XSS过滤JAVA过滤器filter 防止常见SQL注入

出处： https://www.cnblogs.com/hero123/p/9091625.html

 

Java项目中XSS过滤器的使用方法。

简单介绍：

XSS : 跨站脚本攻击(Cross Site Scripting)，为不和层叠样式表(Cascading Style Sheets, CSS)的缩写混淆，故将跨站脚本攻击缩写为XSS。恶意攻击者往Web页面里插入恶意html代码，当用户浏览该页之时，嵌入其中Web里面的html代码会被执行，从而达到恶意攻击用户的特殊目的。

sql注入
所谓SQL注入，就是通过把SQL命令插入到Web表单提交或输入域名或页面请求的查询字符串，最终达到欺骗服务器执行恶意的SQL命令。具体来说，它是利用现有应用程序，将（恶意）的SQL命令注入到后台数据库引擎执行的能力，它可以通过在Web表单中输入（恶意）SQL语句得到一个存在安全漏洞的网站上的数据库，而不是按照设计者意图去执行SQL语句。

实现方式，共三步：

第一步：配置web.xml

<filter>
    <filter-name>xssFilter</filter-name> <filter-class>com.wfcm.xss.XssFilter</filter-class> </filter> <filter-mapping> <filter-name>xssFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>

 

第二步：过滤工具类

1.XSSFilter.java

package com.wfcm.xss;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest; import java.io.IOException; /** * xss过滤 * @author xlf * @email xlfbe696@gmail.com * @date 2017年4月19日 上午10:41:42 */ public class XssFilter implements Filter { @Override public void init(FilterConfig config) throws ServletException { } public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper( (HttpServletRequest) request); chain.doFilter(xssRequest, response); } @Override public void destroy() { } }

 

2.XssHttpServletRequestWrapper

package com.wfcm.xss;

import org.apache.commons.lang.StringEscapeUtils;
import org.apache.commons.lang.StringUtils; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; import java.util.LinkedHashMap; import java.util.Map; public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { // 没被包装过的HttpServletRequest（特殊场景，需求自己过滤）  HttpServletRequest orgRequest; // html过滤 private final static HTMLFilter htmlFilter = new HTMLFilter(); public XssHttpServletRequestWrapper(HttpServletRequest request) { super(request); orgRequest = request; } @Override public String getParameter(String name) { String value = super.getParameter(xssEncode(name)); if (StringUtils.isNotBlank(value)) { value =xssEncode(value); } //SQL注入检查 // value = SQLFilter.sqlInject(value); value = SQLFilter.sqlInject(value); return StringEscapeUtils.unescapeHtml(value); } @Override public String[] getParameterValues(String name) { String[] parameters = super.getParameterValues(name); if (parameters == null || parameters.length == 0) { return null; } for (int i = 0; i < parameters.length; i++) { parameters[i] = xssEncode(parameters[i]); //SQL注入检查 // parameters[i] = SQLFilter.sqlInject(parameters[i]); parameters[i] = SQLFilter.sqlInject(parameters[i]); parameters[i] = StringEscapeUtils.unescapeHtml(parameters[i]); } return parameters; } @Override public Map<String, String[]> getParameterMap() { Map<String, String[]> map = new LinkedHashMap<>(); Map<String, String[]> parameters = super.getParameterMap(); for (String key : parameters.keySet()) { String[] values = parameters.get(key); for (int i = 0; i < values.length; i++) { values[i] = xssEncode(values[i]); //SQL注入检查 // values[i] = SQLFilter.sqlInject(values[i]); values[i] = SQLFilter.sqlInject(values[i]); values[i] = StringEscapeUtils.unescapeHtml(values[i]); } map.put(key, values); } return map; } @Override public String getHeader(String name) { String value = super.getHeader(xssEncode(name)); if (StringUtils.isNotBlank(value)) { value = xssEncode(value); } //SQL注入检查 // value = SQLFilter.sqlInject(value); value = SQLFilter.sqlInject(value); return StringEscapeUtils.unescapeHtml(value); } private String xssEncode(String input) { return htmlFilter.filter(input); } /** * 获取最原始的request */ public HttpServletRequest getOrgRequest() { return orgRequest; } /** * 获取最原始的request */ public static HttpServletRequest getOrgRequest(HttpServletRequest request) { if (request instanceof XssHttpServletRequestWrapper) { return ((XssHttpServletRequestWrapper) request).getOrgRequest(); } return request; } }

 

