ÀÌÁ¦ ¸· ½ºÇÁ¸µ ½ÃÀÛÇÏ°í °³¹ß ÇÏ°í Àִµ¥ ÆÄÀÏ ¾÷·Îµå °ü·Ã ÇÏ¿© ¹®ÀÇÁ» µå·Á º¾´Ï´Ù.
web.xml ¼³Á¤¿¡¼
filter>
filter-name>springSecurityFilterChain
filter-class>org.springframework.web.filter.DelegatingFilterProxy
/filter>
filter-mapping>
filter-name>springSecurityFilterChain
url-pattern>/*
/filter-mapping>
filter>
filter-name>multipartFilter
filter-class>org.springframework.web.multipart.support.MultipartFilter
init-param>
param-name>multipartResolverBeanName
param-value>multipartResolver
/init-param>
/filter>
filter-mapping>
filter-name>multipartFilter
url-pattern>/*
/filter-mapping>
filter>
filter-name>xssFilter
filter-class>com.withus.commons.XSSFilter
/filter>
filter-mapping>
filter-name>xssFilter
url-pattern>/*
/filter-mapping>
ÀÌ·¸°Ô µÇ¾î ÀÖ±¸¿ä
ÄÁÆ®·Ñ·¯¿¡¼
@RequestMapping(value="/site/updateLogoproc.do", method=RequestMethod.POST)
public String updateLogo(MultipartHttpServletRequest mpRequest, @ModelAttribute("logoVO") LogoVO logoVO) throws Exception {
//ÆÄÀϾ÷·Îµå
File dir = new File(prop.getProperty("LOGO_PATH"));
if (!dir.isDirectory()) {
dir.mkdirs();
}
Iterator it = mpRequest.getFileNames();
System.out.println(it.hasNext()); // À̺κп¡¼ °è¼ÓÇؼ false ·Î ³ª¿É´Ï´Ù.
while (it.hasNext()) {
MultipartFile multiFile = mpRequest.getFile((String) it.next());
===================
web.xml ¿¡¼ xssFilter ºÎºÐÀ» ÁÖ¼® ó¸®Çϸé Àß µË´Ï´Ù.
¶ÇÇÑ multipartFilter ¿Í xssFilter ºÎºÐÀÇ ¼ø¼¸¦ ¹Ù²ã ÁÖ¸é
input type='file' ·Î ¼±¾ð µÈ ºÎºÐµé¿¡¼
ÆÄÀÏ ¼±ÅÃÀ» ¾ÈÇϸé 82DC658993E7494FA9D86A6649F6153C ÀÌ·± ÆÄÀϵéÀÌ ¿Ã¶ó°©´Ï´Ù. (0¹ÙÀÌÆ®)
xss ´Â http://www.openeg.co.kr/383 ¿©±â¸¦ ÂüÁ¶ÇÏ¿© ¸¸µé¾ú½À´Ï´Ù.
°í¼ö´ÔµéÀÇ ´äº¯ ºÎŹ µå¸³´Ï´Ù ¤Ì.¤Ð
°¨»çÇÕ´Ï´Ù. | |
|