跨站脚本 XSS漏洞解决办法

通过配置nginx

    server {
        listen       8080;
        server_name  192.168.1.162;

	    add_header Content-Security-Policy "default-src 'self' 192.168.1.162:8080 'unsafe-inline' 'unsafe-eval' blob: data: ;";
	
	    add_header X-XSS-Protection "1; mode=block";

        if ($query_string ~* (\$|'|--|[+|(%20)]union[+|(%20)]|[+|(%20)]insert[+|(%20)]|[+|(%20)]drop[+|(%20)]|[+|(%20)]truncate[+|(%20)]|[+|(%20)]update[+|(%20)]|[+|(%20)]from[+|(%20)]|[+|(%20)]grant[+|(%20)]|[+|(%20)]exec[+|(%20)]|[+|(%20)]where[+|(%20)]|[+|(%20)]select[+|(%20)]|[+|(%20)]and[+|(%20)]|[+|(%20)]or[+|(%20)]|[+|(%20)]count[+|(%20)]|[+|(%20)]exec[+|(%20)]|[+|(%20)]chr[+|(%20)]|[+|(%20)]mid[+|(%20)]|[+|(%20)]like[+|(%20)]|[+|(%20)]iframe[+|(%20)]|[\<|%3c]script[\>|%3e]|javascript|alert|webscan|dbappsecurity|style|confirm\(|innerhtml|innertext)(.*)$) { return 555; }
			if ($uri ~* (/~).*) { return 501; }
			if ($uri ~* (\\x.)) { return 501; }
			if ($query_string ~* "[;'<>].*") { return 509; }
			if ($request_uri ~ " ") { return 509; }
			if ($request_uri ~ (\/\.+)) { return 509; }
			if ($request_uri ~ (\.+\/)) { return 509; }
			if ($uri ~* (insert|select|delete|update|count|master|truncate|declare|exec|\*|\')(.*)$ ) { return 503; }        

测试：在程序访问的url中加入js脚本标签