diff --git a/src/main/java/kcc/ve/aplct/adultVisitEdu/eduAplct/web/EduAplctAdultController.java b/src/main/java/kcc/ve/aplct/adultVisitEdu/eduAplct/web/EduAplctAdultController.java index aecfd432..425f3bcf 100644 --- a/src/main/java/kcc/ve/aplct/adultVisitEdu/eduAplct/web/EduAplctAdultController.java +++ b/src/main/java/kcc/ve/aplct/adultVisitEdu/eduAplct/web/EduAplctAdultController.java @@ -235,7 +235,10 @@ public class EduAplctAdultController { //로그인 처리==================================== //로그인 정보 가져오기 - + + /*240820 XSS 취약점 조치*/ + vEEduAplctVO.setJobNm(unscript(vEEduAplctVO.getJobNm())); + String s_userCheckNInfo = checkLoginUtil.userCheckNInfo(model, request); if (!"".equals(s_userCheckNInfo)) { modelAndView.addObject("result", "loginFail"); @@ -558,4 +561,39 @@ public class EduAplctAdultController { return p_paginationInfo; } + + /** + * XSS 방지 처리. + * + * @param data + * @return + */ + protected String unscript(String data) { + if (data == null || data.trim().equals("")) { + return ""; + } + + String ret = data; + + ret = ret.replaceAll("<(S|s)(C|c)(R|r)(I|i)(P|p)(T|t)", "<script"); + ret = ret.replaceAll("(S|s)(C|c)(R|r)(I|i)(P|p)(T|t)", "</script"); + + ret = ret.replaceAll("<(O|o)(B|b)(J|j)(E|e)(C|c)(T|t)", "<object"); + ret = ret.replaceAll("(O|o)(B|b)(J|j)(E|e)(C|c)(T|t)", "</object"); + + ret = ret.replaceAll("<(A|a)(P|p)(P|p)(L|l)(E|e)(T|t)", "<applet"); + ret = ret.replaceAll("(A|a)(P|p)(P|p)(L|l)(E|e)(T|t)", "</applet"); + + ret = ret.replaceAll("<(E|e)(M|m)(B|b)(E|e)(D|d)", "<embed"); + ret = ret.replaceAll("(E|e)(M|m)(B|b)(E|e)(D|d)", "<embed"); + + ret = ret.replaceAll("<(F|f)(O|o)(R|r)(M|m)", "<form"); + ret = ret.replaceAll("(F|f)(O|o)(R|r)(M|m)", "<form"); + + //ret = ret.replaceAll("<", "<"); + ret = ret.replaceAll("alert", ""); + //ret = ret.replaceAll("iframe", ""); + + return ret; + } } diff --git a/src/main/webapp/WEB-INF/jsp/oprtn/cpyrgExprnClsrm/oprtnAplctAnncmMngReg.jsp b/src/main/webapp/WEB-INF/jsp/oprtn/cpyrgExprnClsrm/oprtnAplctAnncmMngReg.jsp index fc3e4ce0..4ce03271 100644 --- a/src/main/webapp/WEB-INF/jsp/oprtn/cpyrgExprnClsrm/oprtnAplctAnncmMngReg.jsp +++ b/src/main/webapp/WEB-INF/jsp/oprtn/cpyrgExprnClsrm/oprtnAplctAnncmMngReg.jsp @@ -488,23 +488,6 @@ - <%--