商品详情反转义

mp-admin/src/main/java/com/qs/mp/web/controller/api/admin/GoodsMgrController.java

@@ -5,6 +5,7 @@ import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
 import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.baomidou.mybatisplus.extension.service.IService;
+import com.google.common.html.HtmlEscapers;
 import com.qs.mp.admin.domain.Coupon;
 import com.qs.mp.admin.domain.Goods;
 import com.qs.mp.admin.domain.GoodsCategory;
@@ -29,6 +30,7 @@ import com.qs.mp.common.core.page.TableDataInfo;
 import com.qs.mp.common.enums.ChannelRoleEnum;
 import com.qs.mp.common.enums.CouponStatusEnum;
 import com.qs.mp.common.enums.ErrorCodeEnum;
+import com.qs.mp.common.utils.html.EscapeUtil;
 import com.qs.mp.system.domain.SysUser;
 import com.qs.mp.system.service.ISysUserService;
 import com.qs.mp.utils.SecurityUtils;
@@ -38,10 +40,13 @@ import io.swagger.annotations.ApiOperation;
 import ma.glasnost.orika.MapperFacade;
 
 import java.math.BigDecimal;
+import java.net.URI;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 
+import org.apache.commons.codec.Decoder;
+import org.apache.commons.lang3.StringEscapeUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.BeanUtils;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -156,7 +161,8 @@ public class GoodsMgrController extends BaseApiController {
 		if(titleCount > 0) {
 			return AjaxResult.error("商品名称" + goods.getTitle() + "已存在！");
 		}
-		
+		String description = EscapeUtil.unescape(goodsParam.getDescription());
+		goods.setDescription(description);
 		// 多SKU
 		List<GoodsSku> skuList = goodsParam.getSkuList();
 		if(goods.getMultiSku() == 1) { // 

mp-common/src/main/java/com/qs/mp/common/utils/html/EscapeUtil.java

@@ -144,7 +144,7 @@ public class EscapeUtil
 
     public static void main(String[] args)
     {
-        String html = "<script>alert(1);</script>";
+        String html = "<script>中文alert(1);</script>";
         // String html = "<scr<script>ipt>alert(\"XSS\")</scr<script>ipt>";
         // String html = "<123";
         // String html = "123>";