|
4 | 4 | import com.fasterxml.jackson.databind.DeserializationContext; |
5 | 5 | import com.fasterxml.jackson.databind.JsonDeserializer; |
6 | 6 | import com.fasterxml.jackson.databind.ObjectMapper; |
| 7 | +import com.fasterxml.jackson.databind.SerializationFeature; |
7 | 8 | import com.fasterxml.jackson.databind.module.SimpleModule; |
| 9 | +import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule; |
8 | 10 | import lombok.extern.slf4j.Slf4j; |
9 | 11 | import org.jsoup.Jsoup; |
10 | 12 | import org.jsoup.safety.Safelist; |
|
13 | 15 |
|
14 | 16 | import java.io.IOException; |
15 | 17 |
|
16 | | -// XSS 방지를 위한 Jackson 설정 |
| 18 | + |
17 | 19 | @Slf4j |
18 | 20 | @Configuration |
19 | 21 | public class JacksonConfig { |
20 | 22 |
|
21 | 23 | @Bean |
22 | 24 | public ObjectMapper objectMapper() { |
23 | 25 | ObjectMapper mapper = new ObjectMapper(); |
24 | | - SimpleModule module = new SimpleModule(); |
25 | | - module.addDeserializer(String.class, new JsonHtmlXssDeserializer()); |
26 | | - mapper.registerModule(module); |
| 26 | + |
| 27 | + mapper.registerModule(new JavaTimeModule()); |
| 28 | + mapper.disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS); |
| 29 | + |
| 30 | + // XSS 방지를 위한 커스텀 모듈 추가 |
| 31 | + SimpleModule xssModule = new SimpleModule(); |
| 32 | + xssModule.addDeserializer(String.class, new JsonHtmlXssDeserializer()); |
| 33 | + mapper.registerModule(xssModule); |
| 34 | + |
27 | 35 | return mapper; |
28 | 36 | } |
29 | 37 |
|
| 38 | + // XSS 방지를 위한 Jackson 설정 |
30 | 39 | public static class JsonHtmlXssDeserializer extends JsonDeserializer<String> { |
31 | 40 | @Override |
32 | 41 | public String deserialize(JsonParser p, DeserializationContext ctxt) throws IOException { |
|
0 commit comments