最近在解决安全漏洞的时候，按照网上过滤的方法使用，发过发现有些路径得到的对象使用仍是没有转义的JS脚本，而网上过滤器的拦截路径是“/”，这就很好奇，为什么有些地方没有拦截住XSS攻击问题，引出今天的话题
先贴出网上的Filter的常见用法
/** * <p>Project Name:cweis-web</p> * <p>File Name: XssHttpServletRequestWrapper.java</p> * <p>Package Name:com.cweis.filter </p> package com.cloudwalk.common.xssnew; import java.util.Map; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; /** * <p>ClassName: XssHttpServletRequestWrapper</p> * Description:HttpServletRequestWapper的包装类<br/> * @date 2018年11月1日 下午3:03:01 * @author yckj0914 * @version 1.0 * @since JDK 1.7 */ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { HttpServletRequest orgRequest = null; public XssHttpServletRequestWrapper(HttpServletRequest request) { super(request); } /** * 覆盖getParameter方法，将参数名和参数值都做xss过滤。 * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取 * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖 */ @Override public String getParameter(String name) { String value = super.getParameter(xssEncode(name)); if (value != null) { value = xssEncode(value); } return value; } @Override public String[] getParameterValues(String name) { String[] value = super.getParameterValues(name); if (value != null) { for (int i = 0; i < value.length; i++) { value[i] = xssEncode(value[i]); } } return value; } @SuppressWarnings("rawtypes") @Override public Map getParameterMap() { return super.getParameterMap(); } /** * 将容易引起xss漏洞的半角字符直接替换成全角字符 在保证不删除数据的情况下保存 * * @param s * @return 过滤后的值 */ private static String xssEncode(String value) { if (value == null || value.isEmpty()) { return value; } value = value.replaceAll("eval\\((.*)\\)", ""); value = value.replaceAll("<","<"); value = value.replaceAll(">",">"); value = value.replaceAll("'","'"); value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\""); value = value.replaceAll("(?i)<script.*?>.*?<script.*?>", ""); value = value.replaceAll("(?i)<script.*?>.*?</script.*?>", ""); value = value.replaceAll("(?i)<.*?javascript:.*?>.*?</.*?>", ""); value = value.replaceAll("(?i)<.*?\\s+on.*?>.*?</.*?>", ""); // value = value.replaceAll("[<>{}\\[\\];\\&]",""); return value; } /** * 覆盖getHeader方法，将参数名和参数值都做xss过滤。 如果需要获得原始的值，则通过super.getHeaders(name)来获取 * getHeaderNames 也可能需要覆盖 这一段代码在一开始没有注释掉导致出现406错误，原因是406错误是HTTP协议状态码的一种， * 表示无法使用请求的内容特性来响应请求的网页。一般是指客户端浏览器不接受所请求页面的 MIME 类型。 **/ @Override public String getHeader(String name) { String value = super.getHeader(xssEncode(name)); if (value != null) { value = xssEncode(value); } return value; } }
/** * <p>Project Name:cweis-web</p> * <p>File Name: XssFilter.java</p> * <p>Package Name:com.cweis.filter </p> * @date 2018年10月16日 下午3:51:25 */ package com.cloudwalk.common.xssnew; import java.io.IOException; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; /** * <p>ClassName: XssFilter</p> * Description:Filter过滤器实现对Request的过滤<br/> * @date 2018年11月1日 下午3:02:37 * @author yckj0914 * @version 1.0 * @since JDK 1.7 */ public class XssFilter implements Filter { @Override public void destroy() { } /** * 过滤器用来过滤的方法 */ @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { // 包装request XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest) request); //实际设置 HttpServletResponse xssResponse = (HttpServletResponse) response; xssResponse.setHeader("X-XSS-Protection", "1; mode=block"); xssResponse.setHeader("X-Frame-Options", "SAMEORIGIN"); xssResponse.setHeader("Strict-Transport-Security", "max-age=31536; includeSubDomains"); // xssResponse.setHeader("Content-Security-Policy", "default-src 'self'"); xssResponse.setHeader("X-Content-Type-Options", "nosniff"); chain.doFilter(xssRequest, xssResponse); } @Override public void init(FilterConfig filterConfig) throws ServletException { } }
<!--新增的filter-->
<filter>
<filter-name>XssFilter</filter-name>
