From 6dabf0b731889a4cfea0c5fad55079fbb272d224 Mon Sep 17 00:00:00 2001
From: JIWOO <dlwldn1024@iten.co.kr>
Date: Tue, 20 Aug 2024 17:14:09 +0900
Subject: [PATCH] =?UTF-8?q?=EC=9D=B4=EC=A7=80=EC=9A=B0=20-=20=EC=9B=B9=20?=
 =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20>=20=EC=84=B1=EC=9D=B8=20?=
 =?UTF-8?q?=EA=B5=90=EC=9C=A1=20=EB=93=B1=EB=A1=9D=20=EC=8B=9C=20XXS=20?=
 =?UTF-8?q?=EB=B0=A9=EC=A7=80=20=EC=B6=94=EA=B0=80,=20web.xml=20=EB=82=B4?=
 =?UTF-8?q?=20=EC=97=90=EB=9F=AC=20=ED=8E=98=EC=9D=B4=EC=A7=80=20=EC=A2=85?=
 =?UTF-8?q?=EB=A5=98=20=EC=A3=BC=EA=B0=80,=20=EC=A3=BC=EC=84=9D=20iframe?=
 =?UTF-8?q?=20=EC=82=AD=EC=A0=9C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../eduAplct/web/EduAplctAdultController.java | 40 ++++++++++++++++++-
 .../cpyrgExprnClsrm/oprtnAplctAnncmMngReg.jsp | 17 --------
 .../oprtnAplctAnncmMngUpdate.jsp              | 18 ---------
 src/main/webapp/WEB-INF/web.xml               | 16 ++++++++
 4 files changed, 55 insertions(+), 36 deletions(-)

diff --git a/src/main/java/kcc/ve/aplct/adultVisitEdu/eduAplct/web/EduAplctAdultController.java b/src/main/java/kcc/ve/aplct/adultVisitEdu/eduAplct/web/EduAplctAdultController.java
index aecfd432..425f3bcf 100644
--- a/src/main/java/kcc/ve/aplct/adultVisitEdu/eduAplct/web/EduAplctAdultController.java
+++ b/src/main/java/kcc/ve/aplct/adultVisitEdu/eduAplct/web/EduAplctAdultController.java
@@ -235,7 +235,10 @@ public class EduAplctAdultController {
         
 		//로그인 처리====================================
 		//로그인 정보 가져오기
-		
+        
+		/*240820 XSS 취약점 조치*/
+    	vEEduAplctVO.setJobNm(unscript(vEEduAplctVO.getJobNm()));
+    	
         String s_userCheckNInfo = checkLoginUtil.userCheckNInfo(model, request);
 		if (!"".equals(s_userCheckNInfo))	{
 			modelAndView.addObject("result", "loginFail");
@@ -558,4 +561,39 @@ public class EduAplctAdultController {
     	
     	return p_paginationInfo;
     }
+    
+	/**
+	 * XSS 방지 처리.
+	 *
+	 * @param data
+	 * @return
+	 */
+	protected String unscript(String data) {
+		if (data == null || data.trim().equals("")) {
+			return "";
+		}
+
+		String ret = data;
+
+		ret = ret.replaceAll("<(S|s)(C|c)(R|r)(I|i)(P|p)(T|t)", "&lt;script");
+		ret = ret.replaceAll("</(S|s)(C|c)(R|r)(I|i)(P|p)(T|t)", "&lt;/script");
+
+		ret = ret.replaceAll("<(O|o)(B|b)(J|j)(E|e)(C|c)(T|t)", "&lt;object");
+		ret = ret.replaceAll("</(O|o)(B|b)(J|j)(E|e)(C|c)(T|t)", "&lt;/object");
+
+		ret = ret.replaceAll("<(A|a)(P|p)(P|p)(L|l)(E|e)(T|t)", "&lt;applet");
+		ret = ret.replaceAll("</(A|a)(P|p)(P|p)(L|l)(E|e)(T|t)", "&lt;/applet");
+
+		ret = ret.replaceAll("<(E|e)(M|m)(B|b)(E|e)(D|d)", "&lt;embed");
+		ret = ret.replaceAll("</(E|e)(M|m)(B|b)(E|e)(D|d)", "&lt;embed");
+
+		ret = ret.replaceAll("<(F|f)(O|o)(R|r)(M|m)", "&lt;form");
+		ret = ret.replaceAll("</(F|f)(O|o)(R|r)(M|m)", "&lt;form");
+
+		//ret = ret.replaceAll("<", "&lt;");
+		ret = ret.replaceAll("alert", "");
+		//ret = ret.replaceAll("iframe", "");
+		
+		return ret;
+	}
 }
diff --git a/src/main/webapp/WEB-INF/jsp/oprtn/cpyrgExprnClsrm/oprtnAplctAnncmMngReg.jsp b/src/main/webapp/WEB-INF/jsp/oprtn/cpyrgExprnClsrm/oprtnAplctAnncmMngReg.jsp
index fc3e4ce0..4ce03271 100644
--- a/src/main/webapp/WEB-INF/jsp/oprtn/cpyrgExprnClsrm/oprtnAplctAnncmMngReg.jsp
+++ b/src/main/webapp/WEB-INF/jsp/oprtn/cpyrgExprnClsrm/oprtnAplctAnncmMngReg.jsp
@@ -488,23 +488,6 @@
 										</div>
 								</div>
 							</div>
-	                        <%-- <div id="sel_date" class="sel_date">
-	                            <input type="text" class="startDate inp" title="검색시작일" id="startDate01" name="strtPnttm" onclick="return calendarOpen('startDate01-lry','',this)" value="${vEPrcsDetailVO.endPnttm}" data-datecontrol="true" readonly>
-	                            <div class="calendar_in" id="calendarName_startDate" style="z-index: 9;">
-	                                <button type="button" value="달력 팝업 열기" onclick="return calendarOpen('startDate01-lry','',this)" class="btn_cal"></button>
-	                                <div id="startDate01-lry" class="calendarPop" style="display: none;">
-	                                    <iframe id="startDate01-ifrm" name="startDate01-ifrm" class="calendar-frame" src="/kccadrPb/adm/calendar.html" title=" 달력 팝업" frameborder="0" scrolling="no"></iframe>
-	                                </div>
-	                            </div> ~
-	                            <input type="text" class="endDate inp" title="검색시작일" id="endDate" name="endPnttm" onclick="return calendarOpen('endDate-lry','',this)" value="${vEPrcsDetailVO.endPnttm}" data-datecontrol="true" readonly>
-	                            <div class="calendar_in" id="calendarName_endDate" style="z-index: 9;">
-	                                <button type="button" value="달력 팝업 열기" onclick="return calendarOpen('endDate-lry','',this)" class="btn_cal" ></button>
-	                                <div id="endDate-lry" class="calendarPop" style="display: none;">
-	                                    <iframe id="endDate-ifrm" name="endDate-ifrm" class="calendar-frame" src="/kccadrPb/adm/calendar.html"title=" 달력 팝업" frameborder="0" scrolling="no"></iframe>
-	                                </div>
-	                            </div>
-	                        </div> --%>
-	                        
 						</td>
 					</tr>
 
