XSS漏洞与SQL注入漏洞解决方案

最新推荐文章于 2024-05-15 09:53:42 发布

板砖的加菲

最新推荐文章于 2024-05-15 09:53:42 发布

阅读量4.7k

点赞数

分类专栏： java spring mvc 文章标签：漏洞解决方案

本文链接：https://blog.csdn.net/u013755149/article/details/76671248

版权

java 同时被 2 个专栏收录

4 篇文章 0 订阅

订阅专栏

spring mvc

4 篇文章 0 订阅

订阅专栏

跨站脚本攻击的原理

XSS又叫CSS (Cross Site Script) ，跨站脚本攻击。它指的是恶意攻击者往Web页面里插入恶意脚本代码，而程序对于用户输入内容未过滤，当用户浏览该页之时，嵌入其中Web里面的脚本代码会被执行，从而达到恶意攻击用户的特殊目的。

跨站脚本攻击的危害：窃取cookie、放蠕虫、网站钓鱼 …

跨站脚本攻击的分类主要有：存储型XSS、反射型XSS、DOM型XSS

SQL注入攻击的原理：

使用用户输入的参数拼凑SQL查询语句，使用户可以控制SQL查询语句。

XSS漏洞及SQL注入过滤器参考：

1.XssReqFilter

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import com.talent.zdjf.wrapper.XssHttpServletRequestWrapper;

public class XssReqFilter implements Filter {

    FilterConfig filterConfig = null;

    @Override
    public void destroy() {
        this.filterConfig = null;
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {       

        XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(
                (HttpServletRequest) request);
        chain.doFilter(xssRequest, response);
    }

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        this.filterConfig = filterConfig;
    }
}

2.XssHttpServletRequestWrapper

import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;
import java.util.regex.Pattern;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;


public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
    HttpServletRequest orgRequest = null;

    public XssHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
        orgRequest = request;
    }

    /**
     * 覆盖getParameter方法，将参数名和参数值都做xss过滤。<br/>
     * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>
     * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
     */
    @Override
    public String getParameter(String name) {
//      System.out.println("XssFilter处理前的 Value = " + super.getParameter(name));

        String value = super.getParameter(xssEncode(name));
        if (value != null) {
            value = xssEncode(value);
        }

//      System.out.println("XssFilter处理后的 Value = " + value);

        return value;
    }

    /**
     * 覆盖getParameterValues方法，将参数名和参数值都做xss过滤。<br/>
     */
    @Override
    public String[] getParameterValues(String parameter) {
        String[] values = super.getParameterValues(parameter);
        if (values == null) {
            return null;
        }
        int count = values.length;
        String[] encodedValues = new String[count];
        for (int i = 0; i < count; i++) {
            encodedValues[i] = xssEncode(values[i]);
        }
        return encodedValues;
    }


    @Override
    public Map<String, String> getParameterMap() {
        HashMap<String, String> paramMap = (HashMap<String, String>) super.getParameterMap();
        paramMap = (HashMap<String, String>) paramMap.clone();

        for (Iterator iterator = paramMap.entrySet().iterator(); iterator.hasNext();) {
            Map.Entry<String, String[]> entry = (Map.Entry<String, String[]>) iterator.next();
            String[] values = entry.getValue();
            for (int i = 0; i < values.length; i++) {
                if (values[i] instanceof String) {
                    values[i] = xssEncode(values[i]);
                }
            }
            entry.setValue(values);
        }
        return paramMap;
    }

    public String getQueryString() {
        String value = super.getQueryString();
        if (value != null) {
            value = xssEncode(value);
            value = value.replaceAll("＆", "&").replaceAll("＝", "=");
        }
        return value;
    }

    /**
     * 覆盖getHeader方法，将参数名和参数值都做xss过滤。<br/>
     * 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>
     * getHeaderNames 也可能需要覆盖
     */
    @Override
    public String getHeader(String name) {

        String value = super.getHeader(xssEncode(name));
        if (value != null) {
            value = xssEncode(value);
        }
        return value;
    }

    public String escape(String s) {
        StringBuilder sb = new StringBuilder(s.length() + 16);
        for (int i = 0; i < s.length(); i++) {
            char c = s.charAt(i);
            switch (c) {
//          case '(':
//              sb.append('（');// 全角左括号
//              break;
//          case ')':
//              sb.append('）');// 全角右括号
//              break;
            case '>':
                sb.append('＞');// 全角大于号
                break;
            case '<':
                sb.append('＜');// 全角小于号
                break;
            case '\'':
                sb.append('‘');// 全角单引号
                break;
            case '\"':
                sb.append('“');// 全角双引号
                break;
            case '\\':
                sb.append('＼');// 全角斜线
                break;
            case '%':
                sb.append('％'); // 全角冒号
                break;
            default:
                sb.append(c);
                break;
            }

        }
        return sb.toString();
    }

    /**
     * 将容易引起xss漏洞的半角字符直接替换成全角字符
     * 
     * @param s
     * @return
     */
    public String xssEncode(String s) {
        if (s == null || s.isEmpty()) {
            return s;
        }

