zoukankan
html css js c++ java
危险字符过滤的类
using
System;
using
System.IO;
using
System.Text;
using
System.Text.RegularExpressions;
using
System.Runtime.Remoting;
using
System.Runtime.Remoting.Proxies;
using
System.Runtime.Remoting.Messaging;
using
System.Reflection;
namespace
FilterRealProxy
{
///
<summary>
///
FilterRealProxy类:一个真实代理, 拦截它所代理对象中方法的返回值,并对需要过滤的返回值进行过滤。
///
</summary>
public
class
FilterRealProxy:RealProxy
{
private
MarshalByRefObject target;
public
FilterRealProxy(MarshalByRefObject target):
base
(target.GetType())
{
this
.target
=
target;
}
public
override
IMessage Invoke(IMessage msg)
{
IMethodCallMessage callMsg
=
msg
as
IMethodCallMessage;
IMethodReturnMessage returnMsg
=
RemotingServices.ExecuteMessage(target,callMsg);
//
检查返回值是否为String,如果不是String,就没必要进行过滤
if
(
this
.IsMatchType(returnMsg.ReturnValue))
{
string
returnValue
=
this
.Filter(returnMsg.ReturnValue.ToString(),returnMsg.MethodName);
return
new
ReturnMessage(returnValue,
null
,
0
,
null
,callMsg);
}
return
returnMsg;
}
protected
string
Filter(
string
ReturnValue,
string
MethodName)
{
MethodInfo methodInfo
=
target.GetType().GetMethod(MethodName);
object
[] attributes
=
methodInfo.GetCustomAttributes(
typeof
(StringFilter),
true
);
foreach
(
object
attrib
in
attributes)
{
return
FilterHandler.Process(((StringFilter)attrib).FilterType,ReturnValue);
}
return
ReturnValue;
}
protected
bool
IsMatchType(
object
obj)
{
return
obj
is
System.String;
}
}
///
<summary>
///
StringFilter类:自定义属性类, 定义目标元素的过滤类型
///
</summary>
public
class
StringFilter:Attribute
{
protected
FilterType _filterType;
public
StringFilter(FilterType filterType)
{
this
._filterType
=
filterType;
}
public
FilterType FilterType
{
get
{
return
_filterType;
}
}
}
///
<summary>
///
枚举类:用于指定过滤类型,例如:对script过滤还是对html进行过滤?
///
</summary>
[Flags()]
public
enum
FilterType
{
Script
=
1
,
Html
=
2
,
Object
=
3
,
AHrefScript
=
4
,
Iframe
=
5
,
Frameset
=
6
,
Src
=
7
,
BadWords
=
8
,
//
Include=9,
All
=
16
}
///
<summary>
///
过滤处理类:根据过滤类型,调用相应的过滤处理方法。
///
</summary>
public
class
FilterHandler
{
private
FilterHandler()
{
}
public
static
string
Process(FilterType filterType,
string
filterContent)
{
switch
(filterType)
{
case
FilterType.Script:
filterContent
=
FilterScript(filterContent);
break
;
case
FilterType.Html:
filterContent
=
FilterHtml(filterContent);
break
;
case
FilterType.Object:
filterContent
=
FilterObject(filterContent);
break
;
case
FilterType.AHrefScript:
filterContent
=
FilterAHrefScript(filterContent);
break
;
case
FilterType.Iframe:
filterContent
=
FilterIframe(filterContent);
break
;
case
FilterType.Frameset:
filterContent
=
FilterFrameset(filterContent);
break
;
case
FilterType.Src:
filterContent
=
FilterSrc(filterContent);
break
;
//
case FilterType.Include:
//
filterContent=FilterInclude(filterContent);
//
break;
case
FilterType.BadWords:
filterContent
=
FilterBadWords(filterContent);
break
;
case
FilterType.All:
filterContent
=
FilterAll(filterContent);
break
;
default
:
//
do nothing
break
;
}
return
filterContent;
}
public
static
string
FilterScript(
string
content)
{
string
commentPattern
=
@"
(?'comment'<!--.*?--[ \n\r]*>)
"
;
string
embeddedScriptComments
=
@"
(\/\*.*?\*\/|\/\/.*?[\n\r])
"
;
string
scriptPattern
=
String.Format(
@"
(?'script'<[ \n\r]*script[^>]*>(.*?{0}?)*<[ \n\r]*/script[^>]*>)
"
, embeddedScriptComments ) ;
//
包含注释和Script语句
string
pattern
=
String.Format(
@"
(?s)({0}|{1})
"
, commentPattern, scriptPattern) ;
return
StripScriptAttributesFromTags(Regex.Replace(content,pattern,
string
.Empty,RegexOptions.IgnoreCase));
}
private
static
string
StripScriptAttributesFromTags(
string
content )
{
string
eventAttribs
=
@"
on(blur|c(hange|lick)|dblclick|focus|keypress|(key|mouse)(down|up)|(un)?load
|mouse(move|o(ut|ver))|reset|s(elect|ubmit))
"
;
string
pattern
=
String.Format(
@"
(?inx)
\<(\w+)\s+
(
(?'attribute'
(?'attributeName'{0})\s*=\s*
(?'delim'['""]?)
(?'attributeValue'[^'"">]+)
(\3)
)
|
(?'attribute'
(?'attributeName'href)\s*=\s*
(?'delim'['""]?)
