SpringBoot安全漏洞SQL注入和XSS攻击简介说明

转自:

SpringBoot安全漏洞SQL注入和XSS攻击简介说明

下文笔者讲述springboot安全漏洞中sql注入和xss注入的处理方法简介说明,如下所示

实现思路:
    1.自定义HttpServletRequestWrapper类，实现SQL和XSS 过滤
	2.自定义filter
	3.注册filter,使其发挥功效

例:

自定义HttpServletRequestWrapper类
   实现SQL和XSS 过滤

package com.java265.sql.filter; 
import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Map;
import java.util.Set;
import java.util.Vector;
import java.util.regex.Pattern;
import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import org.springframework.util.StreamUtils;
 
public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {
	 HttpServletRequest orgRequest = null;
	    private Map<String, String[]> parameterMap;
	    private final byte[] body; //用于保存读取body中数据
 
	    public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException{
	        super(request);
	        orgRequest = request;
	        parameterMap = request.getParameterMap();
	        body = StreamUtils.copyToByteArray(request.getInputStream());
	    }
 
	    // 重写几个HttpServletRequestWrapper中的方法
	    /**
	     * 获取所有参数名
	     *
	     * @return 返回所有参数名
	     */
	    @Override
	    public Enumeration<String> getParameterNames() {
	        Vector<String> vector = new Vector<String>(parameterMap.keySet());
	        return vector.elements();
	    }
 
	    /**
	     * 覆盖getParameter方法，将参数名和参数值都做xss & sql过滤。<br/>
	     * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>
	     * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
	     */
	    @Override
	    public String getParameter(String name) {
	        String[] results = parameterMap.get(name);
	        if (results == null || results.length <= 0)
	            return null;
	        else {
	            String value = results[0];
	            if (value != null) {
	                value = xssEncode(value);
	            }
	            return value;
	        }
	    }
 
	    /**
	     * 获取指定参数名的所有值的数组，如：checkbox的所有数据 接收数组变量 ，如checkobx类型
	     */
	    @Override
	    public String[] getParameterValues(String name) {
	        String[] results = parameterMap.get(name);
	        if (results == null || results.length <= 0)
	            return null;
	        else {
	            int length = results.length;
	            for (int i = 0; i < length; i++) {
	                results[i] = xssEncode(results[i]);
	            }
	            return results;
	        }
	    }
 
	    /**
	     * 覆盖getHeader方法，将参数名和参数值都做xss & sql过滤。<br/>
	     * 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>
	     * getHeaderNames 也可能需要覆盖
	     */
	    @Override
	    public String getHeader(String name) {
 
	        String value = super.getHeader(xssEncode(name));
	        if (value != null) {
	            value = xssEncode(value);
	        }
	        return value;
	    }
 
	    /**
	     * 将容易引起xss & sql漏洞的半角字符直接替换成全角字符
	     * 
	     * @param