http://blog.csdn.net/mhanyue/article/details/78563846
继上篇中未解决的问题,又重新对过滤器进行了调整。具体代码如下:
XssFilter.java
/**
* 功能描述:XSS漏洞过滤器
* XssFilter.java 创建与 2017年11月20日 下午2:50:46
* @author mhanyue
* @version 1.0
*/
package com.fh.filter;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
public class XssFilter implements Filter {
public void init(FilterConfig config) throws ServletException {
}
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(
(HttpServletRequest) request);
chain.doFilter(xssRequest, response);
}
public void destroy() {
}
}
XssHttpServletRequestWrapper.java
/**
* 功能描述:XSS漏洞过滤主程序
* XssHttpServletRequestWrapper.java 创建与 2017年11月20日 下午2:51:43
* @author mayue
* @version 1.0
*/
package com.fh.filter;
import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;
import java.util.Set;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
HttpServletRequest orgRequest = null;
public XssHttpServletRequestWrapper(HttpServletRequest request) {
super(request);
orgRequest = request;
}
/**
* 覆盖getParameter方法,将参数名和参数值都做xss过滤。<br/>
* 如果需要获得原始的值,则通过super.getParameterValues(name)来获取<br/>
* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
*/
@Override
public String getParameter(String name) {
if("FILE_TYPE".equals(name)){
return super.getParameter(name);
}
String value = super.getParameter(xssEncode(name));
if (value != null) {
value = xssEncode(value);
}
return value;
}
/**
* 覆盖getParameterValues方法,将参数名和参数值都做xss过滤。<br/>
* 如果需要获得原始的值,则通过super.getParameterValues(name)来获取<br/>
* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
*/
@Override
public String[] getParameterValues(String name) {
if("FILE_TYPE".equals(name)){
return super.getParameterValues(name);
}
String value[] = super.getParameterValues(xssEncode(name));
if (value != null && value.length!=0) {
for(int i = 0; i<value.length;i++){
value[i] = xssEncode(value[i]);
}
}
return value;
}
/**
* 覆盖getParameterValues方法,将参数名和参数值都做xss过滤。<br/>
* 如果需要获得原始的值,则通过super.getParameterValues(name)来获取<br/>
* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
*/
@Override
public Map<String, String[]> getParameterMap() {
Map<String, String[]> value = super.getParameterMap();
Map<String, String[]> newvalue = new HashMap<String, String[]>();
// 获取当前参数集
Set parameterNames = value.keySet();
Iterator it = parameterNames.iterator();
//得到需要过滤的参数名列表,如果列表是空的,则表示过滤所有参数
while (it.hasNext()) {
String paramName = (String) it.next();
if("FILE_TYPE".equals(paramName)){
newvalue.put(paramName, (String[])value.get(paramName));
}else{
String[] values = (String[])value.get(paramName);
if (values != null && values.length!=0) {
for(int i = 0; i<values.length;i++){
values[i] = xssEncode(values[i]);
}
newvalue.put(paramName, values);
}else{
newvalue.put(paramName, values);
}
}
}
return newvalue;
}
/**
* 覆盖getHeader方法,将参数名和参数值都做xss过滤。<br/>
* 如果需要获得原始的值,则通过super.getHeaders(name)来获取<br/>
* getHeaderNames 也可能需要覆盖
*/
@Override
public String getHeader(String name) {
String value = super.getHeader(xssEncode(name));
if (value != null) {
value = xssEncode(value);
}
return value;
}
/**
* 将容易引起xss漏洞的半角字符直接替换成全角字符
*
* @param s
* @return
*/
private static String xssEncode(String s) {
if (s == null || s.isEmpty()) {
return s;
}
StringBuilder sb = new StringBuilder(s.length() + 16);
for (int i = 0; i < s.length(); i++) {
char c = s.charAt(i);
switch (c) {
case '>':
sb.append('>');// 全角大于号
break;
case '<':
sb.append('<');// 全角小于号
break;
case '\'':
sb.append('‘');// 全角单引号
break;
case '\"':
sb.append('“');// 全角双引号
break;
case '&':
sb.append('&');// 全角
break;
case '\\':
sb.append('\');// 全角斜线
break;
case '#':
sb.append('#');// 全角井号
break;
default:
sb.append(c);
break;
}
}
return sb.toString();
}
/**
* 获取最原始的request
*
* @return
*/
public HttpServletRequest getOrgRequest() {
return orgRequest;
}
/**
* 获取最原始的request的静态方法
*
* @return
*/
public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
if (req instanceof XssHttpServletRequestWrapper) {
return ((XssHttpServletRequestWrapper) req).getOrgRequest();
}
return req;
}
}
web.xml
<filter>
<filter-name>XSSFiler</filter-name>
<filter-class>com.fh.filter.XssFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>XSSFiler</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>