본문 바로가기

IT/Java

XSS 조치 방법(Remove the script)


public static String getRemoveScript(String strContent) {

Pattern patternTag = Pattern.compile("\\<(\\/?)(\\w+)*([^<>]*)>");

Pattern patternScript = Pattern.compile("(?i)\\<script(.*?)</script>");

Pattern patternMouseOver = Pattern

.compile("(?i) onmouseover=[\"']?([^>\"']+)[\"']*");

Pattern patternMouseOut = Pattern

.compile("(?i) onmouseout=[\"']?([^>\"']+)[\"']*");

Pattern patternMouseClick = Pattern

.compile("(?i) onclick=[\"']?([^>\"']+)[\"']*");

Pattern patternImgtag = Pattern

.compile("<img.+?src(.+?)&#[0-9]{2,7};(.+?)>");


Matcher matcherTag = patternTag.matcher(strContent);

strContent = matcherTag.replaceAll("");


Matcher matcherContent = patternScript.matcher(strContent);

strContent = matcherContent.replaceAll("");


Matcher matcherMouseOver = patternMouseOver.matcher(strContent);

strContent = matcherMouseOver.replaceAll("");


Matcher matcherMouseOut = patternMouseOut.matcher(strContent);

strContent = matcherMouseOut.replaceAll("");


Matcher matcherMouseClick = patternMouseClick.matcher(strContent);

strContent = matcherMouseClick.replaceAll("");

Matcher matcherImgtag = patternImgtag.matcher(strContent);

strContent = matcherImgtag.replaceAll("");


return strContent;

}