I need a java regexp to check for dangerous JavaScript in a text string so i don't save it in my database. I'm trying开发者_C百科 to find some information on internet but can't find anything :( Could somebody help me with that? Thank you
I used some years ago a java class which appended for me a regexp like this:
(.(?<!<|%3c|<))*
It was computed that way:
String[] EVIL_WORDS = { "<", "%3C", "<", "<", "PA==",
">", "%3E", ">", ">", "Pg==",
"&", "%26", "&", "&", "Jg==",
"\"", "%22", """, """, "Ig==",
"'", "%27", "'", "'", "Jw=="};
StringBuffer buffer = new StringBuffer();
buffer.append("(.")
if(EVIL_WORDS.length > 0) {
buffer.append("(?<!");
buffer.append(EVIL_WORDS[0]);
for (int i = 1; i < EVIL_WORDS.length; i++) {
buffer.append('|');
buffer.append(EVIL_WORDS[i]);
} //for
buffer.append(')');
}//if
buffer.append(')*');
It the pattern did not match there has been a bad character detected.
The script produced original a veeery looong regex and made checks for length, sql injection and a lot of other stuff, but these times have gone. With grails and XSS protection and hibernates sql injection protection I don't use it anymore. But I am glad if I could help you.
精彩评论