Safety protection method and device based on HTML (Hypertext Markup Language) tag and attribute white list and medium

Abstract

The invention provides a security protection method and device based on an HTML tag and an attribute white list, equipment and a medium, and relates to the technical field of network security protection. The method comprises the steps of obtaining first input data input by a user; converting the first input data into second input data in a target format based on a data analysis instruction; and performing malicious data filtering on the second input data based on a preset verification white list, and outputting target input data. According to the method, the first input data input by the user is converted into the second input data in the specific format according to the data analysis instruction, and the safety and consistency of the input data can be ensured. The second input data is filtered by verifying the white list, it is guaranteed that only tags and attributes which are considered to be safe are allowed to be used in the webpage, potential malicious data can be effectively removed or rejected, and therefore the risk of XSS attacks is greatly reduced.

Description

Technical Field

[0001] The present application relates to the field of network security protection technology, and in particular to a security protection method, device and medium based on HTML tag and attribute whitelist. Background Art

[0002] With the development of the internet, XSS attacks have become one of the most dangerous and common web vulnerabilities. Hackers inject malicious scripts into legitimate web pages, exploiting them to obtain sensitive user information or perform malicious operations on behalf of the victim. Addressing XSS attacks is essential, especially in the banking and financial industry.

[0003] Currently, input filtering is the most direct and common defense against XSS attacks. However, traditional blacklist-based input filtering methods often suffer from vulnerabilities, misjudgments, and security issues. For example, attackers can bypass blacklist restrictions by using signature characters, encoding, or other techniques, allowing malicious scripts to slip through input filtering and enter the system. Furthermore, maintaining blacklists is difficult, requiring constant updates and adjustments to prevent new security attacks.

[0004] Therefore, how to improve the reliability of network security protection has become a technical problem that needs to be solved urgently. Summary of the Invention

[0005] This application provides a security protection method, device, equipment and medium based on HTML tag and attribute whitelist, aiming to improve the reliability of network security protection.

[0006] In a first aspect, the present application provides a security protection method based on an HTML tag and attribute whitelist, the security protection method based on an HTML tag and attribute whitelist comprising the following steps:

[0007] Obtaining first input data input by the user;

[0008] Based on the data parsing instruction, convert the first input data into second input data in a target format;

[0009] Based on a preset verification whitelist, malicious data is filtered out of the second input data, and target input data is output.

[0010] In a second aspect, the present application further provides a security protection device based on an HTML tag and attribute whitelist, the security protection device based on an HTML tag and attribute whitelist comprising:

[0011] An input data acquisition module, configured to acquire first input data input by a user;

[0012] a data conversion module, configured to convert the first input data into second input data in a target format based on a data parsing instruction;

[0013] The data filtering module is used to filter malicious data from the second input data based on a preset verification whitelist and output target input data.

[0014] In a third aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the security protection method based on the HTML tag and attribute whitelist as described above are implemented.

[0015] In a fourth aspect, the present application also provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the security protection method based on the HTML tag and attribute whitelist as described above are implemented.

[0016] The present application provides a security protection method, apparatus, computer equipment and storage medium based on HTML tag and attribute whitelist. The method of the present application includes obtaining first input data input by a user; based on a data parsing instruction, converting the first input data into second input data in a target format; based on a preset verification whitelist, filtering malicious data on the second input data and outputting the target input data. In the above manner, the present application converts the first input data input by the user into second input data in a specific format according to the data parsing instruction, which can ensure the security and consistency of the input data. By filtering the second input data through the verification whitelist, it is ensured that only those tags and attributes that are considered safe are allowed to be used in the web page, which can effectively remove or reject potential malicious data, thereby greatly reducing the risk of XSS attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0018] Figure 1 A flowchart of a first embodiment of a security protection method based on HTML tag and attribute whitelist provided by this application;

[0019] Figure 2 A flowchart of a second embodiment of a security protection method based on HTML tag and attribute whitelist provided by this application;

[0020] Figure 3 This is a structural diagram of a first embodiment of a security protection device based on HTML tags and attribute whitelists provided by the present application;

[0021] Figure 4 This is a schematic block diagram of the structure of a computer device provided in an embodiment of the present application.

[0022] The realization of the objectives, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0024] The flowcharts shown in the accompanying drawings are for illustrative purposes only and do not necessarily include all contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, combined, or partially merged, so the actual execution order may vary depending on the actual situation.

