Gson 自定义TypeAdapter

最新推荐文章于 2025-03-11 11:28:52 发布

快乐的kuai小马

最新推荐文章于 2025-03-11 11:28:52 发布

阅读量1.8k

点赞数

分类专栏： Android 基础文章标签： gson html 数据

本文链接：https://blog.youkuaiyun.com/happy_horse/article/details/53414135

版权

Android 基础专栏收录该内容

38 篇文章

订阅专栏

一、DEMO学习

最近写获取车辆品牌车系时，用Gson解析后台返回的数据会有html的字符，是后台返回有html字符，解决的办法自定义Gson的TypeAdapter。

DEMO如下：

protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        doCase1();
        doCase2();
        doCase3();
        doCase4();
        doCase5();
    }

    private void doCase1(){
        Student student = new Student();
        student.name = "李明";
        student.sex = "<";

        Gson mGson = new GsonBuilder().create();
        String jsonStr = mGson.toJson(student);
        Log.i("TEST", "jsonStr1" + jsonStr);
    }

    private void doCase2(){
        Student student = new Student();
        student.name = "李明";
        student.sex = "<";

        Gson mGson = new GsonBuilder().disableHtmlEscaping().create();
        String jsonStr = mGson.toJson(student);
        Log.i("TEST", "jsonStr2" + jsonStr);
    }

    private void doCase3(){
        String jsonStr = "{\"id\":1,\"str\":\"test\",\"html\":\"&lt;script&gt;alert('xss')&lt;/script&gt;\"}";
        Gson mGson = new GsonBuilder().disableHtmlEscaping().create();
        Log.i("TEST", "beanStr3" + mGson.fromJson(jsonStr, TestObject.class));
    }

    private void doCase4(){
        String jsonStr = "{\"id\":1,\"str\":\"test\",\"html\":\"&lt;script&gt;&lt;/script&gt;\"}";
        Gson mGson = new GsonBuilder().disableHtmlEscaping().
                registerTypeAdapter(String.class, new StringUnescapeDeserializer()).create();
        Log.i("TEST", "beanStr4" + mGson.fromJson(jsonStr, TestObject.class));
    }

    private void doCase5(){
        String jsonStr = "{\"id\":1,\"str\":\"test\",\"html\":\"&#40;script&gt;&#40;/script&gt;\"}";
        Gson mGson = new GsonBuilder().disableHtmlEscaping().
                registerTypeAdapter(String.class, new StringUnescapeDeserializer()).create();
        Log.i("TEST", "beanStr4" + mGson.fromJson(jsonStr, TestObject.class));
    }

打印结果如下：

I/TEST: jsonStr1{"name":"李明","sex":"\u003c"}
I/TEST: jsonStr2{"name":"李明","sex":"<"}
I/TEST: beanStr3TestObject [id=1, str=test, html=&lt;script&gt;alert('xss')&lt;/script&gt;]
I/TEST: beanStr4TestObject [id=1, str=test, html=<script></script>]
I/TEST: beanStr4TestObject [id=1, str=test, html=(script>(/script>]

二、具体做法

 Gson mGson = new GsonBuilder().disableHtmlEscaping().create();

这一段代码是防止实体在被转成json串的时候被转义成html字符；

 Gson mGson = new GsonBuilder().disableHtmlEscaping().
                registerTypeAdapter(String.class, new StringUnescapeDeserializer()).create();

这一段代码是在json转成实体时，将json中的html字符转义成正常字符集；

自定义序列号adapter StringUnescapeDeserializer 代码如下：

public class StringUnescapeDeserializer implements JsonDeserializer<String>{

    public String deserialize(JsonElement json, Type typeOfT, JsonDeserializationContext context)
            throws JsonParseException {

        String src = json.getAsJsonPrimitive().getAsString();
        if (src.indexOf('&') == -1) {
            return src;
        } else {
            // 可能存在html实体字符
            return StringEscapeUtils.unescapeHtml4(src);
        }
    }

}