XSSWebFilter.java - 실제 구현된 코드

public class XSSWebFilter implements Filter {
    // ...
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        // ...
        if (isRequestCheck) {
            // 파라미터에 특수문자 포함 시 제거
            chain.doFilter(new HTMLTagFilterRequestWrapper(req), response);
        } else {
            chain.doFilter(request, response);
        }
        // ...
    }
}

실제 구현된 XSS 필터 설정

<filter>
    <filter-name>XSSWebFilter</filter-name>
    <filter-class>humanframe.web.filter.XSSWebFilter</filter-class>
    <async-supported>true</async-supported>
</filter>
<filter-mapping>
    <filter-name>XSSWebFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

HumanCryptoServiceImpl.java - 실제 구현된 코드

@Service("humanCryptoService")
public class HumanCryptoServiceImpl extends HumanAbstractServiceImpl implements HumanCryptoService {

    @Resource(name="propertiesService")
    private EgovPropertyService properties;

    @Resource(name="ARIACryptoService")
    private EgovCryptoService cryptoService;

    @Resource(name="passwordEncoder")
    public EgovPasswordEncoder egovPasswordEncoder;

    @Override
    public String encrypt(String str) throws Exception {
        byte[] encrypted = cryptoService.encrypt(str.getBytes("UTF-8"), properties.getString("CRYPTO_KEY"));
        String encryptStr = new String(Base64.encodeBase64(encrypted));
        return encryptStr;
    }

    @Override
    public String decrypt(String str) throws Exception {
        byte[] decrypted = cryptoService.decrypt(Base64.decodeBase64(str.getBytes()), properties.getString("CRYPTO_KEY"));
        return new String(decrypted, "UTF-8");
    }

    /**
     * 비밀번호를 암호화하는 기능(복호화가 되면 안되므로 SHA-256 인코딩 방식 적용)
     */
    @Override
    public String encryptPassword(String password, String id) throws Exception {
        if (password == null) {
            return "";
        }

        byte[] hashValue = null; // 해쉬값
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        md.reset();
        md.update(id.getBytes());
        hashValue = md.digest(password.getBytes());

        return new String(Base64.encodeBase64(hashValue));
    }
}

AdminPrivacyAspect.java - 실제 구현된 코드

@Aspect
@Order(2)
@Component
public class AdminPrivacyAspect {

    @Resource(name = "mngPrivacyService")
    private MngPrivacyService mngPrivacyService;

   // 관리자 권한 체크
   @Pointcut("execution(* humanframe.backoffice..Admin*Controller.form(..))"
           + "|| execution(* humanframe.backoffice..Admin*Controller.list(..))"
           + "|| execution(* humanframe.backoffice..Admin*Controller.view(..))"
           + "|| execution(* humanframe.backoffice..Admin*Controller.action(..))"
           + "|| execution(* humanframe.web.controller.admin..Admin*Controller.list(..))"
           + "|| execution(* humanframe.web.controller.admin..Admin*Controller.view(..))"
           + "|| execution(* humanframe.web.controller.admin..Admin*Controller.form(..))"
           + "|| execution(* humanframe.web.controller.admin..Admin*Controller.action(..))")
    private void checkAdminPrivacy() {}

    @Before(value = "checkAdminPrivacy()")
    private void beforeCheckAdminPrivacy(JoinPoint joinPoint) throws Exception {
        HttpServletRequest request = null;
        for (Object o : joinPoint.getArgs()) {
            if (o instanceof HttpServletRequest)
                request = (HttpServletRequest)o;
        }

        if(request != null) {
            // 개인정보 접근이력 저장
            String logTxt = "IP:" + request.getRemoteAddr() + ", " + className + "." + methodName;
            for(MngMenuVO sessMenuVO : mngrSession.getMngMenuList()){
                if(sessMenuVO.getMenuUrl().contains(request.getServletPath().substring(0,request.getServletPath().lastIndexOf("/")))){
                    if(sessMenuVO.getPrivacyAt().equals("Y")) {
                        mngPrivacyService.createMngPriacyAccess(logTy, request.getServletPath(), logTxt);
                    }
                }
            }
        }
    }
}

실제 구현된 HTTP 보안 설정

<session-config>
    <session-timeout>60</session-timeout>
    <cookie-config>
        <http-only>true</http-only> <!-- 서버 요청이 있을 때에만 쿠키가 전송되도록 설정 -->
        <!-- <secure>true</secure> --> <!-- SSL 통신 채널 연결 시에만 쿠키를 전송 하도록 설정 -->
    </cookie-config>    
    <tracking-mode>COOKIE</tracking-mode>        
</session-config>

<security-constraint>
    <display-name></display-name>
    <web-resource-collection>
        <web-resource-name>restricted methods</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>TRACE</http-method>
        <http-method>DELETE</http-method>
        <http-method>PUT</http-method>
        <http-method>HEAD</http-method>
        <http-method>OPTIONS</http-method>
    </web-resource-collection>
    <auth-constraint>
        <role-name>nobody</role-name>
    </auth-constraint>
</security-constraint>

HumanValidatorUtil.java - 실제 코드 일부

public class HumanValidatorUtil {

    // 정규식 패턴
    final static private String pattern_alpha = "^[A-Za-z]*$";
    final static private String pattern_numeric = "^[0-9]*$";
    final static private String pattern_korean = "^[ㄱ-ㅎ|가-힣]*$";
    final static private String pattern_email = "^[-A-Za-z0-9_]+[-A-Za-z0-9_.]*[@]{1}[-A-Za-z0-9_]+[-A-Za-z0-9_.]*[.]{1}[A-Za-z]{2,5}$";
    final static private String pattern_url = "^(https?)://[-a-zA-Z0-9+&@#/%?=~_|!:,.;]*[-a-zA-Z0-9+&@#/%=~_|]";
    final static private String pattern_invalid_password = "^(?=.*?[a-zA-Z])(?=.*?[0-9])(?=.*?[#?!@$%^&*-]).{8,25}$";
    
    // 이메일 검증
    public static boolean isEmail(String value) {
        return nullChecker(5, value);
    }
    
    // URL 검증
    public static boolean isUrl(String value) {
        return nullChecker(6, value);
    }
    
    // 비밀번호 복잡성 검증
    public static boolean isValidPassword(String value){
        return nullChecker(10, value);
    }
    
    // 알파벳+숫자 조합 검증
    public static boolean isAlphaNumeric(String value) {
        if (!nullChecker(value)) {
            boolean bReturn = true;
            char[] cArr = value.toCharArray();
            int alphaLen = 0;
            int numericLen = 0;
            for (char c : cArr) {
                if (isAlpha(String.valueOf(c))) {
                    alphaLen++;
                }
                if (isNumeric(String.valueOf(c))) {
                    numericLen++;
                }
            }

            if ((alphaLen == 0) || (numericLen == 0) || (cArr.length != (alphaLen + numericLen))){
                bReturn = false;
            }

            return bReturn;
        } else {
            return false;
        }
    }
}

<select id="bbs.selectBbs" parameterType="java.util.Map" resultType="humanframe.web.vo.BbsVO">
    SELECT 
        bbs_no,
        title,
        content,
        reg_dt
    FROM 
        tn_bbs 
    WHERE 
        bbs_no = #{bbsNo}
</select>