package cn.com.lemon.base.util;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

public final class Xxes {
	private final static Pattern URL_PATTERN = Pattern
			.compile("\\b(([\\w-]+://?|www[.])[^\\s()<>]+(?:[\\w\\d]+|([^[:punct:]\\s]|/)))");

	private Xxes() {
	}

	public static String xxe(String content) {
		Matcher matcher = URL_PATTERN.matcher(content);
		if (matcher.find()) {
			if (matcher.groupCount() == 1) {
				content = content.replace(matcher.group(0), "");
			} else {
				for (int i = 0; i < matcher.groupCount(); i++) {
					content = content.replace(matcher.group(i), "");
				}
			}
		}
		if (content != null && content.length() > 0) {
			content = content.replace("DOCTYPE", "").replace("SYSTEM", "").replace("ENTITY", "").replace("PUBLIC", "");
		}
		return content;
	}
}

@@ -91,16 +91,174 @@
 ttern;%0A%0A
+import static cn.com.lemon.base.Strings.isNullOrEmpty;%0A%0A/**%0A * Simple filter XXE third URL and sensitive words%0A * %0A * @author shaobo shih%0A * @version 1.0%0A */%0A
 public f
@@ -480,16 +480,84 @@
 tent) %7B%0A
+%09%09if (isNullOrEmpty(content))%0A%09%09%09return null;%0A%09%09// filter third URL%0A
 %09%09Matche
@@ -851,51 +851,62 @@
 %7D%0A%09%09
-if (content != null && content.length() %3E 0
+// filter sensitive word%0A%09%09if (!isNullOrEmpty(content)
 ) %7B%0A

update xxe not public instance