开发者

RegExp to check for JavaScript

开发者 https://www.devze.com 2023-01-29 06:00 出处:网络
I need a java regexp to check for dangerous JavaScript in a text string so i don\'t save it in my database.

I need a java regexp to check for dangerous JavaScript in a text string so i don't save it in my database. I'm trying开发者_C百科 to find some information on internet but can't find anything :( Could somebody help me with that? Thank you


I used some years ago a java class which appended for me a regexp like this:

(.(?<!<|%3c|&#x3c))*

It was computed that way:

   String[] EVIL_WORDS = { "<", "%3C", "&#x3C;", "&#60", "PA==",
                            ">", "%3E", "&#x3E;", "&#62", "Pg==",
                            "&", "%26", "&#x26;", "&#38", "Jg==",
                            "\"", "%22", "&#x22;", "&#34", "Ig==",
                            "'", "%27", "&#x27;", "&#39", "Jw=="};

StringBuffer buffer = new StringBuffer();
buffer.append("(.")
if(EVIL_WORDS.length > 0) {    
  buffer.append("(?<!");
  buffer.append(EVIL_WORDS[0]);
  for (int i = 1; i < EVIL_WORDS.length; i++) {
    buffer.append('|');
    buffer.append(EVIL_WORDS[i]);
  } //for
  buffer.append(')');
}//if
buffer.append(')*');

It the pattern did not match there has been a bad character detected.

The script produced original a veeery looong regex and made checks for length, sql injection and a lot of other stuff, but these times have gone. With grails and XSS protection and hibernates sql injection protection I don't use it anymore. But I am glad if I could help you.

0

精彩评论

暂无评论...
验证码 换一张
取 消