国产成人亚洲综合在线,国产产在线精品亚洲AAVV,亚洲国产理论片在线播放

如何应对xss��d��?

quaff — Mon, 24 Sep 2007 03:33:00 GMT

什么是xss��d��?
�?a href="http://www.tkk7.com/quaff/archive/2005/12/08/23030.html">点击�q�里

怎么样避免xss��d��?
使用jsp tag来输�?比如,�q�些tag默认都对html代码转义�?br />
但是又引入了一个新的难�?怎么使用富文本编辑器?
富文本编辑器最�l�得到的内容是html代码,�q�且要原栯��?但是html代码是可以直接或者间接编辑的,�q�样的话��可以插入�Q何代�?可以�?lt;script>标签,可以�?lt;a href="javascript:xxx">,可以用css里面的expression,�{�等.

解决�Ҏ(gu��)��有两�?br /> 1.在服务器端过滤这些script,很难全部�q��o(h��),不知道有没有现成的lib可以�?br /> 2.�q�脆不��?像大部分论坛那样搞几个定义好的tag,比如[a][/a]插入��链�?�q�样不够灉|��也做不到所见即所�?但是安全�W�一

不知道大家有什么好的解��x��?

quaff 2007-09-24 11:33 发表评论

一�U�新的hibernate和spring�l�合方式

quaff — Mon, 10 Apr 2006 13:03:00 GMT

内容��幅较长,��L(f��ng)��?a href="/quaff/articles/40322.html">�q�里阅读全文�?/h4>

quaff 2006-04-10 21:03 发表评论

quaff — Sun, 26 Mar 2006 08:41:00 GMT

先说怎么�?再稍微解释一下�ؓ(f��)什么这么做
1.webwork.properties里面讄��
webwork.serve.static=false
webwork.multipart.parser=cos
2.在webapp的根目录下徏一个文件夹webwork,把webwork.jar里面�?com/opensymphony/webwork/static�?template里面的文件和复制到自己徏的webwork文�g多w��?�?webwork/richtexteditor里面建文件夹data(可能�?x��)自动�?没测试过)
3.写一个RichtexteditorConnector

package test;

import java.io.FileFilter;
import java.io.IOException;
import java.util.ArrayList;
import java.util.List;

import javax.servlet.ServletContext;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import com.opensymphony.webwork.components.DefaultRichtexteditorConnector;

public class RichtexteditorConnector extends DefaultRichtexteditorConnector {
    public static final Log _log = LogFactory
            .getLog(RichtexteditorConnector.class);

    private ServletContext servletContext;

    public void setServletContext(ServletContext servletContext) {
        this.servletContext = servletContext;
    }

    protected String calculateActualServerPath(String actualServerPath,
            String type, String folderPath) throws Exception {
        String path = servletContext.getRealPath(actualServerPath);
        path = path.replace('\\', '/');
        makeDirIfNotExists(path);
        path = path.endsWith("/") ? path : path + "/";
        return path + type + folderPath;
    }

    protected Folder[] getFolders(String virtualFolderPath, String type)
            throws Exception {
        String path = calculateActualServerPath(getActualServerPath(), type,
                virtualFolderPath);
        makeDirIfNotExists(path);
        java.io.File f = new java.io.File(path);
        java.io.File[] children = f.listFiles(new FileFilter() {
            public boolean accept(java.io.File pathname) {
                if (!pathname.isFile()) {
                    return true;
                }
                return false;
            }
        });

        List tmpFolders = new ArrayList();
        for (int a = 0; a < children.length; a++) {
            tmpFolders.add(new Folder(children[a].getName()));
        }

        return (Folder[]) tmpFolders.toArray(new Folder[0]);
    }

    protected FoldersAndFiles getFoldersAndFiles(String virtualFolderPath,
            String type) throws Exception {
        String path = calculateActualServerPath(getActualServerPath(), type,
                virtualFolderPath);
        makeDirIfNotExists(path);
        java.io.File f = new java.io.File(path);
        java.io.File[] children = f.listFiles();

        List directories = new ArrayList();
        List files = new ArrayList();
        for (int a = 0; a < children.length; a++) {
            if (children[a].isDirectory()) {
                directories.add(new Folder(children[a].getName()));
            } else {
                try {
                    files.add(new File(children[a].getName(),
                            fileSizeInKBytes(children[a])));
                } catch (Exception e) {
                    _log.error("cannot deal with file " + children[a], e);
                }
            }
        }

        return new FoldersAndFiles((Folder[]) directories
                .toArray(new Folder[0]), (File[]) files.toArray(new File[0]));
    }

