XSS 방어 (@RequestBody)

XSS 방어용 서블릿 필터에서 사용하는 코드를 JSON에도 적용시켜본다.

@Configuration
@ConditionalOnClass(name="com.fasterxml.jackson.databind.ObjectMapper")
protected static class JacksonCustomizerConfig {

	@Bean
	public Jackson2ObjectMapperBuilderCustomizer objectMapperBuilderCustomizer() {
		return customizer -> customizer.findModulesViaServiceLoader(true);
	}
}

@Configuration
@ConditionalOnClass(name="com.fasterxml.jackson.databind.module.SimpleModule")
public static class JacksonModuleProvider {

	@Bean
	public SimpleModule xssProtectionModule() {
		return new SimpleModule("XssProtectionModule", Version.unknownVersion(), ImmutableMap.of(String.class, new XssProtectionJsonDeserializer()));
	}
}

static class XssProtectionJsonDeserializer extends StringDeserializer implements ContextualDeserializer {

	private static final long serialVersionUID = 1L;

	@Override
	public JsonDeserializer<String> createContextual(final DeserializationContext c, final BeanProperty bp) {
		return this;
	}

	@Nullable @Override
	public String deserialize(final JsonParser p, final DeserializationContext c) throws IOException {
		return com.nhncorp.lucy.security.xss.XssPreventer.escape(super.deserialize(p, c));
	}
}