# HG changeset patch # User tatsuki # Date 1406726243 -32400 # Node ID ac7d1070f44947470f6f28fbe38f48b763d724ab # Parent 066f58e93a14a8d6cc52005d72194adf82f00820 sanitizing diff -r 066f58e93a14 -r ac7d1070f449 src/main/java/app/bbs/NetworkJungleBulletinBoard.java --- a/src/main/java/app/bbs/NetworkJungleBulletinBoard.java Wed Jul 30 17:57:18 2014 +0900 +++ b/src/main/java/app/bbs/NetworkJungleBulletinBoard.java Wed Jul 30 22:17:23 2014 +0900 @@ -456,6 +456,7 @@ path = path.add(Integer.parseInt(_path.substring(count, count + 1))); } } catch (Exception _e) { + System.out.println("屑"); } JungleTreeEditor editor = tree.getTreeEditor(); @@ -631,6 +632,18 @@ } } + + public String sanitize( String str ) { + if(str==null) { + return str; + } + str = str.replaceAll("&" , "&" ); + str = str.replaceAll("<" , "<" ); + str = str.replaceAll(">" , ">" ); + str = str.replaceAll("\"", """); + str = str.replaceAll("'" , "'" ); + return str; + } } diff -r 066f58e93a14 -r ac7d1070f449 src/main/java/app/bbs/ShowMessageWithTimeStampServlet.java --- a/src/main/java/app/bbs/ShowMessageWithTimeStampServlet.java Wed Jul 30 17:57:18 2014 +0900 +++ b/src/main/java/app/bbs/ShowMessageWithTimeStampServlet.java Wed Jul 30 22:17:23 2014 +0900 @@ -44,25 +44,24 @@ private void printBoard(String _bname, PrintWriter _pw) throws Exception { _pw.write("\n"); - _pw.write("

" + _bname + "

\n"); + _pw.write("

" + bbs.sanitize(_bname) + "

\n"); _pw.write("

Latest renew time : " + bbs.getRenewTime(_bname) + "

\n"); ; _pw.write("
Author : EditKey :

\n"); + _pw.write("

Author : EditKey :

\n"); _pw.write("

Message

\n"); _pw.write("

\n"); - _pw.write("MatrixMode"+"
"); + _pw.write("MatrixMode"+"
"); for (BoardMessage msg : bbs.getMessages(_bname)) {//フォルダの表示 _pw.write("
"); - _pw.write("

Author " + msg.getAuthor() + "

"); - _pw.write(""+ msg.getMessage() +"
"); + _pw.write("

Author " + bbs.sanitize(msg.getAuthor()) + "

"); + _pw.write(""+ bbs.sanitize(msg.getMessage()) +"
"); } - //forコメントの表示 _pw.write(""); _pw.flush(); } diff -r 066f58e93a14 -r ac7d1070f449 src/main/java/app/bbs/thinks/EditAttributeServlet.java --- a/src/main/java/app/bbs/thinks/EditAttributeServlet.java Wed Jul 30 17:57:18 2014 +0900 +++ b/src/main/java/app/bbs/thinks/EditAttributeServlet.java Wed Jul 30 22:17:23 2014 +0900 @@ -15,7 +15,7 @@ { private final NetworkBulletinBoard bbs; private static final String PARAM_BOARD_NAME = "bname"; - private static final String PARAM_NODE_PATH = "uuid"; + private static final String PARAM_NODE_PATH = "path"; private static final String PARAM_BOARD_MESSAGE= "msg"; private static final String PARAM_BOARD_EDITKEY = "key"; private static final String PARAM_NODE_ID = "id"; @@ -29,7 +29,7 @@ public void doGet(HttpServletRequest _req,HttpServletResponse _res) { String bname = (_req.getParameter(PARAM_BOARD_NAME)); - String path = (_req.getParameter(PARAM_NODE_ID)); + String path = (_req.getParameter(PARAM_NODE_PATH)); String id = (_req.getParameter(PARAM_NODE_ID)); @@ -54,7 +54,7 @@ { String boardName = (_req.getParameter(PARAM_BOARD_NAME)); String msg = (_req.getParameter(PARAM_BOARD_MESSAGE)); - String path = (_req.getParameter(PARAM_NODE_ID)); + String path = (_req.getParameter(PARAM_NODE_PATH)); String id = (_req.getParameter(PARAM_NODE_ID)); try{ diff -r 066f58e93a14 -r ac7d1070f449 src/main/java/app/bbs/thinks/ShowMatrix.java --- a/src/main/java/app/bbs/thinks/ShowMatrix.java Wed Jul 30 17:57:18 2014 +0900 +++ b/src/main/java/app/bbs/thinks/ShowMatrix.java Wed Jul 30 22:17:23 2014 +0900 @@ -63,11 +63,11 @@ if (nodeName == null) nodeName = "rootNode"; - _pw.write("

" + nodeName + " Path = " + path + "

\n"); + _pw.write("

" + bbs.sanitize(nodeName) + " Path = " + path + "

\n"); _pw.write("\n"); - _pw.write("

\n"); _pw.write("

Folder Name

\n"); _pw.write(""); @@ -76,7 +76,7 @@ _pw.write("


add Attribute

"); _pw.write("\n"); _pw.write("

attributeName

\n"); _pw.write(""); @@ -86,16 +86,16 @@ _pw.write("

Folder

"); for (BoardMessage msg : bbs.getFolder(_bname, path)) { - _pw.write("" + msg.getMessage() + + bbs.sanitize(msg.getMessage()) + ">" + bbs.sanitize(msg.getMessage()) + ""); _pw.write(" "); - _pw.write("edit"); _pw.write(" "); - _pw.write("delete

"); } @@ -104,10 +104,10 @@ getAttributeImp attribute = (bbs.getAttribute(_bname, path)); for (int count = 0; attribute.getMessage(count) != null; count++) { _pw.write("

" + count + " : "); - _pw.write("" - + attribute.getMessage(count) + ""); - _pw.write("" + " delete" + "

"); } diff -r 066f58e93a14 -r ac7d1070f449 src/main/java/app/bbs/thinks/deleteAttributeServlet.java --- a/src/main/java/app/bbs/thinks/deleteAttributeServlet.java Wed Jul 30 17:57:18 2014 +0900 +++ b/src/main/java/app/bbs/thinks/deleteAttributeServlet.java Wed Jul 30 22:17:23 2014 +0900 @@ -15,7 +15,7 @@ { private final NetworkBulletinBoard bbs; private static final String PARAM_BOARD_NAME = "bname"; - private static final String PARAM_NODE_PATH = "uuid"; + private static final String PARAM_NODE_PATH = "path"; private static final String PARAM_BOARD_MESSAGE= "msg"; private static final String PARAM_BOARD_EDITKEY = "key"; private static final String PARAM_NODE_ID = "id"; @@ -29,7 +29,7 @@ public void doGet(HttpServletRequest _req,HttpServletResponse _res) { String bname = (_req.getParameter(PARAM_BOARD_NAME)); - String path = (_req.getParameter(PARAM_NODE_ID)); + String path = (_req.getParameter(PARAM_NODE_PATH)); String id = (_req.getParameter(PARAM_NODE_ID)); @@ -52,7 +52,7 @@ public void doPost(HttpServletRequest _req,HttpServletResponse _res) { String boardName = (_req.getParameter(PARAM_BOARD_NAME)); - String path = (_req.getParameter(PARAM_NODE_ID)); + String path = (_req.getParameter(PARAM_NODE_PATH)); String id = (_req.getParameter(PARAM_NODE_ID)); try{