From f6022809767553902133bb897b341211bf603e0b Mon Sep 17 00:00:00 2001 From: daekuk Date: Fri, 9 Jan 2026 11:19:29 +0900 Subject: [PATCH] =?UTF-8?q?XSS=20=ED=95=84=ED=84=B0=EB=A1=9C=20=EC=9D=B8?= =?UTF-8?q?=ED=95=9C=20()=20=ED=91=9C=EA=B8=B0=EC=98=A4=EB=A5=98=20?= =?UTF-8?q?=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../rule/transform2/transform2ManDetail.jsp | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/WebContent/jsp/onl/admin/rule/transform2/transform2ManDetail.jsp b/WebContent/jsp/onl/admin/rule/transform2/transform2ManDetail.jsp index ed96fd4..d37ab64 100644 --- a/WebContent/jsp/onl/admin/rule/transform2/transform2ManDetail.jsp +++ b/WebContent/jsp/onl/admin/rule/transform2/transform2ManDetail.jsp @@ -705,11 +705,22 @@ $("input[name=eaiSvcName]").val('${param.eaiSvcName }'); var rawDesc = '${param.eaiSvcDesc}'; + + // XSS filter 값 복구 + function decodeHTMLEntities(text) { + if (!text) return ""; + var textArea = document.createElement('textarea'); + textArea.innerHTML = text; + return textArea.value; + } + + var cleanDesc = decodeURIComponent(rawDesc); + cleanDesc = decodeHTMLEntities(cleanDesc); - if (rawDesc && rawDesc !== "") { - $("input[name=eaiSvcDesc]").val(decodeURIComponent(rawDesc)); + if (cleanDesc) { + $("input[name=eaiSvcDesc]").val(cleanDesc); } else { - $("input[name=eaiSvcDesc]").val(""); + $("input[name=eaiSvcDesc]").val(""); } //$("input[name=cnvsnDesc]").val('${param.cnvsnDesc }');