From 63773c97a56bdb3649510e83b66c16db4754965b Mon Sep 17 00:00:00 2001
From: thinkgem <thinkgem@163.com>
Date: Mon, 18 Aug 2025 23:06:15 +0800
Subject: [PATCH] =?UTF-8?q?=E5=AE=8C=E5=96=84xss=E8=BF=87=E6=BB=A4?=
 =?UTF-8?q?=E8=A1=A8=E8=BE=BE=E5=BC=8F=EF=BC=8C=E9=81=BF=E5=85=8D=E5=87=BA?=
 =?UTF-8?q?=E7=8E=B0data:?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 common/src/main/java/com/jeesite/common/codec/EncodeUtils.java  | 2 +-
 .../src/test/java/com/jeesite/test/codec/EncodeUtilsTest.java   | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/common/src/main/java/com/jeesite/common/codec/EncodeUtils.java b/common/src/main/java/com/jeesite/common/codec/EncodeUtils.java
index 4d797e33..1c1efe62 100644
--- a/common/src/main/java/com/jeesite/common/codec/EncodeUtils.java
+++ b/common/src/main/java/com/jeesite/common/codec/EncodeUtils.java
@@ -191,7 +191,7 @@ public class EncodeUtils {
 	// 预编译XSS过滤正则表达式
 	private static final List<Pattern> xssPatterns = ListUtils.newArrayList(
 			Pattern.compile("(<\\s*(script|link|style|iframe)([\\s\\S]*?)(>|<\\/\\s*\\1\\s*>))|(</\\s*(script|link|style|iframe)\\s*>)", Pattern.CASE_INSENSITIVE),
-			Pattern.compile("\\s*(href|src)\\s*=\\s*(\"\\s*(javascript|vbscript):[^\"]+\"|'\\s*(javascript|vbscript):[^']+'|(javascript|vbscript):[^\\s]+)\\s*(?=>)", Pattern.CASE_INSENSITIVE),
+			Pattern.compile("\\s*(href|src)\\s*=\\s*(\"\\s*(javascript|vbscript|data):[^\"]+\"|'\\s*(javascript|vbscript|data):[^']+'|(javascript|vbscript|data):[^\\s]+)\\s*(?=>)", Pattern.CASE_INSENSITIVE),
 			Pattern.compile("\\s*/?\\s*on[a-zA-Z]+\\s*=\\s*(['\"]?)(.*?)\\1(?=\\s|>|/>)", Pattern.CASE_INSENSITIVE),
 			Pattern.compile("(eval\\((.*?)\\)|expression\\((.*?)\\))", Pattern.CASE_INSENSITIVE),
 			Pattern.compile("^(javascript:|vbscript:)", Pattern.CASE_INSENSITIVE)
diff --git a/common/src/test/java/com/jeesite/test/codec/EncodeUtilsTest.java b/common/src/test/java/com/jeesite/test/codec/EncodeUtilsTest.java
index 73039d3f..c0f48f66 100644
--- a/common/src/test/java/com/jeesite/test/codec/EncodeUtilsTest.java
+++ b/common/src/test/java/com/jeesite/test/codec/EncodeUtilsTest.java
@@ -41,6 +41,7 @@ public class EncodeUtilsTest {
 		xssFilter(i++, "<!--HTML-->你好 ?abc=def&hello=123&world={\"a\":1}我还在。");
 		xssFilter(i++, "<!--HTML-->你好 ?abc=def&hello=123&world={'a':1}我还在。");
 		xssFilter(i++, "<!--HTML-->\"><svg/ONLOAD=confirm(3) />");
+		xssFilter(i++, "<!--HTML-->XSS<embed src=\"data:text/html;base64,PHNjcmlwdD5hbGVydCg5KTwvc2NyaXB0Pgo=\">");
 		sqlFilter(i++, "你好 select * from xxx where abc=def and 1=1我还在。", "common");
 		sqlFilter(i++, "你好 insert into xxx values(1,2,3,4,5)我还在。", "common");
 		sqlFilter(i++, "你好 delete from xxx我还在。", "common");