字符串处理类.避免字符串中带有的有害脚步.

字符串处理类.避免字符串中带有的有害脚步.

public class StringEscapeEditor extends PropertyEditorSupport {
public StringEscapeEditor() {
super();
}
@Override
public void setAsText(String text) {
if (text == null) {
setValue(null);
} else {
String value = clearXss(text);
setValue(value);
}
}
@Override
public String getAsText() {
Object value = getValue();
return value != null ? value.toString() : “”;
}
/**
* 处理字符转义
*
* @param value
* @return
/
private String clearXss(String value) {
if (value == null || “”.equals(value)) {
return value;
}
value = value.replaceAll("<", “<”).replaceAll(">", “>”);
value = value.replaceAll("\(", “(”).replaceAll("\)", “)”);
value = value.replaceAll("’", “’”);
value = value.replaceAll("eval\((.)\)", “”);
value = value.replaceAll("[\"\’][\s]javascript:(.)[\"\’]", “”"");
value = value.replaceAll(“script”, “”);
return value;
}
}