[0025] The following describes some embodiments of the present application in detail with reference to the accompanying drawings. In the absence of conflict, the following embodiments and features therein may be combined with each other.

[0026] Please refer to Figure 1 , Figure 1 This is a flowchart of the first embodiment of a security protection method based on HTML tag and attribute whitelist provided by this application.

[0027] like Figure 1 As shown, the security protection method based on the HTML tag and attribute whitelist includes steps S101 to S103.

[0028] S101, obtaining first input data input by a user;

[0029] In one embodiment, in the field of network security protection, the first input data input by the user may be in the form of data that can become a carrier of security attacks, such as SQL injection, XSS attack, file upload vulnerability, etc.

[0030] Exemplarily, the data form of the first input data may be text input, such as a user name, password, search query, etc. Generally, text input may be collected through a form input element.

[0031] Exemplarily, the first input data may also be in the form of a file. Users may upload files such as pictures, documents, etc., which may contain malicious code.

[0032] Exemplarily, the first input data may also be a numerical input, such as age, phone number, price, etc.

[0033] Exemplarily, the first input data may also be in the form of an email address, date and time, a check box, a radio button, a drop-down menu, a hidden input, a color selection, a range input, a password input, a URL input, etc.

[0034] In one embodiment, data is collected through corresponding HTML (HyperText Markup Language) form elements or input methods according to the data type of the first input data input by the user, such as text, file, or number.

[0035] HTML (Hypertext Markup Language) is the building block of the web. It defines the meaning and structure of web page content. Hypertext refers to the links that connect web pages within a single website or between multiple websites. Links are a fundamental aspect of the web. HTML uses "markup" to indicate text, images, and other content for display in a web browser. HTML elements are separated from a document by "tags." Tags consist of the element name enclosed in "<" and ">" brackets. Element names within HTML tags are not case-sensitive.

[0036] S102: based on the data parsing instruction, convert the first input data into second input data in a target format;

[0037] In one embodiment, before data parsing, the first input data can be verified to determine whether it conforms to the expected format and type, and the first input data can be clarified to remove unnecessary blanks, format errors or potential malicious content, thereby improving the accuracy and processing efficiency of subsequent data parsing and screening.

[0038] In one embodiment, a data parsing instruction parses first input data and applies specific conversion rules based on parsing requirements to convert the first input data into second input data in a target format. For example, a text date may be converted into a date in a specific format, or a string number may be converted into an integer or floating point number.

[0039] In one embodiment, the first input data may be string data, and the target format may be a document object DOMDocument.

[0040] In one embodiment, if the first input data is string data, it may be HTML, XML or other parsable document strings.

[0041] In one embodiment, the first input data may also be in other data formats that can be converted into a string data format, such as a numerical value, an array or an object, a date, a function, binary data, a file, a regular expression, etc. For example, a numerical value, a date, an object, etc. may use the toString() method, or use a string template in JavaScript (a scripting language).

[0042] Among them, the toString() method is used to return the Number object value represented by a string.

[0043] JavaScript is a cross-platform, object-oriented scripting language that enables interactive web pages (e.g., complex animations, clickable buttons, and simple menus). JavaScript includes a standard library of objects, such as arrays, dates, and math, as well as a core set of statements, including operators, flow control symbols, and declarations. The core of JavaScript can be extended by adding objects to suit different uses.

[0044] Furthermore, based on the data parsing instruction, a document object constructor DOMParser is called; based on the document object constructor, the first input data is parsed into the target format to obtain the second input data.

[0045] In one embodiment, a string may be parsed using DOMParser().

[0046] Understandably, before browsers introduced the DOMParser() API, the only API for constructing a DOM structure from a string was innerHTML. While innerHTML can construct a DOM structure from a string, it can also execute malicious code within it. The browser Web API, DOMParser(), only parses a string into a DOM object; it doesn't execute scripts within it or request resources such as images, SVG, or styles. This allows the DOM object constructed with DOMParser() to be accessed and manipulated without affecting the page, including preventing the execution of malicious code.

[0047] In one embodiment, a DOMParser() instance is created based on the data parsing instruction. DOMParser() is an interface provided by the browser for parsing a string into a DOM object. The parseFromString method is called using the DOMParser() instance. The parseFromString method returns a new Document object that represents the parsed DOM structure.

