Java 如何清理输入
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/24353728/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Howto sanitize inputs
提问by Léa Massiot
I am willing to use "OWASP ESAPI for Java" to sanitize users inputs when they submits forms in a Tomcat Webapp.
当用户在 Tomcat Webapp 中提交表单时，我愿意使用“OWASP ESAPI for Java”来清理用户输入。
I used to use org.apache.commons.lang.StringEscapeUtilslike this:
我曾经这样使用org.apache.commons.lang.StringEscapeUtils：
public static String myEscapeHtml(String s)
{
String s_escapedString = null;
s_escapedString = StringEscapeUtils.escapeHtml(s);
return s_escapedString;
}
I don't know anymore if this is good enough to protect the webapp "reasonably"...
我不知道这是否足以“合理地”保护网络应用程序......
I would like to know what lines of code I should write to use the OWASP ESAPI to sanitize a Tomcat webapp user inputs.
我想知道我应该编写哪些代码行来使用 OWASP ESAPI 来清理 Tomcat webapp 用户输入。
Can you give an example in which one or several ESAPI "filters" (escaping?, encoding? ...) would be applied to a string to sanitize it?
你能举一个例子，其中一个或几个 ESAPI“过滤器”（转义？，编码？...）将应用于字符串以对其进行清理？
The backend RDBMS is PostgreSQL.
后端 RDBMS 是 PostgreSQL。
The Tomcat server can either be be running on a Linux server or on a Windows server.
Tomcat 服务器可以运行在 Linux 服务器或 Windows 服务器上。
Thank you and best regards.
感谢你并致以真诚的问候。
回答by avgvstvs
For input validation, you'll use org.owasp.esapi.reference.DefaultValidator.
对于输入验证，您将使用org.owasp.esapi.reference.DefaultValidator.
If you want to define your own validation rules in validation.properties, the technique to do that is demonstrated in answers to this question.
如果您想在 中定义自己的验证规则validation.properties，此问题的答案中演示了实现此目的的技术。
For output escaping, that's actually quite easier. Preferably when inserting data into an object that will be sent to the presentation layer, you'll want to use String output = ESAPI.encoder().escapeForHTML(String s);methods.
对于输出转义，这实际上相当容易。最好在将数据插入将发送到表示层的对象中时，您需要使用String output = ESAPI.encoder().escapeForHTML(String s);方法。
The full list of methods is defined in org.owasp.esapi.Encoder.
方法的完整列表在 中定义org.owasp.esapi.Encoder。
