跨脚本+Host拦截

最新推荐文章于 2024-04-04 16:28:36 发布

置顶匿名sun

最新推荐文章于 2024-04-04 16:28:36 发布

阅读量1.5k

点赞数

本文链接：https://blog.csdn.net/m0_37587841/article/details/83378813

版权

web.xml配置

   <!-- spring方式的xss过滤器 start -->
   <filter>
        <filter-name>XssFilter</filter-name>
        <filter-class>com.enation.eop.XssFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>XssFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <!-- spring方式的xss过滤器 end -->
    
    <!-- XssSqlFilter start -->
    <filter>
        <filter-name>XssSqlFilter</filter-name>
        <filter-class>com.enation.eop.SessionFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>XssSqlFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>  
    <!-- XssSqlFilter end -->
    
   <!--  ServletCGIFilter  start -->
   <filter>
        <filter-name>ServletCGIFilter</filter-name>
        <filter-class>com.enation.eop.ServletCGIFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>ServletCGIFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping> 
    <!-- ServletCGIFilter end -->

===========================================

package com.enation.eop;  
  
import java.io.IOException;  
import java.util.Iterator;  
import java.util.Map;  
import javax.servlet.Filter;  
import javax.servlet.FilterChain;  
import javax.servlet.FilterConfig;  
import javax.servlet.ServletException;  
import javax.servlet.ServletRequest;  
import javax.servlet.ServletResponse;  
import javax.servlet.http.HttpServletRequest;  
import javax.servlet.http.HttpServletResponse;  
import org.apache.commons.lang.StringUtils;  
import org.apache.log4j.Logger;  
  
  
public class SessionFilter implements Filter{
	private static Logger log = Logger.getLogger(SessionFilter.class);

	public void destroy() {
	}

	public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
			throws IOException, ServletException {
		HttpServletRequest request = (HttpServletRequest) servletRequest;
		HttpServletResponse response = (HttpServletResponse) servletResponse;
		String requestStr = getRequestString(request);
		System.out.println("requestStr： ======================== " + requestStr);
		System.out.println("完整的地址是====" + request.getRequestURL().toString());
		System.out.println("提交的方式是========" + request.getMethod());
		log.info("requestStr： ======================== " + requestStr);
		log.info("完整的地址是====" + request.getRequestURL().toString());
		log.info("提交的方式是========" + request.getMethod());

		if ("bingo".equals(guolv2(requestStr)) || "bingo".equals(guolv2(request.getRequestURL().toString()))) {
			System.out.println("======访问地址发现非法字符，已拦截======");
			log.info("======访问地址发现非法字符，已拦截======其非法地址为：" + guolv2(request.getRequestURL().toString()));
			response.setStatus(403);
			//response.sendRedirect(request.getContextPath() + "/login.jsp");
			return;
		}
		// 主机ip和端口 或 域名和端口
		String myhosts = request.getHeader("host");
		if (!StringUtils.equals(myhosts, "192.168.0.177:8080")) {
			System.out.println("======访问host非法，已拦截======其非法host为:" + myhosts);
			log.info("======访问host非法，已拦截======其非法host为:" + myhosts);
			response.setStatus(403);
			//response.sendRedirect(request.getContextPath() + "/login.jsp"); // 或者response.setStatus(403);
			return;
		}

		String currentURL = request.getRequestURI();
		// add by wangsk 过滤请求特殊字符，扫描跨站式漏洞
		Map parameters = request.getParameterMap();
		if (parameters != null && parameters.size() > 0) {
			for (Iterator iter = parameters.keySet().iterator(); iter.hasNext();) {
				String key = (String) iter.next();
				String[] values = (String[]) parameters.get(key);
				for (int i = 0; i < values.length; i++) {
					values[i] = guolv(values[i]);
					System.out.println(values[i]);
				}
			}
		}
		filterChain.doFilter(servletRequest, servletResponse);
		return;
	}

	public void init(FilterConfig filterConfig) throws ServletException {

	}

	public static String guolv(String a) {
		a = a.replaceAll("%22", "");
		a = a.replaceAll("%27", "");
		a = a.replaceAll("%3E", "");
		a = a.replaceAll("%3e", "");
		a = a.replaceAll("%3C", "");
		a = a.replaceAll("%3c", "");
		a = a.replaceAll("<", "");
		a = a.replaceAll(">", "");
		a = a.replaceAll("\"", "");
		a = a.replaceAll("'", "");
		a = a.replaceAll("\\+", "");
		a = a.replaceAll("\\(", "");
		a = a.replaceAll("\\)", "");
		a = a.replaceAll(" and ", "");
		a = a.replaceAll(" or ", "");
		a = a.replaceAll(" 1=1 ", "");
		return a;
	}

	private String getRequestString(HttpServletRequest req) {
		String requestPath = req.getServletPath().toString();
		String queryString = req.getQueryString();
		if (queryString != null)
			return requestPath + "?" + queryString;
		else
			return requestPath;
	}

	public String guolv2(String a) {
		if (StringUtils.isNotEmpty(a)) {
			if (a.contains("%22") || a.contains("%3E") || a.contains("%3e") || a.contains("%3C") || a.contains("%3c")
					|| a.contains("<") || a.contains(">") || a.contains("\"") || a.contains("'") || a.contains("+")
					||a.contains(" and ") || a.contains(" or ") || a.contains("1=1") || a.contains("(")
					|| a.contains(")")) {
				return "bingo";
			}
		}
		return a;
	}
}