<filter-class>com.cloudwalk.common.xssnew.XssFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>XssFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
至此，以上的便是网上的方案，但是只能解决普通的getParamter()的办法，接下来来说明一下 ，如何解决上传，JSON，表单的XSS攻击防御措施
package cn.cloudwalk.common.mapper.adapters; import java.util.ArrayList; import java.util.List; import java.util.Map; import javax.xml.bind.annotation.XmlAccessType; import javax.xml.bind.annotation.XmlAccessorType; import javax.xml.bind.annotation.XmlType; @XmlType(name = "MapConvertor") @XmlAccessorType(XmlAccessType.FIELD) public class MapConvertor { private List<MapEntry> entries = new ArrayList<MapEntry>(); public void addEntry(MapEntry entry) { entries.add(entry); } public List<MapEntry> getEntries() { return entries; } public static class MapEntry { private String key; private Object value; public MapEntry() { super(); } public MapEntry(Map.Entry<String, Object> entry) { super(); this.key = entry.getKey(); this.value = entry.getValue(); } public MapEntry(String key, Object value) { super(); this.key = key; this.value = value; } public String getKey() { return key; } public void setKey(String key) { this.key = key; } public Object getValue() { return value; } public void setValue(Object value) { this.value = value; } } }
package cn.cloudwalk.common.mapper.adapters; import java.util.HashMap; import java.util.Map; import javax.xml.bind.annotation.adapters.XmlAdapter; public class MapAdapter extends XmlAdapter<MapConvertor, Map<String, Object>> { @Override public MapConvertor marshal(Map<String, Object> map) throws Exception { MapConvertor convertor = new MapConvertor(); for (Map.Entry<String, Object> entry : map.entrySet()) { MapConvertor.MapEntry e = new MapConvertor.MapEntry(entry); convertor.addEntry(e); } return convertor; } @Override public Map<String, Object> unmarshal(MapConvertor map) throws Exception { Map<String, Object> result = new HashMap<String, Object>(); for (MapConvertor.MapEntry e : map.getEntries()) { result.put(e.getKey(), e.getValue()); } return result; } }
/** * Project Name:cloudwalk-common * File Name:CloudWalkHttpMessageConverter.java * Package Name:cn.cloudwalk.common.mapper.adapters * Date:2016年5月20日下午4:58:32 */ package cn.cloudwalk.common.mapper.adapters; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.InputStream; import java.nio.charset.Charset; import com.cloudwalk.common.xssnew.XssHttpServletRequestWrapper; import org.springframework.http.HttpInputMessage; import org.springframework.http.converter.HttpMessageNotReadableException; import com.alibaba.fastjson.JSON; import com.alibaba.fastjson.support.spring.FastJsonHttpMessageConverter; /** * ClassName:FalconHttpMessageConverter <br/> * Description: String 类型不需要转换. <br/> * Date: 2016年5月20日 下午4:58:32 <br/> * */ public class FalconHttpMessageConverter extends FastJsonHttpMessageConverter { private Charset charset = UTF8; /** * 重写读取json，加密的时候，如果返回String，不需要转json */ @Override protected Object readInternal(Class<? extends Object> clazz, HttpInputMessage inputMessage) throws IOException, HttpMessageNotReadableException { // String 不需要转json if (clazz == String.class) { ByteArrayOutputStream baos = new ByteArrayOutputStream(); InputStream in = inputMessage.getBody(); byte[] buf = new byte[1024]; for (;;) { int len = in.read(buf); if (len == -1) { break; } if (len > 0) { baos.write(buf, 0, len); } } byte[] bytes = baos.toByteArray(); return xssEncode(new String(bytes, getCharset())); } else { ByteArrayOutputStream baos = new ByteArrayOutputStream(); InputStream in = inputMessage.getBody(); byte[] buf = new byte[1024]; for (;;) { int len = in.read(buf); if (len == -1) { break; } if (len > 0) { baos.write(buf, 0, len); } } byte[] bytes = baos.toByteArray(); String text=xssEncode(new String(bytes, getCharset())); return JSON.parseObject(text, clazz); } } private static String xssEncode(String value) { if (value == null || value.isEmpty()) { return value; } value = value.replaceAll("eval\\((.