Class XssJsonSerializer

java.lang.Object
tools.jackson.databind.ValueSerializer<String>
tech.riemann.nif.web.xss.escaper.XssJsonSerializer
All Implemented Interfaces:
tools.jackson.databind.jsonFormatVisitors.JsonFormatVisitable
public class XssJsonSerializer extends tools.jackson.databind.ValueSerializer<String>
XSS JSON序列化器 (Jackson 3)

用于在JSON序列化过程中对字符串进行XSS出站转义（渲染缓解层）

继承自Jackson 3的ValueSerializer，重写serialize方法实现XSS过滤逻辑

出站策略（H4 修复）：保留转义作为渲染缓解层，但修复字段名匹配—— 入站已不再转义（存储为原文），出站做单次 HTML 转义，防止前端以 innerHTML 方式渲染时复活 XSS； 同时修正原实现用 value 匹配 @XssIgnore(value=...) 忽略名单的 bug， 改为用当前字段名匹配，与反序列化侧的语义对齐。

主要功能： 1. 对null值特殊处理，直接写入null 2. 根据XssHolder的配置决定是否忽略XSS处理 3. 对需要XSS处理的字符串进行HTML特殊字符转义

Author:
Kerbores(kerbores@riemann.tech)

  • Nested Class Summary

    Nested classes/interfaces inherited from class tools.jackson.databind.ValueSerializer

    tools.jackson.databind.ValueSerializer.None

  • Constructor Summary

    Constructors
    Constructor
    Description
    XssJsonSerializer()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    serialize(String value, tools.jackson.core.JsonGenerator gen, tools.jackson.databind.SerializationContext ctxt)
    序列化字符串值，处理XSS出站转义

    Methods inherited from class tools.jackson.databind.ValueSerializer

    acceptJsonFormatVisitor, createContextual, getDelegatee, handledType, isEmpty, isUnwrappingSerializer, properties, replaceDelegatee, resolve, serializeWithType, unwrappingSerializer, usesObjectId, withFilterId, withFormatOverrides, withIgnoredProperties

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • XssJsonSerializer

      public XssJsonSerializer()

  • Method Details

    • serialize

      public void serialize(String value, tools.jackson.core.JsonGenerator gen, tools.jackson.databind.SerializationContext ctxt) throws tools.jackson.core.JacksonException
      序列化字符串值，处理XSS出站转义

      根据XssHolder的配置决定是否对字符串进行XSS转义； 忽略名单按当前字段名（gen.getOutputContext().currentName()）匹配

      Specified by:
      serialize in class tools.jackson.databind.ValueSerializer<String>
      Parameters:
      value - 要序列化的字符串值
      gen - JSON生成器，用于写入序列化结果
      ctxt - 序列化上下文
      Throws:
      tools.jackson.core.JacksonException - 当写入JSON时发生解析错误