        String result = stripXSS(s);
        if (null != result) {
            result = escape(result);
        }

        return result;
    }

    private String stripXSS(String value) {
        if (value != null) {
            // NOTE: It's highly recommended to use the ESAPI library and
            // uncomment the following line to
            // avoid encoded attacks.
            // value = ESAPI.encoder().canonicalize(value);
            // Avoid null characters
            value = value.replaceAll("", "");
            // Avoid anything between script tags
            Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
            scriptPattern = Pattern.compile("alert(.*?)",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
            // Avoid anything in a src='...' type of expression
            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
            // Remove any lonesome </script> tag
            scriptPattern = Pattern.compile("</script>",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
            // Remove any lonesome <script ...> tag
            scriptPattern = Pattern.compile("<script(.*?)>",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
            // Avoid eval(...) expressions
            scriptPattern = Pattern.compile("eval\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
            // Avoid expression(...) expressions
            scriptPattern = Pattern.compile("expression\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
            // Avoid javascript:... expressions
            scriptPattern = Pattern.compile("javascript:",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
            // Avoid vbscript:... expressions
            scriptPattern = Pattern.compile("vbscript:",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
            // Avoid onload= expressions
            scriptPattern = Pattern.compile("onload(.*?)=",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("<iframe>(.*?)</iframe>",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("</iframe>",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
            // Remove any lonesome <script ...> tag
            scriptPattern = Pattern.compile("<iframe(.*?)>",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
            scriptPattern = Pattern.compile("\"onmouseover.*?='.*?\\\\x61\\\\x6c\\\\x65\\\\x72\\\\x74\\\\x28\\\\x31\\\\x29'.*?[new Function|new\\+Function]\\(.*?\\)\\(\\)\"",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
            scriptPattern = Pattern.compile("&#x6a;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3a;alert&#x28;.*?&#x29;",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
        }
        return value;
    }

    /**
     * 获取最原始的request
     * 
     * @return
     */
    public HttpServletRequest getOrgRequest() {
        return orgRequest;
    }

    /**
     * 获取最原始的request的静态方法
     * 
     * @return
     */
    public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
        if (req instanceof XssHttpServletRequestWrapper) {
            return ((XssHttpServletRequestWrapper) req).getOrgRequest();
        }

        return req;
    }
}

3.XssRspFilter

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.talent.zdjf.wrapper.XssHttpServletResponseWrapper;


public class XssRspFilter implements Filter {

    FilterConfig filterConfig = null;

    @Override
    public void destroy() {
        this.filterConfig = null;
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {

        HttpServletRequest rq = (HttpServletRequest) request;
        XssHttpServletResponseWrapper rsp = new XssHttpServletResponseWrapper((HttpServletResponse) response);
        chain.doFilter(rq, rsp);

        // 得到response输出内容,并过滤
        String output = rsp.filterRspInfo(rsp.getCharArrayWriter());

        // 通过response输出内容
        rsp.getOutputStream().write(output.getBytes("UTF-8"));
        rsp.getOutputStream().flush();

    }

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        this.filterConfig = filterConfig;
    }
}

import java.io.CharArrayWriter;
import java.io.IOException;
import java.io.PrintWriter;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServletResponseWrapper;

//定义具有缓存功能response
public class XssHttpServletResponseWrapper extends HttpServletResponseWrapper {
    // 定义字符数组
    private CharArrayWriter charArrayWriter = new CharArrayWriter();

    public XssHttpServletResponseWrapper(HttpServletResponse response) {
        super(response);
    }

    public void finalize() throws Throwable {
        super.finalize();
        charArrayWriter.close();
    }

    @Override
    public PrintWriter getWriter() throws IOException {
        return new PrintWriter(charArrayWriter);
    }

    public CharArrayWriter getCharArrayWriter() {
        return charArrayWriter;
    }

    public String filterRspInfo(CharArrayWriter charArrayWriter) {

        String str =charArrayWriter.toString();     
        String[] regxs = new String[]{
                                      "[\"|'][\\+|\\=|\\*|\\^|\\&|\\-]{1,}.*?(alert|eval){1}.*?([\\+|\\=|\\*|\\^|\\&|\\-]{1,}\"){1}"
//                                    "\\\\x6a\\\\x61\\\\x76\\\\x61\\\\x73\\\\x63\\\\x72\\\\x69\\\\x70\\\\x74\\\\x3a\\\\x61\\\\x6c\\\\x65\\\\x72\\\\x74\\\\x28.*?\\\\x29",
//                                    "&#x6a;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3a;alert&#x28;.*?&#x29;",
//                                    "\"onmouseover.*?='.*?\\\\x61\\\\x6c\\\\x65\\\\x72\\\\x74\\\\x28\\\\x31\\\\x29'.*?[new Function|new\\+Function]\\(.*?\\)\\(\\)\"",
//                                    "(\"/><img){1,}.*?(alert|eval){1}(>){1}",
//                                    "(\"onmouseover\\s*=\"(alert|eval)){1,}.*?(\"){1}",
//                                    "(\"onmouseover\\s*=\"){1,}.*?(valueOf:alert){1}.*?(\"){1}"
                                      };

        for (String regx : regxs) {
            Pattern pattern = Pattern.compile(regx); 
            //2.将字符串和正则表达式相关联 
            Matcher matcher = pattern.matcher(str); 
            //3.String 对象中的matches 方法就是通过这个Matcher和pattern来实现的。 

            //System.out.println(matcher.matches()); 
            //查找符合规则的子串 
            while(matcher.find()){ 
                str = str.replace(matcher.group(), "");
            }
        } 
        //System.out.println(str);
        return str;     
    }
}