spring boot XSS 攻击 富文本框

2个类

 

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

import org.apache.commons.lang3.StringEscapeUtils;

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {

    public XssHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
    }

    public String[] getParameterValues(String parameter) {
        String[] values = super.getParameterValues(parameter);
        if (values == null) {
            return null;
        }
        int count = values.length;
        String[] encodedValues = new String[count];
        for (int i = 0; i < count; i++) {
            encodedValues[i] = cleanXSS(values[i]);
        }
        return encodedValues;
    }

    public String getParameter(String parameter) {
        String value = super.getParameter(parameter);
        if (value == null) {
            return null;
        }
        return cleanXSS(value);
    }

    public String getHeader(String name) {
        String value = super.getHeader(name);
        if (value == null)
            return null;
        return cleanXSS(value);
    }

    private String cleanXSS(String value) {
        // value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");
        //  value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;");
        //  value = value.replaceAll("'", "& #39;");
        value = value.replaceAll("alert", "");
        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
        value = value.replaceAll("script", "");
        return value;
    }
}

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import org.springframework.stereotype.Component;

import com.sinopec.siam.apache.log4j.Logger;

@Component
public class XssFilter implements Filter {
    @Override
    public void destroy() {

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
                         FilterChain chain) throws IOException, ServletException {

      /*  HttpServletRequest httpRequest=(HttpServletRequest) request;
       // Set<String> textList=new HashSet<String>();
        String bulltincontent=request.getParameter("bulltincontent");
        String bulletinTitle=request.getParameter("bulletinTitle");
        *//*textList.add(bulltincontent);
        textList.add(content);*//*
        if(bulltincontent!=null&&bulltincontent.length()>0){
            if (bulletinTitle!=null&&bulletinTitle.length()>0){
                XssHttpServletRequestWrapper xssHttpServletRequestWrapper=new XssHttpServletRequestWrapper(httpRequest);
                xssHttpServletRequestWrapper.getParameter(bulletinTitle);
                System.out.println(xssHttpServletRequestWrapper.getParameter(bulletinTitle));
            }
            chain.doFilter(httpRequest,response);
            String bulletinTitle1=request.getParameter("bulletinTitle");
            System.out.println(bulletinTitle1);
        }else{
            chain.doFilter(new XssHttpServletRequestWrapper(
                    (HttpServletRequest)request), response);//对request和response进行过滤
        }*/

        chain.doFilter(new XssHttpServletRequestWrapper(
                (HttpServletRequest)request), response);//对request和response进行过滤
    }

    @Override
    public void init(FilterConfig arg0) throws ServletException {

    }
}