|
3 | 3 | import com.google.gson.Gson; |
4 | 4 | import java.io.PrintWriter; |
5 | 5 | import java.util.HashMap; |
6 | | -import java.util.Random; |
7 | 6 | import javax.servlet.http.HttpServletRequest; |
8 | 7 | import javax.servlet.http.HttpServletResponse; |
9 | 8 | import org.springframework.stereotype.Controller; |
10 | 9 | import org.springframework.web.bind.annotation.GetMapping; |
11 | | -import org.springframework.web.bind.annotation.RequestMapping; |
12 | | -import org.springframework.web.bind.annotation.RequestMethod; |
13 | 10 | import org.springframework.web.bind.annotation.ResponseBody; |
14 | 11 |
|
15 | 12 | @Controller |
16 | | -public class JsonpInjection { |
| 13 | +public class JsonpController { |
17 | 14 | private static HashMap hashMap = new HashMap(); |
18 | 15 |
|
19 | 16 | static { |
@@ -96,54 +93,13 @@ public void bad6(HttpServletRequest request, |
96 | 93 |
|
97 | 94 | @GetMapping(value = "jsonp7") |
98 | 95 | @ResponseBody |
99 | | - public String good(HttpServletRequest request) { |
100 | | - String resultStr = null; |
101 | | - String jsonpCallback = request.getParameter("jsonpCallback"); |
102 | | - |
103 | | - String val = ""; |
104 | | - Random random = new Random(); |
105 | | - for (int i = 0; i < 10; i++) { |
106 | | - val += String.valueOf(random.nextInt(10)); |
107 | | - } |
108 | | - // good |
109 | | - jsonpCallback = jsonpCallback + "_" + val; |
110 | | - String jsonStr = getJsonStr(hashMap); |
111 | | - resultStr = jsonpCallback + "(" + jsonStr + ")"; |
112 | | - return resultStr; |
113 | | - } |
114 | | - |
115 | | - @GetMapping(value = "jsonp8") |
116 | | - @ResponseBody |
117 | 96 | public String good1(HttpServletRequest request) { |
118 | 97 | String resultStr = null; |
119 | | - String jsonpCallback = request.getParameter("jsonpCallback"); |
120 | 98 |
|
121 | 99 | String token = request.getParameter("token"); |
122 | 100 |
|
123 | | - // good |
124 | 101 | if (verifToken(token)){ |
125 | | - System.out.println(token); |
126 | | - String jsonStr = getJsonStr(hashMap); |
127 | | - resultStr = jsonpCallback + "(" + jsonStr + ")"; |
128 | | - return resultStr; |
129 | | - } |
130 | | - |
131 | | - return "error"; |
132 | | - } |
133 | | - |
134 | | - @GetMapping(value = "jsonp9") |
135 | | - @ResponseBody |
136 | | - public String good2(HttpServletRequest request) { |
137 | | - String resultStr = null; |
138 | | - String jsonpCallback = request.getParameter("jsonpCallback"); |
139 | | - |
140 | | - String referer = request.getHeader("Referer"); |
141 | | - |
142 | | - boolean result = verifReferer(referer); |
143 | | - |
144 | | - boolean test = result; |
145 | | - // good |
146 | | - if (test){ |
| 102 | + String jsonpCallback = request.getParameter("jsonpCallback"); |
147 | 103 | String jsonStr = getJsonStr(hashMap); |
148 | 104 | resultStr = jsonpCallback + "(" + jsonStr + ")"; |
149 | 105 | return resultStr; |
|
0 commit comments