java 安全编码指南之: 输入校验

    public void testNormalizer(){
        System.out.println(Normalizer.normalize("\u00C1", Normalizer.Form.NFKC));
        System.out.println(Normalizer.normalize("\u0041\u0301", Normalizer.Form.NFKC));
    }
1.
2.
3.
4.

Á
Á
1.
2.

    public void falseNormalize(){
        String s = "\uFE64" + "script" + "\uFE65";
        Pattern pattern = Pattern.compile("[<>]"); // 检查是否有尖括号
        Matcher matcher = pattern.matcher(s);
        if (matcher.find()) {
            throw new IllegalStateException();
        }
        s = Normalizer.normalize(s, Normalizer.Form.NFKC);
    }
1.
2.
3.
4.
5.
6.
7.
8.
9.

    public void trueNormalize(){
        String s = "\uFE64" + "script" + "\uFE65";
        s = Normalizer.normalize(s, Normalizer.Form.NFKC);
        Pattern pattern = Pattern.compile("[<>]"); // 检查是否有尖括号
        Matcher matcher = pattern.matcher(s);
        if (matcher.find()) {
            throw new IllegalStateException();
        }
    }
1.
2.
3.
4.
5.
6.
7.
8.
9.

    public void wrongFormat(){
        Calendar c = new GregorianCalendar(2020, GregorianCalendar.JULY, 27);
        String input=" %1$tm";
        System.out.format(input + " 时间不匹配，应该是某个月的第 %1$terd 天", c);
    }
1.
2.
3.
4.
5.

 07 时间不匹配，应该是某个月的第 27rd 天
1.

    public void rightFormat(){
        Calendar c = new GregorianCalendar(2020, GregorianCalendar.JULY, 27);
        String input=" %1$tm";
        System.out.format("%s 时间不匹配，应该是某个月的第 %terd 天",input, c);
    }
1.
2.
3.
4.
5.

 %1$tm 时间不匹配，应该是某个月的第 27rd 天
1.