[0048] In one embodiment, the parseFromString method accepts two parameters: the first parameter is the string to be parsed, and the second parameter is the MIME type (eg, text / html).

[0049] DOMParser() is a constructor that creates a new DOMParser object. parseFromString() is a method of the DOMParser object that accepts a string and a MIME type and parses the string into a DOM Document object.

[0050] In one embodiment, the Document object can be used to access and manipulate the elements and content therein. For example, methods such as getElementById and getElementsByClassName can be used to select a specific element.

[0051] The Document object is an interface in the browser's DOM API that represents the entire HTML or XML document. Methods like getElementById() and getElementsByClassName() are used to select specific elements within the document.

[0052] Understandably, since DOMParser does not execute scripts or request resources in the string, it avoids potential security risks. Therefore, you can safely process the parsed DOM object without worrying about executing malicious code or loading unnecessary resources.

[0053] Generally, the structure of the DOM object generated by parsing can be modified according to actual needs without triggering script execution, such as adding, deleting or modifying elements.

[0054] This embodiment converts the first input data into second input data in a target format, thereby achieving standardization and normalization of the incoming data and reducing security risks caused by format differences.

[0055] S103: Based on a preset verification whitelist, filter the second input data for malicious data and output target input data.

[0056] In one embodiment, whitelist rules can be predefined to determine which elements, attributes, or styles are safe and can be included in a document. For example, a list can be created that includes all allowed HTML tags and attributes.

[0057] In one embodiment, a function can be created that can be used to traverse all nodes of a DOM Document and apply whitelist verification whitelist rules to each node. For each node, its tag name and attributes are checked to see if they are in the whitelist. If the node does not meet the whitelist rules, it is removed from the document or replaced.

[0058] In one embodiment, the verification whitelist includes a label whitelist and an attribute whitelist; the label whitelist includes a label name and an attribute list, and the attribute whitelist includes an attribute name and a verification rule.

[0059] In one embodiment, the tag whitelist can be a predefined list containing HTML tag names that are allowed to appear in the final output. This list ensures that only safe, business-required tags are included in the document object (DOM).

[0060] In one embodiment, a tag whitelist can prevent malicious HTML tags (such as <script>、<iframe>等)执行可能导致跨站脚本攻击(XSS)的代码。标签白名单还可以确保文档内容符合预期的格式和结构，防止不符合设计的内容出现。

[0061] 在一实施例中，属性白名单是一个更详细的列表，它不仅包含属性名称，还包含了对这些属性值的检验规则。这个列表确保了只有符合安全策略的属性才会被应用到标签。

[0062] 在一实施例中，属性白名单可以用于属性值验证，确保属性值符合特定的格式和安全要求，防止如XSS攻击中的恶意脚本注入。属性白名单可以通过限制属性的使用，减少潜在的安全风险，增强安全性。

[0063] 本实施例中，防止跨站脚本攻击(XSS)对金融领域有许多益处，以下是其中一些主要优点：

[0064] 用户数据保护：金融领域涉及敏感的个人和财务信息。通过防止XSS攻击，可以有效保护用户的数据免受恶意脚本的侵害。这样，客户的账户号码、密码、信用卡信息等敏感数据就不容易被黑客窃取。

[0065] 防止钓鱼攻击：XSS攻击常常被用于进行钓鱼攻击，即通过伪造页面或欺骗用户来获取其敏感信息。在金融领域，用户经常需要输入账户详细信息、安全代码等敏感信息来进行操作，如果网站容易受到XSS攻击，恶意用户可能会伪造页面来欺骗用户并窃取这些信息。通过防止XSS攻击，可以降低钓鱼攻击的风险，保护用户的财务安全。

[0066] 合规要求满足：金融领域有严格的合规要求，包括数据保护、隐私保护和信息安全等方面。防止XSS攻击是满足这些合规要求的一部分。通过采取适当的安全措施，如输入验证和输出编码，可以降低XSS攻击的风险，确保金融机构符合相关法规和标准。

[0067] 降低经济损失：XSS攻击可能导致严重的经济损失。例如，黑客可能利用XSS漏洞窃取客户资金或盗取身份信息，导致金融机构和客户双方遭受损失。通过有效地防止XSS攻击，可以降低此类经济损失的风险，并节省恢复受损系统所需的成本和时间。

