Class XssInitBinder.StringPropertiesEditor

java.lang.Object

java.beans.PropertyEditorSupport

tech.riemann.nif.web.xss.escaper.XssInitBinder.StringPropertiesEditor

All Implemented Interfaces:

PropertyEditor

Enclosing class:

XssInitBinder

public static class XssInitBinder.StringPropertiesEditor
extends PropertyEditorSupport

字符串属性编辑器

继承自PropertyEditorSupport，重写setAsText方法实现XSS检测

主要功能： 1. 对null值特殊处理 2. 根据XssHolder的配置决定是否忽略XSS检测 3. 对检测到的 XSS 内容记录日志（可配置拦截），数据原样绑定

Author:

Kerbores(kerbores@riemann.tech)

Constructor Summary

Constructors

Constructor	Description
StringPropertiesEditor()
StringPropertiesEditor(boolean blockOnDetection)

Method Summary

Modifier and Type	Method	Description
void	setAsText(String text)	设置文本值，处理XSS检测

Methods inherited from class PropertyEditorSupport

addPropertyChangeListener, firePropertyChange, getAsText, getCustomEditor, getJavaInitializationString, getSource, getTags, getValue, isPaintable, paintValue, removePropertyChangeListener, setSource, setValue, supportsCustomEditor

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

StringPropertiesEditor

public StringPropertiesEditor()

StringPropertiesEditor

public StringPropertiesEditor(boolean blockOnDetection)

Method Details

setAsText

public void setAsText(String text)
               throws IllegalArgumentException

设置文本值，处理XSS检测

根据XssHolder的配置决定是否对字符串进行XSS检测

Specified by:

setAsText in interface PropertyEditor

Overrides:

setAsText in class PropertyEditorSupport

Parameters:

text - 要设置的文本值

Throws:

IllegalArgumentException - 当参数无效或拦截模式下检测到 XSS 时抛出