Skip to content

XSS 방지 #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pdh0128 wants to merge 1 commit into
base: dev-0.2
Choose a base branch
from
Open

XSS 방지 #55

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions src/main/java/com/example/auth/global/config/JacksonConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
package com.example.auth.global.config;

public class JacksonConfig {
}
Comment on lines +3 to +4
Copy link
Contributor

@coderabbitai coderabbitai bot Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

빈 클래스로는 XSS 방지 기능이 구현되지 않습니다.

이 클래스는 현재 비어있어 XSS 방지 기능을 제공하지 않습니다. PR 목적이 "XSS 방지"인 것을 고려하면, 다음 사항들이 필요합니다:

  • @Configuration 어노테이션 추가
  • ObjectMapper 빈 정의 및 커스텀 XSS deserializer 등록
  • XssStringJsonDeserializer를 Jackson 모듈에 등록

다음과 같은 구현을 제안합니다:

 package com.example.auth.global.config;
 
+import com.example.auth.global.deserializer.XssStringJsonDeserializer;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.module.SimpleModule;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration
 public class JacksonConfig {
+    @Bean
+    public ObjectMapper objectMapper() {
+        ObjectMapper mapper = new ObjectMapper();
+        SimpleModule module = new SimpleModule();
+        module.addDeserializer(String.class, new XssStringJsonDeserializer());
+        mapper.registerModule(module);
+        return mapper;
+    }
 }

Committable suggestion skipped: line range outside the PR's diff.

4 changes: 4 additions & 0 deletions src/main/java/com/example/auth/global/deserializer/XssStringJsonDeserializer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
package com.example.auth.global.deserializer;

public class a {
}
Comment on lines +3 to +4
Copy link
Contributor

@coderabbitai coderabbitai bot Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

컴파일 오류: 파일명과 클래스명이 일치하지 않습니다.

Java에서 public 클래스의 이름은 반드시 파일명과 일치해야 합니다. 현재 파일명은 XssStringJsonDeserializer.java인데 클래스명이 a로 되어 있어 컴파일되지 않습니다.

또한, XSS 방지를 위한 실제 구현 로직이 없습니다. 이 클래스는:

  • JsonDeserializer<String>을 상속해야 합니다
  • XSS 공격을 방지하기 위한 문자열 sanitization 로직을 구현해야 합니다

다음과 같이 수정하세요:

 package com.example.auth.global.deserializer;
 
-public class a {
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+import org.apache.commons.text.StringEscapeUtils;
+import java.io.IOException;
+
+public class XssStringJsonDeserializer extends JsonDeserializer<String> {
+    @Override
+    public String deserialize(JsonParser p, DeserializationContext ctxt) throws IOException {
+        String value = p.getValueAsString();
+        if (value == null) {
+            return null;
+        }
+        // XSS 방지를 위해 HTML 특수문자를 이스케이프 처리
+        return StringEscapeUtils.escapeHtml4(value);
+    }
 }

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents 
In
src/main/java/com/example/auth/global/deserializer/XssStringJsonDeserializer.java
around lines 3 to 4, the file contains a public class named `a` which causes a
compile error because the public class name must match the file name; replace it
with a public class named `XssStringJsonDeserializer` that extends
`com.fasterxml.jackson.databind.JsonDeserializer<String>`, implement the
deserialize(JsonParser, DeserializationContext) method to read the incoming
string, handle nulls, and apply XSS sanitization (e.g., strip/escape HTML tags
or use a trusted sanitizer library) before returning the cleaned string; also
add necessary imports and consider registering/annotating the deserializer where
needed.