[0068] 综上所述，在金融领域的系统中XSS攻击防护是必不可少的，不仅有助于保护客户的财务安全，也有助于增强金融机构的可信度和可持续发展。

[0069] 进一步地，基于所述标签白名单，移除所述第二输入数据中的非白名单标签，获得第一筛除数据；基于所述属性白名单，移除所述第一筛除数据中的异常属性，获得所述目标输入数据。

[0070] 在一实施例中，标签白名单可以明确哪些标签是安全的，如、、、、等。

[0071] 示例性的，在DOM遍历过程中，检查每个节点的标签名称是否在标签白名单中。如果节点的标签名称不在标签白名单中，则将其从DOM中移除；如果节点中的标签名称在标签白名单中，则保留。

[0072] 在一实施例中，对于每个标签，属性白名单定义允许的属性列表和相应的检验规则。

[0073] 示例性的，在DOM遍历过程中，对于每个节点的每个属性，检查其名称是否在属性白名单中。如果属性名称不在属性白名单中，则将其从节点中移除；如果属性名称在白名单中，进一步验证其值是否符合预定义的检验规则。如果属性或其值不符合白名单规则，则将其从节点中移除；如果符合，则保留。

[0074] 进一步地，基于所述属性白名单，移除所述第一筛除数据中非白名单属性，获得第二筛除数据；基于预设的检验规则，移除所述第二筛除数据中不满足所述检验规则的所述异常属性，获得所述目标输入数据。

[0075] 在一实施例中，可以创建一个包含允许的属性名称和相应检验规则的对象或映射表。检验规则可以是正则表达式、函数或其他验证机制。确立安全标准，确保只有预期的、安全的属性被包含在文档中。

[0076] 在一实施例中，可以构建一个遍历函数，用于遍历DOM节点的所有属性，并根据白名单和检验规则进行筛选。通过遍历函数，对DOM对象的每个节点的每个属性进行遍历检查。

[0077] 在一实施例中，对于每个属性，首先检查其名称是否在属性白名单中，如果其名称不在属性白名单中，则移除。由此，可以阻止未授权属性的添加，增强数据安全性。

[0078] 在一实施例中，如果其名称在属性白名单中，则进一步使用预设的检验规则来验证属性值，确保属性值的安全性和合规性。如果属性值不满足检验规则，也将该属性从节点中移除，提高数据的准确性和可靠性。

[0079] 在一实施例中，可以重复筛选过程，直至所有节点的所有属性都被检查过，确保整个输入数据的安全性和合规性。

[0080] 在一实施例中，可以随机对筛选过后的目标输入数据中的任意数据进行单独验证，可以随机选择若干个数据，或者对所有数据进行验证，确保所有节点的属性都符合属性白名单和检验规则，确认过滤操作的有效性。

[0081] 本实施例通过校验白名单，对用户输入数据进行过滤，确保了所有属性和属性值都符合预定义的安全策略，阻止了潜在的跨站脚本攻击(XSS)和其他注入攻击。通过将过滤逻辑封装在函数中，提高了代码的可维护性和可读性，精确的检验规则减少了错误地移除安全属性的可能性。

[0082] 在一实施例中，基于HTML标签和属性白名单的安全防护方法，是一种更加主动和积极的防御策略。这种方法通过预先定义一个安全标签和属性的白名单，可以确保只有那些被认为安全的标签和属性被允许在网页中使用。相比于黑名单方法，白名单策略从源头上减少了潜在的攻击面，因为它不允许任何不在名单内的内容，从而有效避免了攻击者通过绕过黑名单限制的方式来注入恶意脚本。

[0083] 本实施例提供了一种基于HTML标签和属性白名单的安全防护方法，本申请方法根据数据解析指令将用户输入的第一输入数据转化为特定格式的第二输入数据，可以确保输入数据的安全性和一致性。通过校验白名单对第二输入数据进行过滤，保只有那些被认为安全的标签和属性被允许在网页中使用，能够有效地移除或拒绝潜在的恶意数据，从而大幅降低XSS攻击的风险。

[0084] 请参照图2，图2为本申请提供的一种基于HTML标签和属性白名单的安全防护方法第二实施例的流程示意图。

[0085] 本实施例中，如图2所示，基于上述图1所示实施例，所述S103之后，还包括：

[0086] S201、识别所述目标输入数据中的特征字符；

[0087] 进一步地，获取特征字符数据集，其中，所述特征字符数据集包括至少一个预设的所述特征字符以及各所述特征字符的字符识别规则；基于所述特征字符数据集，对所述目标输入数据进行遍历匹配，获得所述目标输入数据中的所述特征字符。

