java - 拒绝服务:regular expression : fortify pointed out a issue

Question

您好，我收到拒绝服务:下面一行的正则表达式警告

billingApplicationAcctId = billingApplicationAcctId.replaceAll("\"+ s, "");

您可以查看以下代码以供进一步引用

   if (null != formatBillingAcctIdInd && formatBillingAcctIdInd.equals("Y")
                    && billingApplicationCode.equalsIgnoreCase(EPWFReferenceDataConstants.BILLING_APPICATION_ID.KENAN.name())) {
                Pattern pt = Pattern.compile("[^a-zA-Z0-9]");
                Matcher match = pt.matcher(payment.getBillingApplicationAccntId());
                while (match.find()) {
                    String s = match.group();
                    billingApplicationAcctId = billingApplicationAcctId.replaceAll("\\" + s, "");
                }
            }

我应该做什么来代替上面的代码，这样我就不会收到 fortify DOS 警告

Answer 1

如果您想摆脱正则表达式代码，您可以按字符比较输入。只需更换即可

Pattern pt = Pattern.compile("[^a-zA-Z0-9]");
Matcher match = pt.matcher(payment.getBillingApplicationAccntId());
while (match.find()) {
    String s = match.group();
    billingApplicationAcctId = billingApplicationAcctId.replaceAll("\\" + s, "");
}

与:

String rawInput = payment.getBillingApplicationAccntId();
StringBuilder sb = new StringBuilder();
for (char c : rawInput.toCharArray()) {
    // any char that is an english letter or 0-9 is included. The rest is thrown away...
    if ((c >= 'a' && c <= 'z')
            || (c >= 'A' && c <= 'Z')
            || (c >= '0' && c <= '9')) {
        sb.append(c);
    }
}
billingApplicationAcctId = sb.toString();