XSS 방어 도와주세요~~

Question

안녕하세요 이번에 처음으로.. 보안관련 이슈를 맡게됐는데요 처음이다보니 제가 부족한점이 많나 봅니다.일단 환경은 Rest api와 SpringBoot를 이용하고 있고요.XSS방지를 위한 필터링을 해야하는데 썩 먹히지가 않더라고요.그래서 혹시나 해서 질문 올립니다..!----------------------------1.pom.xml (추가 dependency) org.apache.commons commons-text 1.8 org.projectlombok lombok 1.18.8 provided 2.HTMLCharacterEscapes.java import com.fasterxml.jackson.core.SerializableString;import com.fasterxml.jackson.core.io.CharacterEscapes;import com.fasterxml.jackson.core.io.SerializedString;import org.apache.commons.lang3.text.translate.AggregateTranslator;import org.apache.commons.lang3.text.translate.CharSequenceTranslator;import org.apache.commons.lang3.text.translate.EntityArrays;import org.apache.commons.lang3.text.translate.LookupTranslator; public class HTMLCharacterEscapes extends CharacterEscapes { private final int[] asciiEscapes; private final CharSequenceTranslator translator; public HTMLCharacterEscapes() { // 1. XSS 방지 처리할 특수 문자 지정 asciiEscapes = CharacterEscapes.standardAsciiEscapesForJSON(); asciiEscapes['<'] = CharacterEscapes.ESCAPE_CUSTOM; asciiEscapes['>'] = CharacterEscapes.ESCAPE_CUSTOM; asciiEscapes['&'] = CharacterEscapes.ESCAPE_CUSTOM; asciiEscapes['\"'] = CharacterEscapes.ESCAPE_CUSTOM; asciiEscapes['('] = CharacterEscapes.ESCAPE_CUSTOM; asciiEscapes[')'] = CharacterEscapes.ESCAPE_CUSTOM; asciiEscapes['#'] = CharacterEscapes.ESCAPE_CUSTOM; asciiEscapes['\''] = CharacterEscapes.ESCAPE_CUSTOM; // 2. XSS 방지 처리 특수 문자 인코딩 값 지정 translator = new AggregateTranslator( new LookupTranslator(EntityArrays.BASIC_ESCAPE()), // <, >, &, " 는 여기에 포함됨 new LookupTranslator(EntityArrays.ISO8859_1_ESCAPE()), new LookupTranslator(EntityArrays.HTML40_EXTENDED_ESCAPE()), // 여기에서 커스터마이징 가능 new LookupTranslator( new String[][]{ {"(", "("}, {")", ")"}, {"#", "#"}, {"\'", "'"} } ) ); } @Override public int[] getEscapeCodesForAscii() { return asciiEscapes; } @Override public SerializableString getEscapeSequence(int ch) { return new SerializedString(translator.translate(Character.toString((char) ch))); }} 3.MessageConverter.java import java.util.List; import org.springframework.context.annotation.Bean;import org.springframework.http.converter.HttpMessageConverter;import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter; import com.fasterxml.jackson.databind.ObjectMapper; public class MessageConverter { @Bean public WebMvcConfigurerAdapter controlTowerWebConfigurerAdapter() { return new WebMvcConfigurerAdapter() { @Override public void configureMessageConverters(List> converters) { super.configureMessageConverters(converters); // 5. WebMvcConfigurerAdapter에 MessageConverter 추가 converters.add(htmlEscapingConveter()); } private HttpMessageConverter htmlEscapingConveter() { ObjectMapper objectMapper = new ObjectMapper(); // 3. ObjectMapper에 특수 문자 처리 기능 적용 objectMapper.getFactory().setCharacterEscapes(new HTMLCharacterEscapes()); // 4. MessageConverter에 ObjectMapper 설정 MappingJackson2HttpMessageConverter htmlEscapingConverter = new MappingJackson2HttpMessageConverter(); htmlEscapingConverter.setObjectMapper(objectMapper); return htmlEscapingConverter; } }; } } 4.WebMvcConfiguration.java import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter; import com.fasterxml.jackson.databind.ObjectMapper; import lombok.RequiredArgsConstructor; @RequiredArgsConstructor@Configurationpublic class WebMvcConfiuration { private final ObjectMapper objectMapper = new ObjectMapper(); @Bean public MappingJackson2HttpMessageConverter jsonEscapeConverter() { ObjectMapper copy = objectMapper.copy(); copy.getFactory().setCharacterEscapes(new HTMLCharacterEscapes()); return new MappingJackson2HttpMessageConverter(copy); }} -----------------------------------------------------------------------------코드는 뭐.. 대강 이렇습니다만.. 적용이 되질 않아서 고민입니다.제가 무엇을 놓치고 있는것 같긴한데.. 잘모르겠네요 ㅎㅎ..선배님들 부탁드립니다.!

39Song · Answer

전 Jsoup 쓰는데 편하더라구요

XSS 방어 도와주세요~~

1개의 답변

Q&A 목록