(?'attributeValue'javascript[^'"">]+)
(\3)
)
|
[^>]
)*
\>
"
, eventAttribs ) ;
Regex re
=
new
Regex( pattern ) ;
//
使用MatchEvaluator的委托
return
re.Replace( content,
new
MatchEvaluator( StripAttributesHandler ) ) ;
}
private
static
string
StripAttributesHandler( Match m )
{
if
( m.Groups[
"
attribute
"
].Success )
{
return
m.Value.Replace( m.Groups[
"
attribute
"
].Value,
""
) ;
}
else
{
return
m.Value ;
}
}
public
static
string
FilterAHrefScript(
string
content)
{
string
newstr
=
FilterScript(content);
string
regexstr
=
@"
href[ ^=]*= *[\s\S]*script *:
"
;
return
Regex.Replace(newstr,regexstr,
string
.Empty,RegexOptions.IgnoreCase);
}
public
static
string
FilterSrc(
string
content)
{
string
newstr
=
FilterScript(content);
string
regexstr
=
@"
src *= *['""]?[^\.]+\.(js|vbs|asp|aspx|php|jsp)['""]
"
;
return
Regex.Replace(newstr,regexstr,
@""
,RegexOptions.IgnoreCase);
}
/*
public static string FilterInclude(string content)
{
string newstr=FilterScript(content);
string regexstr=@"<[\s\S]*include *(file|virtual) *= *[\s\S]*\.(js|vbs|asp|aspx|php|jsp)[^>]*>";
return Regex.Replace(newstr,regexstr,string.Empty,RegexOptions.IgnoreCase);
}
*/
public
static
string
FilterHtml(
string
content)
{
string
newstr
=
FilterScript(content);
string
regexstr
=
@"
<[^>]*>
"
;
return
Regex.Replace(newstr,regexstr,
string
.Empty,RegexOptions.IgnoreCase);
}
public
static
string
FilterObject(
string
content)
{
string
regexstr
=
@"
(?i)<Object([^>])*>(\w|\W)*</Object([^>])*>
"
;
return
Regex.Replace(content,regexstr,
string
.Empty,RegexOptions.IgnoreCase);
}
public
static
string
FilterIframe(
string
content)
{
string
regexstr
=
@"
(?i)<Iframe([^>])*>(\w|\W)*</Iframe([^>])*>
"
;
return
Regex.Replace(content,regexstr,
string
.Empty,RegexOptions.IgnoreCase);
}
public
static
string
FilterFrameset(
string
content)
{
string
regexstr
=
@"
(?i)<Frameset([^>])*>(\w|\W)*</Frameset([^>])*>
"
;
return
Regex.Replace(content,regexstr,
string
.Empty,RegexOptions.IgnoreCase);
}
//
移除非法或不友好字符
private
static
string
FilterBadWords(
string
chkStr)
{
//
这里的非法和不友好字符由你任意加,用“|”分隔,支持正则表达式,由于本Blog禁止贴非法和不友好字符,所以这里无法加上。
string
BadWords
=
@"
"
;
if
(chkStr
==
""
)
{
return
""
;
}
string
[] bwords
=
BadWords.Split(
'
#
'
);
int
i,j;
string
str;
StringBuilder sb
=
new
StringBuilder();
for
(i
=
0
; i
<
bwords.Length; i
++
)
{
str
=
bwords[i].ToString().Trim();
string
regStr,toStr;
regStr
=
str;
Regex r
=
new
Regex(regStr,RegexOptions.IgnoreCase
|
RegexOptions.Singleline
|
RegexOptions.Multiline);
Match m
=
r.Match(chkStr);
if
(m.Success)
{
j
=
m.Value.Length;
sb.Insert(
0
,
"
*
"
,j);
toStr
=
sb.ToString();
chkStr
=
Regex.Replace(chkStr,regStr,toStr,RegexOptions.IgnoreCase
|
RegexOptions.Singleline
|
RegexOptions.Multiline);
}
sb.Remove(
0
,sb.Length);
}
return
chkStr;
}
public
static
string
FilterAll(
string
content)
{
content
=
FilterHtml(content);
content
=
FilterScript(content);
content
=
FilterAHrefScript(content);
content
=
FilterObject(content);
content
=
FilterIframe(content);
content
=
FilterFrameset(content);
content
=
FilterSrc(content);
content
=
FilterBadWords(content);
//
content = FilterInclude(content);
return
content;
}
}
}
作者:
wpf之家
出处:
http://www.cnblogs.com/wpf123
本文版权归作者和博客园共有,欢迎转载,但未经作者同意必须保留此段声明,且在文章页面明显位置给出原文连接,否则保留追究法律责任的权利。
查看全文
相关阅读:
动态规划01背包
动态规划矩阵连乘
分治法归并排序
动态规划最长公共子序列
贪心算法活动安排
分治法二分查找
vue 可拖拽可缩放 vuedraggableresizable 组件常用总结
rifilter in python discussed in 3delight
3delight linear work flow
pixar stereo rendering doc
原文地址:https://www.cnblogs.com/wpf123/p/2347373.html
最新文章
Maven基础知识与使用总结
HTTP标头信息
Android 4.0中对话框项目文字无法用setText变更问题
如何将图片和文字同时分享到微信
Android图片内存优化的几点心得
Native C++中调用C++/C#/VB托管程序集(用C++保护.NET程序)
C++重绘CPropertySheet
用C++实现半透明按钮控件(PNG,GDI+)
让Discuz!NT论坛API支持在回帖时指定UID
2010年总结
热门文章
高效能人士的七个习惯 读书笔记1
最近我是面霸,今天我终于面罢
来上海两周了,面试及面试题
计算机很笨
搭建自己的svn服务器
App_Code(转)
比较.ASP.NET中Application,Session,Cookie,ViewState和Cache
Configuration命名空间找不到ConfigurationManager
分治法快速排序
Win8博文
Copyright © 2011-2022 走看看