    protected FileUploadResult fileUpload(String virtualFolderPath,
            String type, String filename, String contentType,
            java.io.File newFile) {
        try {
            String tmpDir = calculateActualServerPath(getActualServerPath(),
                    type, virtualFolderPath);
            makeDirIfNotExists(tmpDir);
            String tmpFile = tmpDir + filename;
            if (makeFileIfNotExists(tmpFile)) {
                // already exists
                int a = 0;
                String ext = String.valueOf(a);
                tmpFile = calculateActualServerPath(getActualServerPath(),
                        type, virtualFolderPath)
                        + filename + ext;
                while (makeFileIfNotExists(tmpFile)) {
                    a = a + 1;
                    ext = String.valueOf(a);
                    if (a > 100) {
                        return FileUploadResult.invalidFile();
                    }
                }
                copyFile(newFile, new java.io.File(tmpFile));
                return FileUploadResult
                        .uploadCompleteWithFilenamChanged(filename + ext);
            } else {
                copyFile(newFile, new java.io.File(tmpFile));
                return FileUploadResult.uploadComplete();
            }
        } catch (Exception e) {
            _log.error(e.toString(), e);
            e.printStackTrace();
            return FileUploadResult.invalidFile();
        }
    }

    protected void unknownCommand(String command, String virtualFolderPath,
            String type, String filename, String contentType,
            java.io.File newFile) {
        throw new RuntimeException("unknown command " + command);
    }

    /**
     *
     * @param path
     * @return true if file already exists, false otherwise.
     */
    protected boolean makeDirIfNotExists(String path) {
        java.io.File dir = new java.io.File(path);
        if (!dir.exists()) {
            _log.debug("make directory " + dir);
            boolean ok = dir.mkdirs();
            if (!ok) {
                throw new RuntimeException("cannot make directory " + dir);
            }
            return false;
        }
        return true;
    }

    protected boolean makeFileIfNotExists(String filePath) throws IOException {
        java.io.File f = new java.io.File(filePath);
        if (!f.exists()) {
            _log.debug("creating file " + filePath);
            boolean ok = f.createNewFile();
            if (!ok) {
                throw new RuntimeException("cannot create file " + filePath);
            }
            return false;
        }
        return true;
    }

}

4.xwork.xml加上

<package name="richtexteditor-browse" extends="webwork-default"
        namespace="/webwork/richtexteditor/editor/filemanager/browser/default/connectors/jsp">
        <action name="connector"
            class="test.RichtexteditorConnector"
            method="browse">
            <param name="actualServerPath">
                /webwork/richtexteditor/data
            param>
            <result name="getFolders" type="richtexteditorGetFolders" />
            <result name="getFoldersAndFiles"
                type="richtexteditorGetFoldersAndFiles" />
            <result name="createFolder"
                type="richtexteditorCreateFolder" />
            <result name="fileUpload" type="richtexteditorFileUpload" />
        action>
package>
<package name="richtexteditor-upload" extends="webwork-default"
        namespace="/webwork/richtexteditor/editor/filemanager/upload">
        <action name="uploader"
            class="test.RichtexteditorConnector"
            method="upload">
            <param name="actualServerPath">
                /webwork/richtexteditor/data
            param>
            <result name="richtexteditorFileUpload" />
        action>
package>

5.配置标签

   <%request.setAttribute("contextPath",request.getContextPath());%>

6.服务器端口设�|��ؓ(f��)80

原因
1.
webwork.serve.static=false
/webwork/*�q�样的URL是可以直接访问不需要通过webwork,�q�样做是��Z��自己可以在里面徏文�g,�q�且可以方便的访问这些文�?br />webwork.multipart.parser=cos
讄��为jakarta上传文�g不成�?com.opensymphony.webwork.interceptor.FileUploadInterceptor解析MultiPartRequestWrapper不成�?原因不清�?反正用cos��可以了,记得加上cos.jar
2.因�ؓ(f��)讄��了webwork.serve.static=false需要这样做
3.覆盖webwork的DefaultRichtexteditorConnector,最关键的是覆盖calculateActualServerPath()�Ҏ(gu��)��,默认是把文�g攑ֈ�/WEB-INF/classes/com/opensymphony/webwork/static/richtexteditor/data/,我们需要放�?webwork/richtexteditor/data/里面,覆盖其他�Ҏ(gu��)��是因为默认对文�g的访问都是通过
new File(new URI("file://"+filePath);来访问的,�?x��)有些问�?直接new File(filePath)��可以了
4.使用自己的RichtexteditorConnector,�q�且讄��参数actualServerPath,其他参数不要�?webwork默认的是�q�样
5.basePath必须自己指定不能用默认的,虽然指定的值和默认的是一�?但是不自己指定的话它自动加上jsessionid,�?webwork/richtexteditor/;jsessionid=301gs94034pki/editor/fckeditor.html,因�ؓ(f��)讄��了webwork.serve.static=false,所以服务器不能解析�q�个url
defaultLanguage="zh-cn",不指定的话中文默认是�J�体
6.服务器端口必��Mؓ(f��)80不能�?080,因�ؓ(f��)fckeditor链接你上传的文�g的时�?不会(x��)把端口加上去

quaff 2006-03-26 16:41 发表评论

quaff — Fri, 24 Mar 2006 11:07:00 GMT

webwork2.2.2内置了fckeditor�Q�用�?br />

<ww:richtexteditor toolbarCanCollapse="false" width="700" label="描述" name="description"/>

