package com.slodon.b2b2c.starter.datasource.xss;

import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.databind.DeserializationContext;
import com.fasterxml.jackson.databind.JsonDeserializer;
import com.slodon.b2b2c.core.config.DomainUrlUtil;
import com.slodon.b2b2c.core.controller.BaseController;
import com.slodon.b2b2c.core.xss.HtmlUtil;
import lombok.extern.slf4j.Slf4j;
import org.jsoup.Jsoup;

import java.io.IOException;

/**
 * json格式参数 xss 处理
 *
 */
@Slf4j
public class JacksonXssEncoder extends JsonDeserializer<String> {

	@Override
	public String deserialize(JsonParser p, DeserializationContext ctx) throws IOException {
		// XSS filter
		String value = p.getValueAsString();
		String text;
		if (DomainUrlUtil.XSS_MODE == 2){
			//xss转义模式
			text = HtmlUtil.encode(value);
		}else {
			text = Jsoup.clean(value, BaseController.WHITE_LIST);
		}
		if (!value.equals(text)){
			log.debug("XSS清洗，清洗前：{}，清洗后：{}",value,text);
		}
		return text;
	}
}
