content: package net.laoyeye.yyblog.common.utils;
  
  import java.util.regex.Pattern;
  import static java.util.regex.Pattern.*;
  
  /**
   * 过滤注入的字符串
   * @author 小卖铺的老爷爷
   * @date 2018年1月10日
   * @website www.laoyeye.net
   */
  public final class Injection {
      /**
       * @param value 待处理内容
       * @return
       * @Description 过滤XSS脚本内容
       */
      public static String stripXSS(String value) {
          String rlt = null;
  
          if (null != value) {
              // NOTE: It's highly recommended to use the ESAPI library and uncomment the following line to
              // avoid encoded attacks.
              // value = ESAPI.encoder().canonicalize(value);
  
              // Avoid null characters
              rlt = value.replaceAll("", "");
  
              // Avoid anything between script tags
              Pattern scriptPattern = compile("<script>(.*?)</script>", CASE_INSENSITIVE);
              rlt = scriptPattern.matcher(rlt).replaceAll("");
  
              // Avoid anything in a src='...' type of expression
              /*scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE
                      | Pattern.MULTILINE | Pattern.DOTALL);
  			rlt = scriptPattern.matcher(rlt).replaceAll("");
  
  			scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE
  					| Pattern.MULTILINE | Pattern.DOTALL);
  			rlt = scriptPattern.matcher(rlt).replaceAll("");*/
  
              // Remove any lonesome </script> tag
              scriptPattern = compile("</script>", CASE_INSENSITIVE);
              rlt = scriptPattern.matcher(rlt).replaceAll("");
  
              // Remove any lonesome <script ...> tag
              scriptPattern = compile("<script(.*?)>", CASE_INSENSITIVE
                      | MULTILINE | DOTALL);
              rlt = scriptPattern.matcher(rlt).replaceAll("");
  
              // Avoid eval(...) expressions
              scriptPattern = compile("eval\\((.*?)\\)", CASE_INSENSITIVE
                      | MULTILINE | DOTALL);
              rlt = scriptPattern.matcher(rlt).replaceAll("");
  
              // Avoid expression(...) expressions
              scriptPattern = compile("expression\\((.*?)\\)", CASE_INSENSITIVE
                      | MULTILINE | DOTALL);
              rlt = scriptPattern.matcher(rlt).replaceAll("");
  
              // Avoid javascript:... expressions
              scriptPattern = compile("javascript:", CASE_INSENSITIVE);
              rlt = scriptPattern.matcher(rlt).replaceAll("");
  
              // Avoid vbscript:... expressions
              scriptPattern = compile("vbscript:", CASE_INSENSITIVE);
              rlt = scriptPattern.matcher(rlt).replaceAll("");
  
              // Avoid onload= expressions
              scriptPattern = compile("onload(.*?)=", CASE_INSENSITIVE
                      | MULTILINE | DOTALL);
              rlt = scriptPattern.matcher(rlt).replaceAll("");
          }
  
          return rlt;
      }
  
      /**
       * @param value 待处理内容
       * @return
       * @Description 过滤SQL注入内容
       */
      public static String stripSqlInjection(String value) {
          //value.replaceAll("('.+--)|(--)|(\\|)|(%7C)", "");
          return (null == value) ? null : value.replaceAll("('.+--)|(--)|(%7C)", "");
      }
  
      /**
       * @param value 待处理内容
       * @return
       * @Description 过滤SQL/XSS注入内容
       */
      public static String stripSqlXSS(String value) {
          return stripXSS(stripSqlInjection(value));
      }
  
  }
  