xss和csrf其实就是一个过滤器和一个拦截器而已：放屁

CSRF攻击原理及防御：https://www.cnblogs.com/shytong/p/5308667.html 

CSRF 攻击的应对之道：https://www.ibm.com/developerworks/cn/web/1102_niugang_csrf/

 

拦截器可以获取IOC容器中的各个bean，而过滤器就不行，这点很重要，在拦截器里注入一个service，可以调用业务逻辑。

 

 

XSS

一个目标资源可以指定多个过滤器，过滤器的执行顺序是在web.xml文件中的部署顺序：

1.web.xml配置filter

  1.1配置要拦截的url的格式

  1.2配置拦截后的处理类

 

<filter>
    <filter-name>XSSFilter</filter-name>
    <filter-class>com.jd.ihotel.pc.webapp.filters.NewXssFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>XSSFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

一个filter可被多个mapping使用：

1. <filter>  
2.     <filter-name>authority</filter-name>  
3.     <filter-class>com.util.AuthorityFilter</filter-class>  
4. </filter>  
5. <filter-mapping>  
6.     <filter-name>authority</filter-name>  
7.        <url-pattern>/pages/genbill/*</url-pattern>  
8. </filter-mapping>  
9. <filter-mapping>  
10.     <filter-name>authority</filter-name>  
11.     <url-pattern>/pages/cmm/*</url-pattern>  
12. </filter-mapping>

2.配置依赖：

<dependency>
    <groupId>javax.servlet</groupId>
    <artifactId>javax.servlet-api</artifactId>
    <version>3.0.1</version>
    <scope>provided</scope>
</dependency>

新建：实现Filter类是初始化，过滤，销毁三个方法必须都实现(初始化和销毁可以是空方法，过滤方法中chain.doFilter的参数是装饰者模式的http请求对象和普通的http响应对象)

NewXssFilter类

过滤方法中新建一个request过滤对象(装饰者模式)，以便可以对request的参数进行更改(过滤)

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

public class NewXssFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        chain.doFilter(new NewXssHttpServletRequestWraper(
                (HttpServletRequest)request), response);//对request和response进行过滤
    }

    @Override
    public void destroy() {

    }
}

新建NewXssHttpServletRequestWraper类

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public class NewXssHttpServletRequestWraper extends HttpServletRequestWrapper {

    public NewXssHttpServletRequestWraper(HttpServletRequest request) {
        super(request);
    }

    @Override
    public String getParameter(String name) {
        return clearXss(super.getParameter(name));
    }

    @Override
    public String getHeader(String name) {
        return clearXss(super.getHeader(name));
    }
    @Override
    public String[] getParameterValues(String name) {
        String[] values = super.getParameterValues(name);
        if (values == null) {
            return null;
        }
        String[] newValues = new String[values.length];

        for (int i = 0; i < values.length; i++) {
            newValues[i] = clearXss(values[i]);
        }

        return newValues;
    }

    /**
     * 处理字符转义
     *
     * @param value
     * @return
     */
    private String clearXss(String value) {
        if (value == null || "".equals(value)) {
            return value;
        }
        value = value
                .replaceAll("'","")
                .replaceAll("\'","")
                .replaceAll("`","")
                //.replaceAll("\"","“")
                .replaceAll("<","")
                .replaceAll(">","")
                .replaceAll("\\(","（")
                .replaceAll("\\)","）")
                //.replaceAll("&","＆")
                .replaceAll("eval","")
                .replaceAll("java","")
                .replaceAll("script","")
                .replaceAll("alert","")
                .replaceAll("prompt","");
        value = value.replaceAll("eval\\((.*)\\)", "");
        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']",
                "\"\"");
        return value;
    }



}

下面的代码配置的过滤器必须有吗？作用是？

<filter>
    <filter-name>XssEscape</filter-name>
    <filter-class>com.jd.ihotel.pc.webapp.filters.XssFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>XssEscape</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>

