work/book-api
4
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

优化xss逻辑

This commit is contained in:
阿沐 2023-10-06 15:54:23 +08:00
parent ef861d48d6
commit 181a489908
1 changed files with 9 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
maku-framework/src/main/java/net/maku/framework/common/xss/XssUtils.java
View File

@ -1,8 +1,8 @@
package net.maku.framework.common.xss;
import cn.hutool.core.util.ReflectUtil;
import cn.hutool.http.HTMLFilter;
import org.jsoup.Jsoup;
import org.jsoup.nodes.Document;
import org.jsoup.safety.Safelist;
/**
* XSS 过滤工具类
@ -11,12 +11,10 @@ import cn.hutool.http.HTMLFilter;
* <a href="https://maku.net">MAKU</a>
*/
public class XssUtils {
private static final ThreadLocal<HTMLFilter> HTML_FILTER = ThreadLocal.withInitial(() -> {
HTMLFilter htmlFilter = new HTMLFilter();
// 避免 " 被转成 &quot; 字符
ReflectUtil.setFieldValue(htmlFilter, "encodeQuotes", false);
return htmlFilter;
});
/**
* 不格式化
*/
private final static Document.OutputSettings outputSettings = new Document.OutputSettings().prettyPrint(false);
/**
* XSS过滤
@ -25,7 +23,7 @@ public class XssUtils {
* @return 返回过滤后的内容
*/
public static String filter(String content) {
return HTML_FILTER.get().filter(content);
return Jsoup.clean(content, "", Safelist.relaxed(), outputSettings);
}
}