java - 为什么 StringBuilder 中无法使用 ReplaceAll 方法

Question

我正在使用 sonarQube 进行代码扫描。我发现问题引入新变量而不是重用参数“值”。我应该使用 StringBuilder 而不是 String 还是引入一个新变量？下面是我的代码。

private String stripXSS(String value) {

        if (StringUtils.isNotBlank(value)) {

            value = value.replaceAll("", "");

            Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            value = value.replace("&", "&amp;");
            value = value.replace(">", "&gt;");
            value = value.replace("<", "&lt;");
        }
        return value;
    }

Answer 1

对于您的问题，我应该使用 StringBuilder 而不是 String 还是引入新变量？

以下是String、StringBuffer和StringBuilder之间的比较...您应该根据您的需要使用...即内存、性能等

                  String                    StringBuffer         StringBuilderStorage Area | Constant String Pool    |       Heap         |           HeapModifiable   |  No (immutable)         |   Yes( mutable )   |      Yes( mutable )Thread Safe  |     Yes                 |       Yes          |             No Performance |   Fast                  |    Very slow       |            Fast