XSS ( Cross Site Scripting ) 제거 하기 ( 필터링 )

XSS ( Cross Site Scripting ) 제거 하기

- 문자열을 아래와 같은 변환을 통해서, 불필요한 script를 제거 한다. ( 때로는 escape된 문자열를 변환후에 제거하는 과정도 필요하다. )

1. HTML Sanitizer Project

https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project

1) 다운로드

(1) owasp-java-html-sanitizer.jar

https://search.maven.org/#search%7Cga%7C1%7Cowasp%20html%20sanitizer

(2) Dependency jar

https://github.com/owasp/java-html-sanitizer

- guava : lib/guava-libraries/guava.jar

- JSR305 : lib/jsr305/jsr305.jar

2)  코드 작성

// prepackaged policies
String untrustedHTML="<script>alert()</script>";
PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
String safeHTML = policy.sanitize(untrustedHTML);

2. Jsoup

1) 다운로드 jsoup-1.10.2.jar

https://jsoup.org/download

2) 코드작성

String unsafe =   "<p><a onclick="stealCookies()" href="http://example.com/">Link</a></p>";
String safe = Jsoup.clean(unsafe, Whitelist.basic());
// now: <p><a href="http://example.com/" rel="nofollow">Link</a></p>

* UnescapeHtml() - Class StringEscapeUtils - commons.apache.org

:  Unescapes a string containing XML entity escapes to a string containing the actual Unicode characters corresponding to the escapes