===========================================

package com.enation.eop;
import java.io.IOException;
import java.util.Map;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;


public class ServletCGIFilter implements Filter{
	
	@Override
	public void init(FilterConfig filterConfig) throws ServletException {
		// TODO Auto-generated method stub
		
	}

	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
			throws IOException, ServletException {
		HttpServletRequest hReqest = (HttpServletRequest) request;
		String referer=hReqest.getHeader("Referer");
		Map map=hReqest.getParameterMap();
		HttpServletResponse hResponse = (HttpServletResponse) response;
		String queryString = hReqest.getQueryString();
		if ( queryString != null && (queryString.contains("\\u0023") || this.queryStringHasCommond(queryString)) ){
			hResponse.sendRedirect(hReqest.getContextPath() + "/404.jsp");
		}else if(map.toString().contains("redirect")){
			hResponse.sendRedirect(hReqest.getContextPath() + "/404.jsp");
		}else{
			chain.doFilter(request, response);
		}
		
	}

	 /**
     * 
     * 描述：检测查询参数是否包含命令行
     * @since 
     * @param queryString
     * @return
     */
	private boolean queryStringHasCommond(String queryString) {
		String cmdModel = "^(action|redirect|redirectAction)(\\:|%3a).*$";
		boolean matched = queryString.toLowerCase().matches(cmdModel);
		return matched;
	}

	@Override
	public void destroy() {
		// TODO Auto-generated method stub
		
	}

}

===========================================

package com.enation.eop;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import com.enation.eop.XssHttpServletRequestWrapper;
public class XssFilter implements Filter {

    public void destroy() {
        // TODO Auto-generated method stub
    }
    /**
     * 过滤器用来过滤的方法
     */
    public void doFilter(ServletRequest request, ServletResponse response,FilterChain chain) throws IOException, ServletException {
        //包装request
        XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest) request);
        chain.doFilter(xssRequest, response);
    }
    public void init(FilterConfig filterConfig) throws ServletException {
        // TODO Auto-generated method stub
    }
}

===========================================

package com.enation.eop;

import java.util.Map;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {  
    HttpServletRequest orgRequest = null;  

    public XssHttpServletRequestWrapper(HttpServletRequest request) {  
        super(request);
    }  
    /** 
     * 覆盖getParameter方法，将参数名和参数值都做xss过滤。
     * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取
     * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖 
     */  
    @Override  
    public String getParameter(String name) {  
        String value = super.getParameter(xssEncode(name));  
        if (value != null) {  
            value = xssEncode(value);  
        }  
        return value;  
    }
    @Override
    public String[] getParameterValues(String name) {
        String[] value = super.getParameterValues(name);
        if(value != null){
            for (int i = 0; i < value.length; i++) {
                value[i] = xssEncode(value[i]);
            }
        }
        return value;
    }
    @Override
    public Map getParameterMap() {
        // TODO Auto-generated method stub
        return super.getParameterMap();
    }

    /** 
     * 覆盖getHeader方法，将参数名和参数值都做xss过滤。
     * 如果需要获得原始的值，则通过super.getHeaders(name)来获取 
     * getHeaderNames 也可能需要覆盖
     * 这一段代码在一开始没有注释掉导致出现406错误，原因是406错误是HTTP协议状态码的一种，
     * 表示无法使用请求的内容特性来响应请求的网页。一般是指客户端浏览器不接受所请求页面的 MIME 类型。 
     *  
     *    
     **/
    @Override  
    public String getHeader(String name) {  

        String value = super.getHeader(xssEncode(name));  
        if (value != null) {  
            value = xssEncode(value);  
        }  
        return value;  
    }  
  


    /** 
     * 将容易引起xss漏洞的半角字符直接替换成全角字符 在保证不删除数据的情况下保存
     * @param s 
     * @return 过滤后的值
     */  
    private static String xssEncode(String value) {  
         if (value == null || value.isEmpty()) {  
            return value;  
        }  
        value = value.replaceAll("eval\\((.*)\\)", "");
        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
        value = value.replaceAll("(?i)<script.*?>.*?<script.*?>", "");
        value = value.replaceAll("(?i)<script.*?>.*?</script.*?>", "");
        value = value.replaceAll("(?i)<.*?javascript:.*?>.*?</.*?>", "");
        value = value.replaceAll("(?i)<.*?\\s+on.*?>.*?</.*?>", "");
        return value;
    }  
}