LiRuochen_WorkFlow/MaxKey
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update WebXssRequestFilter.java

Browse Source
This commit is contained in:
MaxKey
2021-03-25 23:13:15 +08:00
parent cd0ea06866
commit 900818e05f
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
maxkey-core/src/main/java/org/maxkey/web/WebXssRequestFilter.java
View File

@@ -27,10 +27,10 @@ public class WebXssRequestFilter extends GenericFilterBean {
String key = (String) parameterNames.nextElement();
String value = request.getParameter(key);
_logger.trace("parameter name "+key +" , value " + value);
String tempValue = value.toLowerCase().replace(" ", "");
String tempValue = value;
if(!StringEscapeUtils.escapeHtml4(tempValue).equals(value)
||tempValue.indexOf("script")>-1
||tempValue.indexOf("eval(")>-1) {
||tempValue.toLowerCase().indexOf("script")>-1
||tempValue.toLowerCase().replace(" ", "").indexOf("eval(")>-1) {
isWebXss = true;
_logger.error("parameter name "+key +" , value " + value
+ ", contains dangerous content ! ");