修复dom型xss漏洞的方式有以下几种
1.使用@InitBinder方法
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.WebDataBinder;
import org.springframework.web.bind.annotation.InitBinder;
@Controller
public class BaseController {
@InitBinder
public void webInitBinder(WebDataBinder binder){
binder.registerCustomEditor(String.class, new StringEditor());
}
}
public class StringEditor extends PropertyEditorSupport {
@Override
public void setAsText(String text) throws IllegalArgumentException {
if (StringUtils.isBlank(text)) {
return;
}
try {
//Spring自带html标签转义与反转义
super.setValue(HtmlUtils.htmlEscape(text));
} catch (Exception e) {
throw new IllegalArgumentException(e);
}
}
}
2.使用WebBindingInitializer方法
public class WebBinderInitializerUtils implements WebBindingInitializer{
@Override
public void initBinder(WebDataBinder binder, WebRequest request) {
binder.registerCustomEditor(String.class,new StringEditor());
}
}
public class StringEditor extends PropertyEditorSupport {
@Override
public void setAsText(String text) throws IllegalArgumentException {
if (StringUtils.isBlank(text)) {
return;
}
try {
//Spring自带html标签转义与反转义
super.setValue(HtmlUtils.htmlEscape(text));
} catch (Exception e) {
throw new IllegalArgumentException(e);
}
}
}
3.使用HttpOnly方法
response.setHeader("Set-Cookie", "cookiename=value;
Path=/;Domain=domainvalue;Max-Age=seconds;HTTPOnly");
辰迅云「云服务器」，即开即用、新一代英特尔至强铂金CPU、三副本存储NVMe SSD云盘，价格低至29元/月。点击查看>>
推荐阅读： dom型xss漏洞修复方式有哪些
云服务器
物理服务器
虚拟主机
跨境电商服务器