content: package com.admin4j.framework.xss.converter;
  
   
  import com.admin4j.framework.xss.utils.XssUtils;
  import com.fasterxml.jackson.core.JsonParser;
  import com.fasterxml.jackson.core.JsonProcessingException;
  import com.fasterxml.jackson.core.JsonToken;
  import com.fasterxml.jackson.databind.DeserializationContext;
  import com.fasterxml.jackson.databind.JsonDeserializer;
  
  import java.io.IOException;
  import java.util.ArrayList;
  import java.util.List;
  
  /**
   * 过滤跨站脚本的 反序列化工具
   *
   * @author andanyang
   * @since 2021/10/22 16:38
   */
  public class XssStringJsonDeserializer extends JsonDeserializer<String> {
      @Override
      public String deserialize(JsonParser p, DeserializationContext dc) throws IOException, JsonProcessingException {
          if (p.hasToken(JsonToken.VALUE_STRING)) {
              String value = p.getValueAsString();
  
              if (value == null || "".equals(value)) {
                  return value;
              }
  
              List<String> list = new ArrayList<>();
              list.add("<script>");
              list.add("</script>");
              list.add("<iframe>");
              list.add("</iframe>");
              list.add("<noscript>");
              list.add("</noscript>");
              list.add("<frameset>");
              list.add("</frameset>");
              list.add("<frame>");
              list.add("</frame>");
              list.add("<noframes>");
              list.add("</noframes>");
              boolean flag = list.stream().anyMatch((item) -> value.contains(item));
              if (flag) {
                  return XssUtils.xssClean(value, null);
              }
              return value;
          }
          return null;
      }
  }