add xss demo

java-realworld/sample/pom.xml

@@ -55,7 +55,6 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-freemarker</artifactId>
         </dependency>
-
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-test</artifactId>

java-realworld/sample/src/main/java/com/example/demo/DemoApplication.java

@@ -1,13 +1,16 @@
 package com.example.demo;
 
+import com.example.demo.controller.utils.DBUtil;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.ConfigurableApplicationContext;
+import org.springframework.jdbc.core.JdbcTemplate;
 
 @SpringBootApplication
 public class DemoApplication {
 
-	public static void main(String[] args) {
-		SpringApplication.run(DemoApplication.class, args);
-	}
-
+    public static void main(String[] args) {
+        ConfigurableApplicationContext context = SpringApplication.run(DemoApplication.class, args);
+        DBUtil.setJdbcTemplate(context.getBean(JdbcTemplate.class));
+    }
 }

java-realworld/sample/src/main/java/com/example/demo/controller/deepcross/DeepCrossController.java

@@ -0,0 +1,41 @@
+package com.example.demo.controller.deepcross;
+
+import com.example.demo.controller.utils.DummyUtil;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class DeepCrossController {
+    @GetMapping({"/xss/safe", "/xss/no-cross"})
+    public ResponseEntity<String> noDeepCross(@RequestParam(required = false) String body) {
+        if (body == null) {
+            return ResponseEntity.ok("No input, try <a href='/xss/no-cross?body=hello-world'>here</a>");
+        }
+        ResponseEntity<String> resp = ResponseEntity.ok(body);
+        return resp;
+    }
+
+    @GetMapping({"/xss/unsafe1", "/xss/cross-method"})
+    public ResponseEntity<String> CrossMethod(@RequestParam String body) {
+        return DeepCrossController.directWrite(body);
+    }
+
+    private static ResponseEntity<String> directWrite(String body) {
+        ResponseEntity<String> resp = ResponseEntity.ok(body);
+        return resp;
+    }
+
+    @GetMapping({"/xss/unsafe2", "/xss/cross-other-method"})
+    public ResponseEntity<String> CrossMethod3(@RequestParam String body) {
+        return directWrite(DummyUtil.nothing(body));
+    }
+
+    @GetMapping({"/xss/unsafe3", "/xss/cross-other-filter"})
+    public ResponseEntity<String> CrossMethod4(@RequestParam String body) {
+        return directWrite(DummyUtil.filterXSS(body));
+    }
+}
+

java-realworld/sample/src/main/java/com/example/demo/controller/global/GlobalExceptionHandler.java

@@ -0,0 +1,22 @@
+package com.example.demo.controller.global;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.ControllerAdvice;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+
+import java.io.PrintWriter;
+import java.io.StringWriter;
+
+@ControllerAdvice
+public class GlobalExceptionHandler {
+    @ExceptionHandler(value = {Exception.class})
+    public ResponseEntity<Object> handleException(Exception ex) {
+        StringWriter sw = new StringWriter();
+        PrintWriter pw = new PrintWriter(sw);
+        // 打印异常信息到控制台
+        ex.printStackTrace(pw);
+        // 将异常信息返回到结果中
+        return new ResponseEntity<>(sw.toString(), HttpStatus.INTERNAL_SERVER_ERROR);
+    }
+}

java-realworld/sample/src/main/java/com/example/demo/controller/utils/DBUtil.java

@@ -0,0 +1,20 @@
+package com.example.demo.controller.utils;
+
+import org.springframework.jdbc.core.JdbcTemplate;
+
+import java.util.List;
+import java.util.Map;
+
+public class DBUtil {
+
+    private static JdbcTemplate jdbcTemplate = null;
+
+    public static void setJdbcTemplate(JdbcTemplate tmp) {
+        jdbcTemplate = tmp;
+    }
+
+    public static List<Map<String, Object>> querySomeResult(String whereCondition) {
+        String sql = "SELECT * FROM your_table WHERE " + whereCondition;
+        return jdbcTemplate.queryForList(sql);
+    }
+}

java-realworld/sample/src/main/java/com/example/demo/controller/utils/DummyUtil.java

@@ -0,0 +1,11 @@
+package com.example.demo.controller.utils;
+
+public class DummyUtil {
+    public static String filterXSS(String s) {
+        return s.replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+    }
+
+    public static String nothing(String s) {
+        return s;
+    }
+}