全局处理请求参数,防止HTML和XSS攻击

1. 创建一个过滤器：

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

public class XSSFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        // 初始化配置
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        XSSRequestWrapper xssRequestWrapper = new XSSRequestWrapper(httpRequest);
        chain.doFilter(xssRequestWrapper, response);
    }

    @Override
    public void destroy() {
        // 资源清理
    }
}

2. 创建一个请求包装类：

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import org.apache.commons.text.StringEscapeUtils;

import java.util.HashMap;
import java.util.Map;

public class XSSRequestWrapper extends HttpServletRequestWrapper {

    public XSSRequestWrapper(HttpServletRequest request) {
        super(request);
    }

    @Override
    public String[] getParameterValues(String parameter) {
        String[] values = super.getParameterValues(parameter);
        if (values == null) {
            return null;
        }

        int count = values.length;
        String[] encodedValues = new String[count];
        for (int i = 0; i < count; i++) {
            encodedValues[i] = sanitize(values[i]);
        }
        return encodedValues;
    }

    @Override
    public String getParameter(String parameter) {
        String value = super.getParameter(parameter);
        return sanitize(value);
    }

    @Override
    public Map<String, String[]> getParameterMap() {
        Map<String, String[]> map = super.getParameterMap();
        Map<String, String[]> sanitizedMap = new HashMap<>();

        for (Map.Entry<String, String[]> entry : map.entrySet()) {
            String[] values = entry.getValue();
            int count = values.length;
            String[] sanitizedValues = new String[count];
            for (int i = 0; i < count; i++) {
                sanitizedValues[i] = sanitize(values[i]);
            }
            sanitizedMap.put(entry.getKey(), sanitizedValues);
        }
        return sanitizedMap;
    }

    private String sanitize(String input) {
        return StringEscapeUtils.escapeHtml4(input);
    }
}

3. 注册过滤器：
   在web.xml中注册过滤器，或在Spring Boot中使用配置类注册过滤器。

在web.xml中：

<filter>
    <filter-name>xssFilter</filter-name>
    <filter-class>com.example.XSSFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>xssFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

在Spring Boot中：

import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class FilterConfig {

    @Bean
    public FilterRegistrationBean<XSSFilter> xssFilterRegistrationBean() {
        FilterRegistrationBean<XSSFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(new XSSFilter());
        registrationBean.addUrlPatterns("/*");
        return registrationBean;
    }
}

以上代码实现了一个基本的XSS防护过滤器，它会对所有进入的请求参数进行HTML转义，从而防止HTML和XSS攻击。