 

也可以简答粗暴不用过滤器这么写：

 

private String stripXSS(String value) {
    if (value != null) {
        value = value.replaceAll("<", "&lt;").replaceAll(">", "&gt;");
        value = value.replaceAll("\\(", "&#40;").replaceAll("\\)", "&#41;");
        value = value.replaceAll("'", "&#39;");
        value = value.replaceAll("eval\\((.*)\\)", "");
        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
        value = value.replaceAll("script", "");
        value = value.replaceAll("%", "");
        value = value.replaceAll(";", "");
    }
    return value;
}

 

 

 

如果项目中使用了Spring框架，那么，很多过滤器都不用自己来写了，Spring为我们写好了一些常用的过滤器。下面我们就以字符编码的
过滤器CharacterEncodingFilter为例，来看一下Spring框架下，如果配置过滤器。

1. <filter>

2. <filter-name>encodingFilter</filter-name>

3. <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>

4. <init-param>

5. <param-name>encoding</param-name>

6. <param-value>UTF-8</param-value>

7. </init-param>

8. <init-param>

9. <param-name>forceEncoding</param-name>

10. <param-value>true</param-value>

11. </init-param>

12. </filter>

13.  

14. <filter-mapping>

15. <filter-name>encodingFilter</filter-name>

16. <url-pattern>/*</url-pattern>

17. </filter-mapping>

 

 

 

CSRF:访问受信网站A并在本地产生cookie，不登出A的情况访问不受信网站B(即使浏览器关闭，A的cookie不一定立即过期或会话结束)

http://www.cnblogs.com/shanyou/p/5038794.html

1.web.xml中配置springMVC：

<servlet>
   <servlet-name>mvc</servlet-name>
   <servlet-class>
      org.springframework.web.servlet.DispatcherServlet
   </servlet-class>
   <init-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>classpath:spring-web-config.xml</param-value>
   </init-param>
   <load-on-startup>1</load-on-startup>
</servlet>

2.springMVC配置中配置拦截器

 <mvc:interceptors>
        <mvc:interceptor>
            <mvc:mapping path="/submitOrder.html" />
            <mvc:mapping path="/ihtrade/unpaidCancel.html"/>
            <mvc:mapping path="/ihtrade/cancel.html"/>
            <bean class="com.jd.ihtrade.core.intercepter.CheckRefferIntercepter" />
        </mvc:interceptor>
    </mvc:interceptors>

</beans>

3.新建拦截器里配置的类：

 

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.net.URI;

public class CheckRefferIntercepter implements HandlerInterceptor{
    private Logger logger = LoggerFactory.getLogger(CheckRefferIntercepter.class);
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws
            Exception {
        String referer = request.getHeader("referer");
        StringBuffer requestURL = request.getRequestURL();
        if(referer == null || referer.isEmpty()) {
            return false ;
        }
        try{
            if (referer.contains("?")){
                referer = referer.substring(0, referer.indexOf("?"));
            }
            URI referUri = new URI(referer);
            String domain = referUri.getHost();
            logger.info("请求目的地URL:{}来源URL:{}验证:{}",requestURL,referer,domain);
            if(domain != null){
                if(
                        domain.endsWith("360buy.com")
                        || domain.endsWith("jd.com")
                        || domain.endsWith("jd.net")
                        || domain.endsWith("jd.hk")
                        ) {
                    return true;
                }
            }
        } catch (Exception e){
            logger.error("--invalid uri--" + referer, e);
            return false ;
        }
        return false ;
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {

    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {

    }
}

可使用拦截器验证token来避免攻击：

http://www.360doc.com/content/18/0223/11/31784658_731672172.shtml

token 是在服务端产生的。如果前端使用用户名/密码向服务端请求认证，服务端认证成功，那么在服务端会返回 token 给前端。前端可以在每次请求的时候带上 token 证明自己的合法地位。