diff --git a/src/main/webapp/WEB-INF/jsp/oprtn/cpyrgExprnClsrm/oprtnAplctAnncmMngUpdate.jsp b/src/main/webapp/WEB-INF/jsp/oprtn/cpyrgExprnClsrm/oprtnAplctAnncmMngUpdate.jsp
index 26c5114e..272704c5 100644
--- a/src/main/webapp/WEB-INF/jsp/oprtn/cpyrgExprnClsrm/oprtnAplctAnncmMngUpdate.jsp
+++ b/src/main/webapp/WEB-INF/jsp/oprtn/cpyrgExprnClsrm/oprtnAplctAnncmMngUpdate.jsp
@@ -476,24 +476,6 @@
 										</div>
 								</div>
 							</div>
-	                        <%-- <div id="sel_date" class="sel_date">
-								<fmt:parseDate value='${info.strtPnttm}' var='strtPnttmDe' pattern="yyMMddHHmmss" scope="page" />
-								<fmt:parseDate value='${info.endPnttm}' var='endPnttmDe' pattern="yyMMddHHmmss" scope="page" />
-	                            <input type="text" value="<fmt:formatDate value="${strtPnttmDe}" pattern="yyyy-MM-dd"/>" class="startDate inp" title="검색시작일" id="startDate01" name="strtPnttm" onclick="return calendarOpen('startDate01-lry','',this)" value="${vEPrcsDetailVO.endPnttm}" data-datecontrol="true" readonly>
-	                            <div class="calendar_in" id="calendarName_startDate" style="z-index: 9;">
-	                                <button type="button" value="달력 팝업 열기" onclick="return calendarOpen('startDate01-lry','',this)" class="btn_cal"></button>
-	                                <div id="startDate01-lry" class="calendarPop" style="display: none;">
-	                                    <iframe id="startDate01-ifrm" name="startDate01-ifrm" class="calendar-frame" src="/kccadrPb/adm/calendar.html" title=" 달력 팝업" frameborder="0" scrolling="no"></iframe>
-	                                </div>
-	                            </div> ~
-	                            <input type="text" value="<fmt:formatDate value="${endPnttmDe}" pattern="yyyy-MM-dd"/>" class="endDate inp" title="검색시작일" id="endDate" name="endPnttm" onclick="return calendarOpen('endDate-lry','',this)" value="${vEPrcsDetailVO.endPnttm}" data-datecontrol="true" readonly>
-	                            <div class="calendar_in" id="calendarName_endDate" style="z-index: 9;">
-	                                <button type="button" value="달력 팝업 열기" onclick="return calendarOpen('endDate-lry','',this)" class="btn_cal" ></button>
-	                                <div id="endDate-lry" class="calendarPop" style="display: none;">
-	                                    <iframe id="endDate-ifrm" name="endDate-ifrm" class="calendar-frame" src="/kccadrPb/adm/calendar.html"title=" 달력 팝업" frameborder="0" scrolling="no"></iframe>
-	                                </div>
-	                            </div>
-	                        </div> --%>
 						</td>
 					</tr>
 
diff --git a/src/main/webapp/WEB-INF/web.xml b/src/main/webapp/WEB-INF/web.xml
index 9284d07b..1195ab09 100644
--- a/src/main/webapp/WEB-INF/web.xml
+++ b/src/main/webapp/WEB-INF/web.xml
@@ -131,10 +131,26 @@
         <exception-type>java.lang.Throwable</exception-type>
         <location>/common/error.jsp</location>
     </error-page>
+    <error-page>
+        <error-code>400</error-code>
+        <location>/common/error.jsp</location>
+    </error-page>
+    <error-page>
+        <error-code>401</error-code>
+        <location>/common/error.jsp</location>
+    </error-page>
+    <error-page>
+        <error-code>403</error-code>
+        <location>/common/error.jsp</location>
+    </error-page>
     <error-page>
         <error-code>404</error-code>
         <location>/common/error.jsp</location>
     </error-page>
+    <error-page>
+        <error-code>405</error-code>
+        <location>/common/error.jsp</location>
+    </error-page>
     <error-page>
         <error-code>500</error-code>
         <location>/common/error.jsp</location>