[0088] 在一实施例中，可以预先构建特征字符数据集，特征字符数据集中包含预先定义的特征字符，以及每一种类型的特征字符的识别规则。

[0089] 在一实施例中，识别目标输入数据中的特征字符通常是指从过滤后的文本中提取出有助于进一步处理或分析的关键信息。特征字符的识别可以通过多种方法实现，包括但不限于文本分析、模式匹配、正则表达式等。

[0090] 在一实施例中，首先需要规定哪些字符或模式是特征字符，可以包括特定的关键字、数据格式(如日期、电话号码等)、特殊符号等，为识别过程提供明确的目标，确保结果的相关性和准确性。

[0091] 在一实施例中，根据定义的特征字符，创建相应的识别规则，识别规则可以是一组正则表达式，或者是特定的字符串匹配逻辑等，确保能够系统地识别所有相关特征。

[0092] 在一实施例中，在识别目标输入数据中的特征字符时，逐个检查目标输入数据中的每个文本段，以识别特征字符，确保全面覆盖，不遗漏任何潜在的特征字符。使用识别规则对每个文本段进行匹配，找出所有符合规则的字符或模式。

[0093] S202、基于预设转义规则，将所述特征字符转换为预设格式的目标字符，以使得所述目标输入数据符合输入数据要求。

[0094] 在一实施例中，可以创建一个包含特征字符及其对应转义格式的目标字符的映射表。

[0095] 在一实施例中，可以编写一个函数，用于将特征字符根据转义规则转换为目标字符，对目标输入数据进行遍历，检查每个字符是否为特征字符，根据映射表，将每个特征字符替换为对应的转义格式的目标字符。将转义后的字符更新到目标输入数据中，将转义后的目标输入数据输出，以便进一步使用或显示。

[0096] 在一实施例中，对于特殊情况，如脚本内部的字符、样式属性等，进行特殊处理以确保转义有效。

[0097] 本实施例通过预设转义规则，对输入数据中的特征字符进行转义，可以防止潜在的代码注入攻击，用户可以安全地看到预期的内容，不会被潜在的恶意内容影响。转义操作可以增强数据完整性，确保数据在存储和传输过程中保持其原始意义。同时，转义操作可以使得数据能够安全地在不同系统和应用程序之间传输，提高互操作性。转义操作使得特征字符符合HTML标准，防止解析错误。

[0098] 请参阅图3，图3是本申请提供的一种基于HTML标签和属性白名单的安全防护装置第一实施例的结构示意图，该基于HTML标签和属性白名单的安全防护装置用于执行前述的基于HTML标签和属性白名单的安全防护方法。