3.HTMLFilter

package com.wfcm.xss;

import java.util.ArrayList;
import java.util.Collections; import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.ConcurrentMap; import java.util.logging.Logger; import java.util.regex.Matcher; import java.util.regex.Pattern; /** * * HTML filtering utility for protecting against XSS (Cross Site Scripting). * * This code is licensed LGPLv3 * * This code is a Java port of the original work in PHP by Cal Hendersen. * http://code.iamcal.com/php/lib_filter/ * * The trickiest part of the translation was handling the differences in regex handling * between PHP and Java. These resources were helpful in the process: * * http://java.sun.com/j2se/1.4.2/docs/api/java/util/regex/Pattern.html * http://us2.php.net/manual/en/reference.pcre.pattern.modifiers.php * http://www.regular-expressions.info/modifiers.html * * A note on naming conventions: instance variables are prefixed with a "v"; global * constants are in all caps. * * Sample use: * String input = ... * String clean = new HTMLFilter().filter( input ); * * The class is not thread safe. Create a new instance if in doubt. * * If you find bugs or have suggestions on improvement (especially regarding * performance), please contact us. The latest version of this * source, and our contact details, can be found at http://xss-html-filter.sf.net * * @author Joseph O'Connell * @author Cal Hendersen * @author Michael Semb Wever */ public class HTMLFilter { /** regex flag union representing /si modifiers in php **/ private static final int REGEX_FLAGS_SI = Pattern.CASE_INSENSITIVE | Pattern.DOTALL; private static final Pattern P_COMMENTS = Pattern.compile("<!--(.*?)-->", Pattern.DOTALL); private static final Pattern P_COMMENT = Pattern.compile("^!--(.*)--$", REGEX_FLAGS_SI); private static final Pattern P_TAGS = Pattern.compile("<(.*?)>", Pattern.DOTALL); private static final Pattern P_END_TAG = Pattern.compile("^/([a-z0-9]+)", REGEX_FLAGS_SI); private static final Pattern P_START_TAG = Pattern.compile("^([a-z0-9]+)(.*?)(/?)$", REGEX_FLAGS_SI); private static final Pattern P_QUOTED_ATTRIBUTES = Pattern.compile("([a-z0-9]+)=([\"'])(.*?)\\2", REGEX_FLAGS_SI); private static final Pattern P_UNQUOTED_ATTRIBUTES = Pattern.compile("([a-z0-9]+)(=)([^\"\\s']+)", REGEX_FLAGS_SI); private static final Pattern P_PROTOCOL = Pattern.compile("^([^:]+):", REGEX_FLAGS_SI); private static final Pattern P_ENTITY = Pattern.compile("&#(\\d+);?"); private static final Pattern P_ENTITY_UNICODE = Pattern.compile("&#x([0-9a-f]+);?"); private static final Pattern P_ENCODE = Pattern.compile("%([0-9a-f]{2});?"); private static final Pattern P_VALID_ENTITIES = Pattern.compile("&([^&;]*)(?=(;|&|$))"); private static final Pattern P_VALID_QUOTES = Pattern.compile("(>|^)([^<]+?)(<|$)", Pattern.DOTALL); private static final Pattern P_END_ARROW = Pattern.compile("^>"); private static final Pattern P_BODY_TO_END = Pattern.compile("<([^>]*?)(?=<|$)"); private static final Pattern P_XML_CONTENT = Pattern.compile("(^|>)([^<]*?)(?=>)"); private static final Pattern P_STRAY_LEFT_ARROW = Pattern.compile("<([^>]*?)(?=<|$)"); private static final Pattern P_STRAY_RIGHT_ARROW = Pattern.compile("(^|>)([^<]*?)(?=>)"); private static final Pattern P_AMP = Pattern.compile("&"); private static final Pattern P_QUOTE = Pattern.compile("\""); private static final Pattern P_LEFT_ARROW = Pattern.compile("<"); private static final Pattern P_RIGHT_ARROW = Pattern.compile(">"); private static final Pattern P_BOTH_ARROWS = Pattern.compile("<>"); private static final Pattern P_DOUBLE_QUOT = Pattern.compile("&quot;"); // @xxx could grow large... maybe use sesat's ReferenceMap private static final ConcurrentMap<String,Pattern> P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap<String, Pattern>(); private static final ConcurrentMap<String,Pattern> P_REMOVE_SELF_BLANKS = new ConcurrentHashMap<String, Pattern>(); /** set of allowed html elements, along with allowed attributes for each element **/ private final Map<String, List<String>> vAllowed; /** counts of open tags for each (allowable) html element **/ private final Map<String, Integer> vTagCounts = new HashMap<String, Integer>(); /** html elements which must always be self-closing (e.g. "<img />") **/ private final String[] vSelfClosingTags; /** html elements which must always have separate opening and closing tags (e.g. "<b></b>") **/ private final String[] vNeedClosingTags; /** set of disallowed html elements **/ private final String[] vDisallowed; /** attributes which should be checked for valid protocols **/ private final String[] vProtocolAtts; /** allowed protocols **/ private final String[] vAllowedProtocols; /** tags which should be removed if they contain no content (e.g. "<b></b>" or "<b />") **/ private final String[] vRemoveBlanks; /** entities allowed within html markup **/ private final String[] vAllowedEntities; /** flag determining whether comments are allowed in input String. */ private final boolean stripComment; private final boolean encodeQuotes; private boolean vDebug = false; /** * flag determining whether to try to make tags when presented with "unbalanced" * angle brackets (e.g. "<b text </b>" becomes "<b> text </b>"). If set to false, * unbalanced angle brackets will be html escaped. */ private final boolean alwaysMakeTags; /** Default constructor. * */ public HTMLFilter() { vAllowed = 

转载于:https://www.cnblogs.com/But-you/p/10670319.html