springboot 、springmvc 预防xss 攻击 自定义WebBindingInitializer 实现类

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.bind.WebDataBinder;
import org.springframework.web.bind.support.WebBindingInitializer;
import org.springframework.web.context.request.WebRequest;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter;

/**
 * 全局请求参数绑定：
 * 
 * 		针对表单绑定参数处理
 * 
 */
@Configuration
public class MyWebBindingInitializer implements WebBindingInitializer {
	
	private static final WebBindingInitializer webBindingInitializer = new MyWebBindingInitializer();

	@Override
	public void initBinder(WebDataBinder binder, WebRequest request) {
		binder.registerCustomEditor(String.class, new StringEscapeEditor(true, true, false));
	}
	
	
	@Autowired
	public void getWebBindingInitializer(RequestMappingHandlerAdapter requestMappingHandlerAdapter){
		requestMappingHandlerAdapter.setWebBindingInitializer(webBindingInitializer);
	}

}

import java.beans.PropertyEditorSupport;

import org.apache.commons.lang3.StringEscapeUtils;

public class StringEscapeEditor extends PropertyEditorSupport {

	private boolean escapeHTML;
	private boolean escapeJavaScript;
	private boolean escapeSQL;

	public StringEscapeEditor() {
		super();
	}

	public StringEscapeEditor(boolean escapeHTML, boolean escapeJavaScript, boolean escapeSQL) {
		super();
		this.escapeHTML = escapeHTML;
		this.escapeJavaScript = escapeJavaScript;
		this.escapeSQL = escapeSQL;
	}

	@Override
	public void setAsText(String text) {
		if (text == null) {
			setValue(null);
		} else {
			String value = text;
			if (escapeHTML) {
				value = StringEscapeUtils.escapeHtml3(value);
			}
			if (escapeJavaScript) {
				value = this.escapeScript(value);
			}
			if (escapeSQL) {
				value = this.escapeSql(value);
			}
			setValue(value);
		}
	}

	@Override
	public String getAsText() {
		Object value = getValue();
		return value != null ? value.toString() : "";
	}
	
	/**
	 * 剥离SQL注入部分代码
	 * @param value
	 * @return
	 */
	public String escapeSql(String value) {
		return value.replaceAll("('.+--)|(--)|(\\|)|(%7C)", "");
	}
	
	/**
	 * 剥离js注入
	 * @param value
	 * @return
	 */
	public String escapeScript(String value){
		value = value.replace("script", "\\script").replace("/script", "\\/script");
		return value;
	}
}

如果是springmvc 框架：

还需要在springMVC-servlet.xml文件里面进行配置，且去掉

@Configuration

注解

springMVC-servlet 配置：

<!-- 防止xss攻击 自定义 WebBindingInitializer-->
	<bean class="org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter">  
        <property name="cacheSeconds" value="0"/>  
        <property name="webBindingInitializer">  
            <bean class="com.wphk.filter.MyWebBindingInitializer"/>  
        </property>  
    </bean>