[0099] 如图3所示，该基于HTML标签和属性白名单的安全防护装置300，包括：输入数据获取模块301、数据转化模块302和数据过滤模块303。

[0100] 输入数据获取模块301，用于获取用户输入的第一输入数据；

[0101] 数据转化模块302，用于基于数据解析指令，将所述第一输入数据转化为目标格式的第二输入数据；

[0102] 数据过滤模块303，用于基于预设的校验白名单，对所述第二输入数据进行恶意数据过滤，输出目标输入数据。

[0103] 在一实施例中，所述校验白名单包括标签白名单和属性白名单；

[0104] 所述标签白名单包括标签名称和属性列表，所述属性白名单包括属性名称和检验规则。

[0105] 在一实施例中，所述数据过滤模块303包括：

[0106] 数据过滤第一单元，用于基于所述标签白名单，移除所述第二输入数据中的非白名单标签，获得第一筛除数据；

[0107] 数据过滤第二单元，用于基于所述属性白名单，移除所述第一筛除数据中的异常属性，获得所述目标输入数据。

[0108] 在一实施例中，所述数据过滤第二单元包括：

[0109] 属性筛除第一子单元，用于基于所述属性白名单，移除所述第一筛除数据中非白名单属性，获得第二筛除数据；

[0110] 属性筛除第二子单元，用于基于预设的检验规则，移除所述第二筛除数据中不满足所述检验规则的所述异常属性，获得所述目标输入数据。

[0111] 在一实施例中，所述基于HTML标签和属性白名单的安全防护装置300还包括字符转义模块，包括：

[0112] 特征字符识别单元，用于识别所述目标输入数据中的特征字符；

[0113] 字符转义单元，用于基于预设转义规则，将所述特征字符转换为预设格式的目标字符，以使得所述目标输入数据符合输入数据要求。

[0114] 在一实施例中，所述特征字符识别单元包括：

[0115] 数据集获取子单元，用于获取特征字符数据集，其中，所述特征字符数据集包括至少一个预设的所述特征字符以及各所述特征字符的字符识别规则；

[0116] 特征字符识别子单元，用于基于所述特征字符数据集，对所述目标输入数据进行遍历匹配，获得所述目标输入数据中的所述特征字符。

[0117] 在一实施例中，所述数据转化模块302包括：

[0118] 函数调用单元，用于基于所述数据解析指令，调用文档对象构造函数DOMParser；

[0119] 数据解析单元，用于基于所述文档对象构造函数，将所述第一输入数据解析为所述目标格式，获得所述第二输入数据；

[0120] 其中，所述第一输入数据为字符串数据，所述目标格式为文档对象DOM Document。

[0121] 需要说明的是，所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的装置和各模块的具体工作过程，可以参考前述基于HTML标签和属性白名单的安全防护方法实施例中的对应过程，在此不再赘述。

[0122] 上述实施例提供的装置可以实现为一种计算机程序的形式，该计算机程序可以在如图4所示的计算机设备上运行。

[0123] 请参阅图4，图4是本申请实施例提供的一种计算机设备的结构示意性框图。该计算机设备可以是服务器。

[0124] 参阅图4，该计算机设备包括通过系统总线连接的处理器、存储器和网络接口，其中，存储器可以包括非易失性存储介质和内存储器。

[0125] 非易失性存储介质可存储操作系统和计算机程序。该计算机程序包括程序指令，该程序指令被执行时，可使得处理器执行任意一种基于HTML标签和属性白名单的安全防护方法。

[0126] 处理器用于提供计算和控制能力，支撑整个计算机设备的运行。

[0127] 内存储器为非易失性存储介质中的计算机程序的运行提供环境，该计算机程序被处理器执行时，可使得处理器执行任意一种基于HTML标签和属性白名单的安全防护方法。

[0128] 该网络接口用于进行网络通信，如发送分配的任务等。本领域技术人员可以理解，图4中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定，具体的计算机设备可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。

[0129] 应当理解的是，处理器可以是中央处理单元(Central Processing Unit，CPU)，该处理器还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。其中，通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。

