springboot, springmvc 예방 xss 공격 사용자 정의 WebBindingInitializer 구현 클래스

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.bind.WebDataBinder;
import org.springframework.web.bind.support.WebBindingInitializer;
import org.springframework.web.context.request.WebRequest;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter;

/**
 *         ：
 * 
 * 		          
 * 
 */
@Configuration
public class MyWebBindingInitializer implements WebBindingInitializer {
	
	private static final WebBindingInitializer webBindingInitializer = new MyWebBindingInitializer();

	@Override
	public void initBinder(WebDataBinder binder, WebRequest request) {
		binder.registerCustomEditor(String.class, new StringEscapeEditor(true, true, false));
	}
	
	
	@Autowired
	public void getWebBindingInitializer(RequestMappingHandlerAdapter requestMappingHandlerAdapter){
		requestMappingHandlerAdapter.setWebBindingInitializer(webBindingInitializer);
	}

}

import java.beans.PropertyEditorSupport;

import org.apache.commons.lang3.StringEscapeUtils;

public class StringEscapeEditor extends PropertyEditorSupport {

	private boolean escapeHTML;
	private boolean escapeJavaScript;
	private boolean escapeSQL;

	public StringEscapeEditor() {
		super();
	}

	public StringEscapeEditor(boolean escapeHTML, boolean escapeJavaScript, boolean escapeSQL) {
		super();
		this.escapeHTML = escapeHTML;
		this.escapeJavaScript = escapeJavaScript;
		this.escapeSQL = escapeSQL;
	}

	@Override
	public void setAsText(String text) {
		if (text == null) {
			setValue(null);
		} else {
			String value = text;
			if (escapeHTML) {
				value = StringEscapeUtils.escapeHtml3(value);
			}
			if (escapeJavaScript) {
				value = this.escapeScript(value);
			}
			if (escapeSQL) {
				value = this.escapeSql(value);
			}
			setValue(value);
		}
	}

	@Override
	public String getAsText() {
		Object value = getValue();
		return value != null ? value.toString() : "";
	}
	
	/**
	 *   SQL      
	 * @param value
	 * @return
	 */
	public String escapeSql(String value) {
		return value.replaceAll("('.+--)|(--)|(\\|)|(%7C)", "");
	}
	
	/**
	 *   js  
	 * @param value
	 * @return
	 */
	public String escapeScript(String value){
		value = value.replace("script", "\\script").replace("/script", "\\/script");
		return value;
	}
}

@Configuration