1 JAvA 11 11. CXSS 1?. SO| 88. SO| : J0O 4. SO| : Pers|stence 7. SO| : mybat|s 0ata Vap OG. 117. 188. 1O. |0AP 171O. |0AP 1O11. ?11?. |TTP ?818. ?14. : 0OV ?71. ?O1G. 8117. 8?18. 881O. 8?O. 87?1. SO| : ||bernate 8O??. uR| 41?8. XPath 48?4. XOuery 4?. 47? AP| 4O1. J?FF: 4O?. J?FF: 18. 0|S |cckup 84. J?FF: System.ex|tC . nu|| 7G. FJ6: O7. equa|sC hashCcdeC GO8 G?1. G??. G8. G84. GO. : 7OG. 7?7. 748. 7GO. 7O1O. 8111. : 881?. 8418. 8G14. 881. : RSA OO1G. : O?17. O418. OG1O. : O7?O. OO?1. : 1O1??. 1O8?8. |TTPS 1O4?4. 1OG?. 1O84 1OO1. : 1OO?. : 1118. : 11?4. J?FF : 11G. 118G. 1?O7. 1?? 1?81. 1?8?. 1?8. 1?G4. 1?8G 18O1. : nct|fyC 18O?. 1818. 1884. : ser|a|Pers|stentF|e|ds 184. : Thread.runC 18G. : 18G7. 1887 14O1. 14O?. 14?8. 1484. F|na| 144. pr|vate - 14G. pr|vate - 14G7. 1478. 148? 14O1 14O? 11 CWE-ID(XSS) CWE-80SQL CWE-89SQL:JDO CWE-89SQL:Persistence CWE-89SQL:myBatisDataMap CWE-89 CWE-23 CWE-36 CWE-78LDAP CWE-90LDAP CWE-90 CWE-99HTTP CWE-113 CWE-15:DOM CWE-80 CWE-95 CWE-114 CWE-190 CWE-434 CWE-470 CWE-494SQL:Hibernate CWE-564URL CWE-601XPath CWE-643XQuery CWE-652 CWE-807API J2EE: CWE-245JAVA CWE-IDJ2EE: CWE-246DNSlookup CWE-247J2EE:System.exit() CWE-382null CWE-398EJB: CWE-577equals()hashCode() CWE-581 CWE-259 CWE-285 CWE-352 CWE-613: CWE-226 CWE-255 CWE-256 CWE-260 CWE-261 CWE-306: CWE-310 CWE-311 CWE-319 CWE-321:RSA CWE-325: CWE-326 CWE-327 CWE-330: CWE-359 CWE-ID CWE-521: CWE-539 CWE-605HTTPS CWE-614 CWE-615 CWE-732: CWE-362: CWE-362: CWE-367J2EE: CWE-383 CWE-386 CWE-609 CWE-674 CWE-521 CWE-209 CWE-390 CWE-754:notify() CWE-362 CWE-404 CWE-476:serialPersistentFields CWE-485:Thread.run() CWE-572: CWE-665 CWE-770 CWE-488 CWE-ID CWE-489 CWE-492Final CWE-493private- CWE-495private- CWE-496 CWE-497 CWE-54511 JAVA1. , .1. (XSS)(ImproperNeutralizationofScript-RelatedHTMLTagsinaWebPage(BasicXSS)). ,.. ,replaceAll() .. -HTML1: 2: 3: 4: 5: 6: 7:XSSSample 8:12: 13:NAME: 14: 15:name, .name,

attack.jsp,.(:url="http://devil.com/attack.jsp;) -HTML1: 2: 3: 4: 5: 6: 7:XSSSample 8:13:if(name!=null){14:name=name.replaceAll("",">");16:}else{17:return;18:}19:%>20: 21:NAME: 22: 23: replaceAll()