[0130] 其中，在一个实施例中，所述处理器用于运行存储在存储器中的计算机程序，以实现如下步骤：

[0131] 获取用户输入的第一输入数据；

[0132] 基于数据解析指令，将所述第一输入数据转化为目标格式的第二输入数据；

[0133] 基于预设的校验白名单，对所述第二输入数据进行恶意数据过滤，输出目标输入数据。

[0134] 在一实施例中，所述校验白名单包括标签白名单和属性白名单；

[0135] 所述标签白名单包括标签名称和属性列表，所述属性白名单包括属性名称和检验规则。

[0136] 在一实施例中，所述处理器在实现所述基于预设的校验白名单，对所述第二输入数据进行恶意数据过滤，输出目标输入数据时，用于实现：

[0137] 基于所述标签白名单，移除所述第二输入数据中的非白名单标签，获得第一筛除数据；

[0138] 基于所述属性白名单，移除所述第一筛除数据中的异常属性，获得所述目标输入数据。

[0139] 在一实施例中，所述处理器在实现所述基于所述属性白名单，移除所述第一筛除数据中的异常属性，获得所述目标输入数据时，用于实现：

[0140] 基于所述属性白名单，移除所述第一筛除数据中非白名单属性，获得第二筛除数据；

[0141] 基于预设的检验规则，移除所述第二筛除数据中不满足所述检验规则的所述异常属性，获得所述目标输入数据。

[0142] 在一实施例中，所述处理器在实现所述基于预设的校验白名单，对所述第二输入数据进行恶意数据过滤，输出目标输入数据之后，还用于实现：

[0143] 识别所述目标输入数据中的特征字符；

[0144] 基于预设转义规则，将所述特征字符转换为预设格式的目标字符，以使得所述目标输入数据符合输入数据要求。

[0145] 在一实施例中，所述处理器在实现所述识别所述目标输入数据中的特征字符时，用于实现：

[0146] 获取特征字符数据集，其中，所述特征字符数据集包括至少一个预设的所述特征字符以及各所述特征字符的字符识别规则；

[0147] 基于所述特征字符数据集，对所述目标输入数据进行遍历匹配，获得所述目标输入数据中的所述特征字符。

[0148] 在一实施例中，所述处理器在实现所述基于数据解析指令，将所述第一输入数据转化为目标格式的第二输入数据时，用于实现：

[0149] 基于所述数据解析指令，调用文档对象构造函数DOMParser；

[0150] 基于所述文档对象构造函数，将所述第一输入数据解析为所述目标格式，获得所述第二输入数据；

[0151] 其中，所述第一输入数据为字符串数据，所述目标格式为文档对象DOM Document。

[0152] 本申请的实施例中还提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序中包括程序指令，所述处理器执行所述程序指令，实现本申请实施例提供的任一种基于HTML标签和属性白名单的安全防护方法。

[0153] 其中，所述计算机可读存储介质可以是前述实施例所述的计算机设备的内部存储单元，例如所述计算机设备的硬盘或内存。所述计算机可读存储介质也可以是所述计算机设备的外部存储设备，例如所述计算机设备上配备的插接式硬盘，智能存储卡(SmartMedia Card，SMC)，安全数字(Secure Digital，SD)卡，闪存卡(Flash Card)等。

[0154] 以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。< / script>

Claims

1. A security protection method based on HTML tag and attribute whitelist, characterized in that: The method comprises: Obtaining first input data input by a user; Based on the data parsing instruction, convert the first input data into second input data in a target format; Based on a preset verification whitelist, malicious data is filtered out for the second input data, and target input data is output.

2. The security protection method based on HTML tag and attribute whitelist according to claim 1 is characterized in that: The verification whitelist includes a label whitelist and an attribute whitelist; The tag whitelist includes tag names and attribute lists, and the attribute whitelist includes attribute names and verification rules.

3. The security protection method based on HTML tag and attribute whitelist according to claim 2 is characterized in that: The filtering of malicious data on the second input data based on a preset verification whitelist and outputting target input data includes: Based on the label whitelist, remove non-whitelist labels in the second input data to obtain first screened data; Based on the attribute whitelist, abnormal attributes in the first screened data are removed to obtain the target input data.

4. The security protection method based on HTML tag and attribute whitelist according to claim 3 is characterized in that: The removing abnormal attributes in the first screened data based on the attribute whitelist to obtain the target input data includes: Based on the attribute whitelist, remove non-whitelist attributes in the first screened data to obtain second screened data; Based on a preset inspection rule, the abnormal attributes that do not meet the inspection rule in the second screened data are removed to obtain the target input data.

5. The security protection method based on HTML tag and attribute whitelist according to claim 1 is characterized in that: After filtering malicious data on the second input data based on the preset verification whitelist and outputting the target input data, the method further includes: Identifying characteristic characters in the target input data; Based on a preset escape rule, the characteristic characters are converted into target characters in a preset format, so that the target input data meets the input data requirement.

6. The security protection method based on HTML tag and attribute whitelist according to claim 5 is characterized in that: The identifying characteristic characters in the target input data includes: Acquire a characteristic character data set, wherein the characteristic character data set includes at least one preset characteristic character and a character recognition rule for each characteristic character; Based on the characteristic character data set, the target input data is traversed and matched to obtain the characteristic characters in the target input data.

7. The security protection method based on HTML tag and attribute whitelist according to claim 1 is characterized in that: The converting the first input data into second input data in a target format based on the data parsing instruction includes: Based on the data parsing instruction, call the document object constructor DOMParser; Based on the document object constructor, the first input data is parsed into the target format to obtain the second input data; The first input data is string data, and the target format is a document object DOM Document.

8. A security protection device based on HTML tag and attribute whitelist, characterized in that: The security protection device based on HTML tag and attribute whitelist includes: An input data acquisition module, used to acquire first input data input by a user; A data conversion module, configured to convert the first input data into second input data in a target format based on a data parsing instruction; The data filtering module is used to filter malicious data on the second input data based on a preset verification white list and output target input data.

9. A computer device, characterized in that: The computer device includes a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the security protection method based on HTML tag and attribute whitelist as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the security protection method based on HTML tag and attribute whitelist according to any one of claims 1 to 7 are implemented.

Images