Spring Boot @ResponseBody Jackson - 逃離所有String字段

Question

有沒有辦法在Spring Boot中配置Jackson，所以我可以在HTML中轉義@RequestBody中的所有值？ 我已嘗試使用序列化程序，但據我所知，它們已定義為特定類。 我需要一個過濾器來處理JSON中發送的所有值，並使用以下內容對它們進行轉義：

StringEscapeUtils.escapeHtml4(value)

謝謝

Answer 1

如何創建一個XSS過濾器並在RequestInterceptor中調用它

public class XSSRequestWrapper extends HttpServletRequestWrapper {

public XSSRequestWrapper(HttpServletRequest request) {
    super(request);
}

/**
 * Get XSS stripped parameter values
 * @param parameter parameter values string to be checked
 * @return xss striped encoded string
 */
@Override
public String[] getParameterValues(String parameter)
{
    String[] values = super.getParameterValues(parameter);
    if(values == null)
    {
        return new String[0];
    }
    int count = values.length;
    String[] encodedValues = new String[count];
    for(int i=0; i<count; i++)
    {
        encodedValues[i]= stripXSS(values[i]);
    }
    return encodedValues;
}

/**
 * Get XSS stripped parameter
 * @param parameter parameter string to be checked
 * @return xss striped encoded string
 */
@Override
public String getParameter(String parameter)
{
    String value = super.getParameter(parameter);
    return stripXSS(value);
}

/**
 * Get XSS stripped header
 * @param name header string to be checked
 * @return xss striped encoded string
 */
@Override
public String getHeader(String name)
{
    String value = super.getHeader(name);
    return stripXSS(value);
}

private String stripXSS(String value)
{
    return HtmlUtils.htmlEscape(value);
}
}

XSS過濾器如下

 @WebFilter(urlPatterns = "/*")
 public class XSSFilter implements Filter {


/**
 * Filter initialization
 * @param filterConfig FilterConfig
*/
@Override
public void init(FilterConfig filterConfig) {
    // nothing required here
}

/**
 * Actual filter implementation
 * @param servletRequest ServletRequest
 * @param servletResponse ServletResponse
 * @param filterChain FilterChain
 * @throws IOException IOException
 * @throws ServletException ServletException
 */
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
    filterChain.doFilter(new XSSRequestWrapper((HttpServletRequest) servletRequest), servletResponse);
}

/**
 * Filter destroy
 */
@Override
public void destroy() {
    // nothing required here
}
}