Java防止跨站点脚本编制（XSS）注入攻击

过滤xss攻击源码

package com.assp.framework.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import com.wsx.assp.framework.util.XSSRequestWrapper;

public class ScriptFilter implements Filter {
	
	public void destroy() {
		
	}

	public void doFilter(ServletRequest request, ServletResponse response,FilterChain chain) throws IOException, ServletException {
		HttpServletRequest req = (HttpServletRequest) request;
		String url = req.getServletPath(); 
		if("/sys/news/insertOrUpdateNews.shtml".equals(url) || "/sys/news/insertOrUpdateLockNews.shtml".equals(url) || "/sys/rgyRule/modifyRgyRule.shtml".equals(url) || "/sys/rgyRule/insertRgyRule.shtml".equals(url)){
			chain.doFilter(request , response); 
		}else{
			chain.doFilter(new XSSRequestWrapper((HttpServletRequest) request), response); 
		}
	}

	public void init(FilterConfig filterConfig) throws ServletException {
		
	}
	
}

 

package com.assp.framework.util;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public class XSSRequestWrapper extends HttpServletRequestWrapper {
	
	public XSSRequestWrapper(HttpServletRequest servletRequest) {  
        super(servletRequest);  
    }  
  
    @Override  
    public String[] getParameterValues(String parameter) {  
        String[] values = super.getParameterValues(parameter);  
  
        if (values == null) {  
            return null;  
        }  
  
        int count = values.length;  
        String[] encodedValues = new String[count];  
        for (int i = 0; i < count; i++) {  
            encodedValues[i] = stripXSS(values[i]);    
        }  
  
        return encodedValues;  
    }  
  
    @Override  
    public String getParameter(String parameter) {  
        String value = super.getParameter(parameter);  
  
        return stripXSS(value);  
    }  
  
    @Override  
    public String getHeader(String name) {  
        String value = super.getHeader(name);  
        return stripXSS(value);  
    }  
  
    private String stripXSS(String value) {  
        if (value != null) {  
        	
            // Avoid null characters  
            value = value.replaceAll("", "");  
  
            // Avoid anything between script tags  
            value = filterXss(value,"<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);  
  
            // Avoid anything in a src='...' type of expression  
            value = filterXss(value,"src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  
  
            // Remove any lonesome </script> tag  
            value = filterXss(value,"</script>", Pattern.CASE_INSENSITIVE);  
            
            // Remove any lonesome <script ...> tag  
            value = filterXss(value,"<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  
  
            // Avoid eval(...) expressions  
            value = filterXss(value,"eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  
  
            // Avoid expression(...) expressions  
            value = filterXss(value,"expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  
  
            // Avoid javascript:... expressions  
            value = filterXss(value,"javascript:", Pattern.CASE_INSENSITIVE);  
  
            // Avoid vbscript:... expressions  
            value = filterXss(value,"vbscript:", Pattern.CASE_INSENSITIVE);  
  
            // Avoid onload= expressions  
            value = filterXss(value,"onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  
            
            // Avoid alert(...) expressions  
            value = filterXss(value,"alert\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            // Avoid <img ...> expressions  
            value = filterXss(value,"<img(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            // Avoid onMouseOver expressions  
            value = filterXss(value,"onMouseOver", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            
        }  
        return value;  
    }  
    
    /***
     * 循环匹配符合条件的特殊字符，如果存在则过滤为空。
     * <p>方法详述（简单方法可不必详述）。</p>
     * @param value
     * @param regex
     * @param flags
     * @return
     */
    private String filterXss(String value,String regex,int flags){
    	Pattern scriptPattern = Pattern.compile(regex, flags);  
    	Matcher matcher = scriptPattern.matcher(value); 
    	while (matcher.find()) {
    		System.out.println(value);
    		value = matcher.replaceAll("");
    		matcher = scriptPattern.matcher(value);
		}
    	return value;
    }
}