public class XssHttpServletRequestWrapper extendsHttpServletRequestWrapper {/*** Constructs a request object wrapping the given request.
*
*@paramrequest The request to wrap
*@throwsIllegalArgumentException if the request is null*/
publicXssHttpServletRequestWrapper(HttpServletRequest request) {super(request);
}
@OverridepublicString getHeader(String name) {
String value= super.getHeader(name);if(StringUtils.isEmpty(value)){returnvalue;
}else{returncleanXSS(value);
}
}
@OverridepublicString getParameter(String name) {
String value= super.getParameter(name);if(StringUtils.isEmpty(value)){returnvalue;
}else{returncleanXSS(value);
}
}
@OverridepublicString[] getParameterValues(String name) {
String[] values= super.getParameterValues(name);if (values != null) {int length =values.length;
String[] escapseValues= newString[length];for (int i = 0; i < length; i++) {
escapseValues[i]=cleanXSS(values[i]);
}returnescapseValues;
}return super.getParameterValues(name);
}
@Overridepublic ServletInputStream getInputStream() throwsIOException {
String str=getRequestBody(super.getInputStream());
Map map= JSON.parseObject(str,Map.class);
Map resultMap=new HashMap<>();for(String key:map.keySet()){
Object val=map.get(key);if(map.get(key) instanceofString){
resultMap.put(key,cleanXSS(val.toString()));
}else{
resultMap.put(key,val);
}
}
str=JSON.toJSONString(resultMap);final ByteArrayInputStream bais = newByteArrayInputStream(str.getBytes());return newServletInputStream() {
@Overridepublic int read() throwsIOException {returnbais.read();
}
@Overridepublic booleanisFinished() {return false;
}
@Overridepublic booleanisReady() {return false;
}
@Overridepublic voidsetReadListener(ReadListener listener) {
}
};
}privateString getRequestBody(InputStream stream) {
String line= "";
StringBuilder body= newStringBuilder();int counter = 0;//读取POST提交的数据内容
BufferedReader reader = new BufferedReader(new InputStreamReader(stream, Charset.forName("UTF-8")));try{while ((line = reader.readLine()) != null) {
body.append(line);
counter++;
}
}catch(IOException e) {
e.printStackTrace();
}returnbody.toString();
}privateString cleanXSS(String value) {if(StringUtils.isEmpty(value)){returnvalue;
}else{if (value != null) {if (value != null) {//NOTE: It's highly recommended to use the ESAPI library and uncomment the following line to//avoid encoded attacks.//value = ESAPI.encoder().canonicalize(value);//Avoid null characters
value = value.replaceAll("", "");//Avoid anything between script tags
Pattern scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);
value= scriptPattern.matcher(value).replaceAll("");//Avoid anything in a src="http://www.yihaomen.com/article/java/..." type of expression//会误伤百度富文本编辑器//scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);//value = scriptPattern.matcher(value).replaceAll("");//scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);//value = scriptPattern.matcher(value).replaceAll("");//Remove any lonesome tag
scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);
value= scriptPattern.matcher(value).replaceAll("");//Remove any lonesome
scriptPattern = Pattern.compile("
value= scriptPattern.matcher(value).replaceAll("");//Avoid eval(...) expressions
scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |Pattern.DOTALL);
value= scriptPattern.matcher(value).replaceAll("");//Avoid expression(...) expressions
scriptPattern = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |Pattern.DOTALL);
value= scriptPattern.matcher(value).replaceAll("");//Avoid javascript:... expressions
scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);
value= scriptPattern.matcher(value).replaceAll("");//Avoid vbscript:... expressions
scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);
value= scriptPattern.matcher(value).replaceAll("");//Avoid οnlοad= expressions
scriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |Pattern.DOTALL);
value= scriptPattern.matcher(value).replaceAll("");
}
}returnvalue;
}
}
}