XSS漏洞通过HttpServletRequestWrapper实现

• 目前对XSS漏洞要求修复，考虑通过拦截器来统一处理request的参数，对XSS相关的js脚本进行过滤替换，从来来实现漏洞修复。
• 但是HttpServletRequest中的参数是无法改变的，若是手动执行修改request中的参数，则会抛出异常。我们可以利用HttpServletRequestWrapper包装HttpServletRequest，在Wrapper中实现参数的修改，然后用HttpServletRequestWrapper替换HttpServletRequest，这样就实现了参数的修改设置。
• 下面是实现步骤：

---

1. 继承HttpServletRequestWrapper，实现一个自己的XSSRequestWrapper来更改request的参数。
   我们在servlet中通过request来获取参数的方法大概有几个：getParameter、getAttribute、getParameterMap等等，所以必须在XSSRequestWrapper里面重写这些方法，才能够在servlet中调用上面的方法来获取参数的时候，对参数中的XSS敏感脚本进行处理，在这里我之重写了这三个方法，如果你们有用到其他方法来获取参数，请重写这些方法以达到修改参数的目的

package cn.com.easy.filter;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Vector;
import java.util.regex.Pattern;

import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

import org.apache.commons.io.IOUtils;

public class XSSRequestWrapper extends HttpServletRequestWrapper  {

    private Map<String, String[]> parameterMap; // 所有参数的Map集合
     private HttpServletRequest request;  
    public XSSRequestWrapper(HttpServletRequest request) {
        super(request);
        parameterMap = request.getParameterMap();
        this.request = request;  
    }

    /* 获取所有参数名
     * 
     * @return 返回所有参数名
     */
    @Override
    public Enumeration<String> getParameterNames() {
        Vector<String> vector = new Vector<String>(parameterMap.keySet());
        return vector.elements();
    }

    @Override  
    public ServletInputStream getInputStream() {  
        String bizBindMsg = null;  
        ServletInputStream stream = null;  

        try {  
            stream = request.getInputStream();  
            bizBindMsg = IOUtils.toString(stream, "UTF-8");  
        } catch (IOException e) {  
            e.printStackTrace();  
        }  
        try {  
            bizBindMsg = URLDecoder.decode(bizBindMsg.toString(), "UTF-8");  
        } catch (UnsupportedEncodingException e) {  
            e.printStackTrace();  
        }  
        //System.out.println("RequestWrapper接收到的请求为: " + bizBindMsg); 
        bizBindMsg = stripXSS(bizBindMsg);
        /** 
         * 将解密后的明文串放到buffer数组中 
         */ 
        byte[] buffer = null;  
        try {  
            buffer = bizBindMsg.getBytes("UTF-8");  
        } catch (UnsupportedEncodingException e) {  
            e.printStackTrace();  
        }  
        final ByteArrayInputStream bais = new ByteArrayInputStream(buffer);  

        ServletInputStream newStream = new ServletInputStream() {  

            @Override  
            public int read() throws IOException {  
                return bais.read();  
            }  
        };  
        return newStream;  
  }


/*  @Override
    public String[] getParameterValues(String parameter) {
        String[] values = super.getParameterValues(parameter);

        if (values == null) {
            return null;
        }
        int count = values.length;
        String[] encodedValues = new String[count];
        for (int i = 0; i < count; i++) {
            encodedValues[i] = StringEscapeUtils.escapeHtml(values[i]);
            encodedValues[i] = stripXSS(encodedValues[i]);
        }
        System.out.println("2222参数名："+parameter+"的原始值为"+values+",替换后为："+encodedValues);
        return encodedValues;
    }*/



    @Override
    public String getParameter(String parameter) {
        String[] value = parameterMap.get(parameter);
        if (value != null){
            //System.out.println("参数名："+parameter+"的原始值为"+value[0]+",替换后为："+stripXSS(value[0]));
            return stripXSS(value[0]);
        }
        return null;
    }

      /**
     * 获取attribute,特殊字符过滤
     */
    @Override
    public Object getAttribute(String parameter) {
        Object value = super.getAttribute(parameter);
        if (value != null && value instanceof String) {
            stripXSS((String) value);
            //System.out.println("参数名33："+parameter+"的原始值为"+value+",替换后为："+stripXSS((String) value));
            return stripXSS((String) value);
        }else{
            return value;
        }

    }




    @Override
    public String getHeader(String name) {
        String value = super.getHeader(name);
        return stripXSS(value);
    }

      /**
     * 获取指定参数名的所有值的数组，如：checkbox的所有数据
     * 接收数组变量 ，如checkobx类型
     */
    @Override
    public String[] getParameterValues(String name) {
        return parameterMap.get(name);
    }
    @Override
    public Map<String, String[]> getParameterMap() {
        Map<String, String[]> newMap = new HashMap<String, String[]>();
        for (Entry<String, String[]> entry : parameterMap.entrySet()) { 
            newMap.put(entry.getKey(), new String[]{stripXSS(entry.getValue()[0])});
        }
        return newMap;
    }
    public void setParameterMap(Map<String, String[]> parameterMap) {
        this.parameterMap = parameterMap;
    }

    private String stripXSS(String value) {
        if (value != null) {
            value = value.replaceAll("", "");
            Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("<script(.*?)>",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("eval\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("e­xpression\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("onload(.*?)=",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("alert\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("window.location(.*?)=",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("unescape\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("execscript\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("msgbox\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("confirm\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("prompt\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
        }
        return value;
    }

    private String cleanXSS(String value) {
        // You'll need to remove the spaces from the html entities below
        value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");
        value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;");
        value = value.replaceAll("'", "& #39;");
        value = value.replaceAll("eval\\((.*)\\)", "");
        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
        value = value.replaceAll("script", "");
        return value;
    }

}

2.编写过滤器XssFilter

package cn.com.easy.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

public class XssFilter  implements Filter{
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        XSSRequestWrapper xSSRequestWrapper = new XSSRequestWrapper((HttpServletRequest) request);
        chain.doFilter(xSSRequestWrapper, response);
    }
    @Override
    public void destroy() {

    }
}

3.配置web.xml,在里面增加过滤器

<!-- 存储型xss漏洞修复 -->
    <filter>  
        <filter-name>XSSFiler2</filter-name>  
        <filter-class>  
            cn.com.easy.filter.XssFilter
        </filter-class> 
    </filter>  
    <filter-mapping>  
        <filter-name>XSSFiler2</filter-name>  
        <url-pattern>*.e</url-pattern>
    </filter-mapping>
    <filter-mapping>  
        <filter-name>XSSFiler2</filter-name>  
        <url-pattern>*.jsp</url-pattern>
    </filter-mapping>

这样可以有效的解决XSS漏洞了。
最后说一下在解决此漏洞的过程中出现的一些问题和解决思路

• 刚开始在XSSRequestWrapper中我只是实现了getParameter方法，这样就导致有的方法能替换参数中的脚本，有的不能替换，后来发现在servlet中获取参数的方法是有多个的，所以如果出现有的参数不能被处理的时候，就应该是在servlet中通过request获取参数的方法在XSSRequestWrapper中并没有实现引起的。