SpringBoot2.1.x，集成POI，用HttpServletRequestWrapper实现XSS攻击拦截，用HttpServletResponseWrapper实现通用excel导出功能

最新推荐文章于 2023-12-20 11:53:29 发布

ouyangjun__

最新推荐文章于 2023-12-20 11:53:29 发布

阅读量1.4k

点赞数

分类专栏： SpringBoot2.3.0

本文链接：https://blog.csdn.net/p812438109/article/details/107872074

版权

该教程详细介绍了如何在SpringBoot2.1.x项目中，利用Filter和HttpServletRequestWrapper、HttpServletResponseWrapper实现Excel通用导出功能，并结合XSS过滤，防止攻击。步骤包括创建项目、配置、数据封装、请求流转换、XSS过滤、SQL注入过滤、响应流转换、Excel导出工具类、拦截器和控制器的实现。文章提供了完整的项目结构和执行效果。

摘要由CSDN通过智能技术生成

该案例是用Filter拦截器实现excel通用导出功能，并在实现的过程中，加入了XSS攻击拦截功能。

局限性：

1、excel通用导出，只能用于一种导出模板，列头+数据格式

2、不适合数据超大导出

导出excel通用模板格式效果图：

第一步：创建一个maven项目，引入springboot的jar，并引入POI导出excel需要的jar

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.oysept</groupId>
    <artifactId>springboot_export</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>jar</packaging>
  
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.1.4.RELEASE</version>
        <relativePath/>
    </parent>
  
    <properties>
        <java.version>1.8</java.version>
        <poi.version>3.17</poi.version>
        <fastjson.version>1.2.70</fastjson.version>
    </properties>
  
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        
        <!--excel-->
        <dependency>
            <groupId>org.apache.poi</groupId>
            <artifactId>poi</artifactId>
            <version>${poi.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.poi</groupId>
            <artifactId>poi-ooxml</artifactId>
            <version>${poi.version}</version>
        </dependency>
        
        <!-- json -->
        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>fastjson</artifactId>
            <version>${fastjson.version}</version>
        </dependency>
    </dependencies>
    
    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <mainClass>com.oysept.ExportApplication</mainClass>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.tomcat.maven</groupId>
                <artifactId>tomcat7-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>
</project>

添加application.yml配置文件：

server:
    port: 8080

创建一个DataVO数据封装类：

package com.oysept.vo;

public class DataVO {

    private String title;
    private String content;
    private Long timestamp;
	
    public DataVO() {}
    public DataVO(String title, String content, Long timestamp) {
        this.title = title;
        this.content = content;
        this.timestamp = timestamp;
    }
	
    public String getTitle() {return title;}
    public void setTitle(String title) {this.title = title;}
	
    public String getContent() {return content;}
    public void setContent(String content) {this.content = content;}
	
    public Long getTimestamp() {return timestamp;}
    public void setTimestamp(Long timestamp) {this.timestamp = timestamp;}
	
    public String toString() {
        return "DataVO[title: "+this.title+", content: "+this.content+", timestamp: "+this.timestamp+"]";
    }
}

第二步：创建请求流转换配置类，把ByteArrayInputStream流转换成ServletInputStream流

package com.oysept.config;

import java.io.IOException;
import java.io.InputStream;

import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;

import org.springframework.util.Assert;

/**
 * Delegating implementation of {@link javax.servlet.ServletInputStream}.
 *
 * <p>Used by {@link MockHttpServletRequest}; typically not directly
 * used for testing application controllers.
 *
 * @author
 * @since
 * @see MockHttpServletRequest
 */
public class DelegatingServletInputStream extends ServletInputStream {

    private final InputStream sourceStream;

    private boolean finished = false;

    /**
     * Create a DelegatingServletInputStream for the given source stream.
     * @param sourceStream the source stream (never {@code null})
     */
    public DelegatingServle