int i = 0; + xssFilter(i++, "你好 我还在。"); + xssFilter(i++, "你好 加粗文字我还在。"); + xssFilter(i++, "你好 \">加粗文字我还在。"); + xssFilter(i++, "你好 加粗文字我还在。"); + xssFilter(i++, "你好 我还在。"); + xssFilter(i++, "你好 eval(abc)我还在。"); + xssFilter(i++, "你好 expression(abc)我还在。"); + xssFilter(i++, "你好 我还在。"); + xssFilter(i++, "你好 我还在。"); + xssFilter(i++, "你好 我还在。"); + xssFilter(i++, "你好 hello我还在。"); + xssFilter(i++, "你好 hello我还在。"); + xssFilter(i++, "你好 hello我还在。"); + xssFilter(i++, "你好 hello我还在。"); + xssFilter(i++, "你好 hello我还在。"); + xssFilter(i++, "你好 ?abc=def&hello=123&world={\"a\":1}我还在。"); + xssFilter(i++, "你好 ?abc=def&hello=123&world={'a':1}我还在。"); + xssFilter(i++, "\">"); + sqlFilter(i++, "你好 select * from xxx where abc=def and 1=1我还在。", "common"); + sqlFilter(i++, "你好 insert into xxx values(1,2,3,4,5)我还在。", "common"); + sqlFilter(i++, "你好 delete from xxx我还在。", "common"); + sqlFilter(i++, "a.audit_result asc,case when 1 like case when length(database())=6 then 1 else exp(111) end then 1 else 1/0 end", "orderBy"); + sqlFilter(i++, "if(1=2,1,SLEEP(10)), if(mid(database(),{},1)=\\\"{}\\\",a.id,a.login_name)", "orderBy"); + sqlFilter(i++, "a.audit_result asc, b.audit_result2 desc, b.AuditResult3 desc", "orderBy"); + } + + private static void xssFilter(int num, String text) { + String text2 = EncodeUtils.xssFilter(text); + System.out.println(num + ". " + text + "\t ==> \t" + text2 + "\t ==> \t" + text.equals(text2)); + } + + private static void sqlFilter(int num, String text, String source) { + String text2 = EncodeUtils.sqlFilter(text, source); + System.out.println(num + ". " + text + "\t ==> \t" + text2 + "\t ==> \t" + text.equals(text2)); } } diff --git a/modules/core/src/main/resources/views/include/sysIndex/leftMenu.html b/modules/core/src/main/resources/views/include/sysIndex/leftMenu.html index 2935e61a..a56291f2 100644 --- a/modules/core/src/main/resources/views/include/sysIndex/leftMenu.html +++ b/modules/core/src/main/resources/views/include/sysIndex/leftMenu.html @@ -6,7 +6,7 @@
-

${user.userName}

+

${user.userName,xss}

${text('在线')} ${text('注销')}
diff --git a/modules/core/src/main/resources/views/include/sysIndex/topMenuUser.html b/modules/core/src/main/resources/views/include/sysIndex/topMenuUser.html index 6971c507..f55ecfd4 100644 --- a/modules/core/src/main/resources/views/include/sysIndex/topMenuUser.html +++ b/modules/core/src/main/resources/views/include/sysIndex/topMenuUser.html @@ -1,7 +1,7 @@
  • - +