使用AntiSamy防止XSS攻击

2019独角兽企业重金招聘Python工程师标准>>>

参考文档：

http://www.2cto.com/Article/201410/342040.html

在web.xml中加上xml过滤器的配置

 <filter>
		<filter-name>XssFilter</filter-name>
		<filter-class>com.cy.frame.filter.XssFilter</filter-class>
		<async-supported>true</async-supported>
		<init-param>
			<param-name>excludedPages</param-name>
			<param-value>
	          *.js,*.gif,*.jpg,*.png,*.css,*.ico,
	           /rest/*/saveOrUpdateRest,（这里过滤你对应接口，防止要提交的内容带有html元素。这里的接口不会被xss拦截）
			</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>XssFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping> -->

XssFilter

package com.cy.frame.filter;

import java.io.IOException;
import java.util.Iterator;
import java.util.Map;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

import org.owasp.validator.html.AntiSamy;
import org.owasp.validator.html.CleanResults;
import org.owasp.validator.html.Policy;
import org.owasp.validator.html.PolicyException;
import org.owasp.validator.html.ScanException;

 
/**
 *
 * <ol>XSS注入拦截
 * <li>{@link  }</li>
 * </ol>
 * @see
 * @author wanghui 
 * @since 1.0
 * @2016年3月14日
 *
 */
public class XssFilter implements Filter {

	/**
	 * 需要排除的页面
	 */
	private String excludedPages;

	private String[] excludedPageArray;
	
	@SuppressWarnings("unused")
	private FilterConfig filterConfig;

	public void destroy() {
		this.filterConfig = null;
	}

	public void doFilter(ServletRequest request, ServletResponse response,
			FilterChain chain) throws IOException, ServletException {

		boolean isExcludedPage = false;

		HttpServletRequest request2 = (HttpServletRequest) request;
		//判断是否需要XSS攻击防护
		isExcludedPage = isMatchUrl(excludedPageArray,   request2) ;
		
		if (isExcludedPage) {
			chain.doFilter(request, response);
		} else {
			chain.doFilter(new XssRequestWrapper(request2), response);
		}

	}

	/**
	 * 自定义过滤规则
	 */
	public void init(FilterConfig filterConfig) throws ServletException {
		this.filterConfig = filterConfig;
		excludedPages = filterConfig.getInitParameter("excludedPages");
		excludedPageArray = new String[] {};
		if (StringUtils.isNotEmpty(excludedPages)) {
			excludedPageArray = excludedPages.replaceAll("[\\s]", "")
					.split(",");
		}
	}
  /**
	 * URL是否符合规则列表
	 * @param patterns
	 * @param request
	 * @return
	 */
   public static boolean isMatchUrl(String[] patterns,	HttpServletRequest request) {
		String ctx_path = request.getContextPath();
		String request_uri = request.getRequestURI();
		String action = request_uri.substring(ctx_path.length()).replaceAll("//", "/");
		return PatternMatchUtils.simpleMatch(patterns, action);
	}

	/**
	 * 
	 * <ol>装饰器模式加强request处理
	 * <li>{@link  }</li>
	 * 
	 * </ol>
	 * @see
	 * @author wanghui 
	 * @since 1.0
	 * @2016年3月14日
	 *
	 */
	static class XssRequestWrapper extends HttpServletRequestWrapper {

		private static Policy policy = null;

		static {
			try {
				policy = Policy.getInstance( XssRequestWrapper.class.getClassLoader()
						.getResourceAsStream("antisamy-anythinggoes.xml"));
			} catch (PolicyException e) {
				 
			}
		}

		public XssRequestWrapper(HttpServletRequest request) {
			super(request);
		}

		@Override
		@SuppressWarnings("rawtypes")
		public Map<String, String[]> getParameterMap() {
			Map<String, String[]> request_map = super.getParameterMap();
			Iterator iterator = request_map.entrySet().iterator();
			while (iterator.hasNext()) {
				Map.Entry me = (Map.Entry) iterator.next();
				String[] values = (String[]) me.getValue();
				for (int i = 0; i < values.length; i++) {
					values[i] = xssClean(values[i]);
				}
			}
			return request_map;
		}

		@Override
		public String[] getParameterValues(String paramString) {
			String[] arrayOfString1 = super.getParameterValues(paramString);
			if (arrayOfString1 == null)
				return null;
			int i = arrayOfString1.length;
			String[] arrayOfString2 = new String[i];
			for (int j = 0; j < i; j++)
				arrayOfString2[j] = xssClean(arrayOfString1[j]);
			return arrayOfString2;
		}

		@Override
		public String getParameter(String paramString) {
			String str = super.getParameter(paramString);
			if (str == null)
				return null;
			return xssClean(str);
		}

		@Override
		public String getHeader(String paramString) {
			String str = super.getHeader(paramString);
			if (str == null)
				return null;
			return xssClean(str);
		}

		private String xssClean(String value) {
			AntiSamy antiSamy = new AntiSamy();
			try {
				// CleanResults cr = antiSamy.scan(dirtyInput, policyFilePath);
				final CleanResults cr = antiSamy.scan(value, policy);
				// 安全的HTML输出
				return cr.getCleanHTML() ;
			} catch (ScanException e) {
			} catch (PolicyException e) {
			}
			return value;
		}

	}

}

 配置文件（antisamy-anythinggoes.xml下载地址）

https://yunpan.cn/cBk3ZhvSC8DJw  访问密码 1cb6

相关依赖jar

<dependency>
      <groupId>org.owasp.antisamy</groupId>
      <artifactId>antisamy</artifactId>
      <version>1.5.3</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.owasp.antisamy</groupId>
      <artifactId>antisamy-sample-configs</artifactId>
      <version>1.5.3</version>
      <scope>compile</scope>
    </dependency>

 

转载于:https://my.oschina.net/u/2472104/blog/710411