|
1 | | -package clap.server.adapter.inbound.web; |
| 1 | +package clap.server.adapter.inbound.web.xss; |
2 | 2 |
|
3 | 3 | import clap.server.common.annotation.architecture.WebAdapter; |
4 | 4 | import clap.server.common.annotation.swagger.DevelopOnlyApi; |
5 | 5 | import io.swagger.v3.oas.annotations.Operation; |
6 | | -import jakarta.servlet.http.HttpServletRequest; |
| 6 | +import io.swagger.v3.oas.annotations.tags.Tag; |
7 | 7 | import lombok.extern.slf4j.Slf4j; |
8 | 8 | import org.springframework.http.ResponseEntity; |
9 | 9 | import org.springframework.web.bind.annotation.*; |
10 | 10 |
|
11 | 11 | @Slf4j |
12 | 12 | @WebAdapter |
13 | 13 | @RequestMapping("/api/xss-test") |
| 14 | +@Tag(name = "xss 공격 테스트 API", description = "아래와 같은 페이로드들에 대해 테스트합니다.\n" + |
| 15 | + "1. 기본적인 스크립트 삽입: `<script>alert('xss')</script>`\n" + |
| 16 | + "2. 이미지 태그를 이용한 XSS: `<img src=x onerror=alert('xss')>`\n" + |
| 17 | + "3. JavaScript 프로토콜: `javascript:alert('xss')`\n" + |
| 18 | + "4. HTML 이벤트 핸들러:` <div onmouseover=\"alert('xss')\">hover me</div>`\n" + |
| 19 | + "5. SVG를 이용한 XSS: `<svg><script>alert('xss')</script></svg>`\n" + |
| 20 | + "6. HTML5 태그를 이용한 XSS: `<video><source onerror=\"alert('xss')\">`") |
14 | 21 | public class XssTestController { |
15 | 22 |
|
16 | 23 | @GetMapping |
17 | 24 | @DevelopOnlyApi |
18 | | - @Operation(summary = "단일 파라미터 xss test") |
| 25 | + @Operation(summary = "단일 파라미터 test") |
19 | 26 | public ResponseEntity<String> testGetXss(@RequestParam String input) { |
20 | 27 | log.info("Received GET input: {}", input); |
21 | 28 | return ResponseEntity.ok("Processed GET input: " + input); |
22 | 29 | } |
23 | 30 |
|
24 | 31 | @PostMapping |
25 | 32 | @DevelopOnlyApi |
26 | | - @Operation(summary = "dto xss test") |
| 33 | + @Operation(summary = "dto test") |
27 | 34 | public ResponseEntity<XssTestResponse> testPostXss(@RequestBody XssTestRequest request) { |
28 | 35 | log.info("Received POST input: {}", request); |
29 | 36 | return ResponseEntity.ok(new XssTestResponse(request.content())); |
30 | 37 | } |
31 | 38 |
|
32 | 39 | @GetMapping("/multi-params") |
33 | | - @Operation(summary = "다중 파라미터 XSS 테스트") |
| 40 | + @Operation(summary = "다중 파라미터 테스트") |
34 | 41 | public ResponseEntity<String> testMultiParamXss(@RequestParam(value = "inputs", required = false) String[] inputs) { |
35 | 42 | if (inputs == null || inputs.length == 0) { |
36 | 43 | return ResponseEntity.badRequest().body("No inputs provided"); |
|
0 commit comments