*)\\)", ""); value = value.replaceAll("<","<"); value = value.replaceAll(">",">"); value = value.replaceAll("'","'"); value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\""); value = value.replaceAll("(?i)<script.*?>.*?<script.*?>", ""); value = value.replaceAll("(?i)<script.*?>.*?</script.*?>", ""); value = value.replaceAll("(?i)<.*?javascript:.*?>.*?</.*?>", ""); value = value.replaceAll("(?i)<.*?\\s+on.*?>.*?</.*?>", ""); // value = value.replaceAll("[<>{}\\[\\];\\&]",""); return value; } }
/** * Project Name:cloudwalk-common * File Name:CloudWalkHttpMessageConverter.java * Package Name:cn.cloudwalk.common.mapper.adapters * */ package cn.cloudwalk.common.mapper.adapters; import java.io.IOException; import cn.cloudwalk.common.ResultEntity; import cn.cloudwalk.enums.GlobalMessage; import org.springframework.http.HttpOutputMessage; import org.springframework.http.converter.HttpMessageNotWritableException; import org.springframework.validation.ObjectError; import com.alibaba.fastjson.support.spring.FastJsonHttpMessageConverter; /** * ClassName:CloudWalkHttpMessageConverter <br/> * Description: 自动封装@ResponseBody 返回的Object 到 ResultEntity. <br/> * Date: 2016年5月20日 下午4:58:32 <br/> * * @author 李强 * @version 1.0.0 * @since JDK 1.7 * @see */ public class CloudWalkHttpMessageConverter extends FastJsonHttpMessageConverter { @Override protected void writeInternal(Object obj, HttpOutputMessage outputMessage) throws IOException, HttpMessageNotWritableException { if (obj instanceof ResultEntity) { super.writeInternal(obj, outputMessage); } else { ResultEntity entity = new ResultEntity(); if (obj instanceof ObjectError) { entity.setRespCode(GlobalMessage.RESP_FAIL.getRespCode()); ObjectError error = (ObjectError) obj; entity.setRespDesc(error.getDefaultMessage()); } else { entity.setData(obj); } super.writeInternal(entity, outputMessage); } } }
<!-- https://mvnrepository.com/artifact/net.sf.dozer/dozer --> <dependency> <groupId>net.sf.dozer</groupId> <artifactId>dozer</artifactId> <version>5.5.1</version> </dependency>
/** * Copyright (c) 2005-2012 springside.org.cn */ package cn.cloudwalk.common.mapper; import java.util.Collection; import java.util.List; import org.dozer.DozerBeanMapper; import com.google.common.collect.Lists; /** * 简单封装Dozer, 实现深度转换Bean<->Bean的Mapper.实现: * * 1. 持有Mapper的单例. 2. 返回值类型转换. 3. 批量转换Collection中的所有对象. 4. * 区分创建新的B对象与将对象A值复制到已存在的B对象两种函数. * * * @version 2013-01-15 */ public class BeanMapper { private BeanMapper() { } /** * 持有Dozer单例, 避免重复创建DozerMapper消耗资源. */ private static DozerBeanMapper dozer = new DozerBeanMapper(); /** * 基于Dozer转换对象的类型. */ public static <T> T map(Object source, Class<T> destinationClass) { return dozer.map(source, destinationClass); } /** * 基于Dozer转换Collection中对象的类型. */ @SuppressWarnings("rawtypes") public static <T> List<T> mapList(Collection sourceList, Class<T> destinationClass) { List<T> destinationList = Lists.newArrayList(); for (Object sourceObject : sourceList) { T destinationObject = dozer.map(sourceObject, destinationClass); destinationList.add(destinationObject); } return destinationList; } /** * 基于Dozer将对象A的值拷贝到对象B中. */ public static void copy(Object source, Object destinationObject) { dozer.map(source, destinationObject); } }
==================================================重写DefaultMultipartHttpServletRequest==========================================