xwork.xml加入�Q?br />

<package name="richtexteditor-browse" extends="webwork-default"
        namespace="/webwork/richtexteditor/editor/filemanager/browser/default/connectors/jsp">
        <action name="connector"
            class="com.opensymphony.webwork.components.DefaultRichtexteditorConnector"
            method="browse">
            <result name="getFolders" type="richtexteditorGetFolders" />
            <result name="getFoldersAndFiles"
                type="richtexteditorGetFoldersAndFiles" />
            <result name="createFolder" type="richtexteditorCreateFolder" />
            <result name="fileUpload" type="richtexteditorFileUpload" />
        action>
package>
<package name="richtexteditor-upload" extends="webwork-default"
        namespace="/webwork/richtexteditor/editor/filemanager/upload">
        <action name="uploader"
            class="com.opensymphony.webwork.components.DefaultRichtexteditorConnector"
            method="upload">
            <result name="richtexteditorFileUpload" />
        action>
package>

存在如下问题:

1.中文环境默认是繁�?需要去包里面用zh-cn.js替换zh.js
2.String path = "file://"+servletContext.getRealPath("/WEB-INF/classes"+actualServerPath),windows文�g路径是\,webwork没有转义或者把\替换�?,�Ҏ(gu��)��件的讉K��都是通过new File(new URI(filePath))来访�?在我机子上会(x��)��Z��?br />com.opensymphony.webwork.dispatcher.DispatcherUtils - Could not execute action
java.lang.IllegalArgumentException: URI has an authority component
at java.io.File.(File.java:326)
at com.opensymphony.webwork.components.DefaultRichtexteditorConnector.makeDirIfNotExists(DefaultRichtexteditorConnector.java:171)

解决�Ҏ(gu��)��是自己写一个类�l�承com.opensymphony.webwork.components.DefaultRichtexteditorConnector然后覆盖它的�Ҏ(gu��)��

3.文�g囄��默认是保存在\WEB-INF\classes\com\opensymphony\webwork\static\richtexteditor\data里面,写入和读取都存在问题,写入的时候如果context是reloadable="true"则会(x��)引发context的reload,在context��h��之后新加的文件比如test.jpg不能通过url来访�?webwork/data/test.jpg,�q�个应该是classloader不会(x��)在context启动之后加蝲�q�些文�g

4.上传的表单里面没有action,虽然tag里面默认�?br />imageUploadURL="/webwork/richtexteditor/editor/filemanager/upload/uploader.action?Type=Image"
flashUploadURL="/webwork/richtexteditor/editor/filemanager/upload/uploader.action?Type=Flash"
linkUploadURL="/webwork/richtexteditor/editor/filemanager/upload/uploader.action?Type=File"
wikidocs里面说是"/webwork/static/richtexteditor/editor/filemanager/upload/uploader.action?Type=File"应该是多了个/static
但是实际上上传的form里面的action是空�?上传不了东西,�q�个可能需要去改fckeditor

quaff 2006-03-24 19:07 发表评论

用jarkata的commons-VFS监视文�g夹的变化

quaff — Thu, 02 Mar 2006 07:48:00 GMT

FileSystemManager fsManager = null;
FileObject listendir = null;
try {
fsManager = VFS.getManager();
listendir = fsManager.resolveFile(new File(
"./classes/").getAbsolutePath());
} catch (FileSystemException e) {
log.error("监视文�g夹出错了", e);
e.printStackTrace();
}
DefaultFileMonitor fm = new DefaultFileMonitor(new FileListener() {
public void fileCreated(FileChangeEvent event) throws Exception {
monitor(event);
}

public void fileDeleted(FileChangeEvent event) throws Exception {
monitor(event);
}

public void fileChanged(FileChangeEvent event) throws Exception {
monitor(event);
}

private void monitor(FileChangeEvent event) {
FileObject fileObject = event.getFile();
FileName fileName = fileObject.getName();
if (fileName.getBaseName().endsWith(".class")) {
reload();
}
}
});
fm.setRecursive(true);
fm.addFile(listendir);
fm.start();

quaff 2006-03-02 15:48 发表评论

quaff — Sat, 11 Feb 2006 04:31:00 GMT

下蝲

用户只需要写models.xml,具体参数参照models.dtd,执行
java -cp .;freemarker.jar org.mycodegen.Main models.xml

生成的代码包�?BR>1.POJO�c?�cȝ��hibernate映射文�g,DAO�c?Manager�c?spring的对hibernate��装的配�|�文�?如果你不使用webwork,只需要这些就行了
2.webwork的Action�c?Action的资源文�?Action的校验文�?xwork.xml,
模板支持freemarker和jsp两种,默认是jsp,列表功能(可以分页),删除功能,录入功能,查看功能,查询功能(查询条�g自己�?

生成之后加上依赖的包��可以运行了,剩下的问题就是根据业务逻辑来修改界面和Action�{?/P>

quaff 2006-02-11 12:31 发表评论

Hello,World

quaff — Thu, 08 Dec 2005 12:50:00 GMT

留名�?

quaff 2005-12-08 20:50 发表评论