package cn.cloudwalk.common; import org.springframework.util.MultiValueMap; import org.springframework.web.multipart.MultipartFile; import org.springframework.web.multipart.support.DefaultMultipartHttpServletRequest; import javax.servlet.http.HttpServletRequest; import java.util.Map; public class XssFilterMultipartHttpServletRequest extends DefaultMultipartHttpServletRequest { public XssFilterMultipartHttpServletRequest(HttpServletRequest request, MultiValueMap<String, MultipartFile> mpFiles, Map<String, String[]> mpParams, Map<String, String> mpParamContentTypes) { super(request, mpFiles, mpParams, mpParamContentTypes); } public XssFilterMultipartHttpServletRequest(HttpServletRequest request) { super(request); } @Override public String[] getParameterValues(String name) { String[] values = getMultipartParameters().get(name); for (int i = 0; i < values.length; i++) { values[i] = xssEncode(values[i]); } return values; } private static String xssEncode(String value) { if (value == null || value.isEmpty()) { return value; } value = value.replaceAll("eval\\((.*)\\)", ""); value = value.replaceAll("<", "<"); value = value.replaceAll(">", ">"); value = value.replaceAll("'", "'"); value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\""); value = value.replaceAll("(?i)<script.*?>.*?<script.*?>", ""); value = value.replaceAll("(?i)<script.*?>.*?</script.*?>", ""); value = value.replaceAll("(?i)<.*?javascript:.*?>.*?</.*?>", ""); value = value.replaceAll("(?i)<.*?\\s+on.*?>.*?</.*?>", ""); // value = value.replaceAll("[<>{}\\[\\];\\&]",""); return value; } }
package cn.cloudwalk.common; import javax.servlet.http.HttpServletRequest; import org.springframework.util.Assert; import org.springframework.web.multipart.MultipartException; import org.springframework.web.multipart.MultipartHttpServletRequest; import org.springframework.web.multipart.commons.CommonsMultipartResolver; import org.springframework.web.multipart.support.DefaultMultipartHttpServletRequest; /** * ClassName: CloudwalkMultipartResolver <br/> * Description: 重写CommonsMultipartResolver，让他不要拦截切片上传的路径. <br/> * date: 2016年11月17日 上午10:01:43 <br/> * * @version 1.0.0 * @since JDK 1.7 */ public class CloudwalkMultipartResolver extends CommonsMultipartResolver { private boolean resolveLazily = false; /** * 判断是切片上传的路径，直接使用默认的request， 不去包装request * @see org.springframework.web.multipart.commons.CommonsMultipartResolver#isMultipart(javax.servlet.http.HttpServletRequest) */ @Override public boolean isMultipart(HttpServletRequest request) { String urlString = request.getRequestURI(); if(urlString.endsWith("chunkUpload/fileUpload")){ return false; }else{ return super.isMultipart(request); } } @Override public MultipartHttpServletRequest resolveMultipart(final HttpServletRequest request) throws MultipartException { Assert.notNull(request, "Request must not be null"); if (this.resolveLazily) { return new XssFilterMultipartHttpServletRequest(request) { @Override protected void initializeMultipart() { MultipartParsingResult parsingResult = parseRequest(request); setMultipartFiles(parsingResult.getMultipartFiles()); setMultipartParameters(parsingResult.getMultipartParameters()); setMultipartParameterContentTypes(parsingResult.getMultipartParameterContentTypes()); } }; } else { MultipartParsingResult parsingResult = parseRequest(request); return new XssFilterMultipartHttpServletRequest(request, parsingResult.getMultipartFiles(), parsingResult.getMultipartParameters(), parsingResult.getMultipartParameterContentTypes()); } } /** * Set whether to resolve the multipart request lazily at the time of * file or parameter access. * <p>Default is "false", resolving the multipart elements immediately, throwing * corresponding exceptions at the time of the {@link #resolveMultipart} call. * Switch this to "true" for lazy multipart parsing, throwing parse exceptions * once the application attempts to obtain multipart files or parameters. */ public void setResolveLazily(boolean resolveLazily) { this.resolveLazily = resolveLazily; } }
添加以上，即可解决
479
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
