java xss过滤器_JavaWeb实现XSS过滤器

public class XSSHttpServletRequestWrapper extends HttpServletRequestWrapper {

/**

* Constructs a request object wrapping the given request.

*

* @param request The request to wrap

* @throws IllegalArgumentException if the request is null

*/

public XSSHttpServletRequestWrapper(HttpServletRequest request) {

super(request);

}

/**

* 对数组参数进行特殊字符过滤

*/

@Override

public String[] getParameterValues(String name) {

String[] values = super.getParameterValues(name);

if (values == null) {

return null;

}

int count = values.length;

String[] encodedValues = new String[count];

for (int i = 0; i < count; i++) {

encodedValues[i] = cleanXSS(values[i]);

}

return encodedValues;

}

/**

* 对参数中特殊字符进行过滤

*/

@Override

public String getParameter(String name) {

String value = super.getParameter(name);

if (value == null) {

return null;

}

return cleanXSS(value);

}

/**

* 获取attribute,特殊字符过滤

*/

@Override

public Object getAttribute(String name) {

Object value = super.getAttribute(name);

if (value != null && value instanceof String) {

cleanXSS((String) value);

}

return value;

}

/**

* 对请求头部进行特殊字符过滤

*/

@Override

public String getHeader(String name) {

String value = super.getHeader(name);

if (value == null) {

return null;

}

return cleanXSS(value);

}

private String cleanXSS(String value) {

if (value != null) {

//推荐使用ESAPI库来避免脚本攻击,value = ESAPI.encoder().canonicalize(value);

// 避免空字符串

value = value.replaceAll(" ", "");

// 避免script 标签

Pattern scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);

value = scriptPattern.matcher(value).replaceAll("");

// 避免src形式的表达式

scriptPattern = Pattern.compile("src[

]*=[

]*\"(.*?)\"",

Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll("");

scriptPattern = Pattern.compile("src[

]*=[

]*\"(.*?)\"",

Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll("");

// 删除单个的 标签

scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);

value = scriptPattern.matcher(value).replaceAll("");

// 删除单个的

scriptPattern = Pattern.compile("

Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll("");

// 避免 eval(...) 形式表达式

scriptPattern = Pattern.compile("eval\((.*?)\)",

Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll("");

// 避免 e­xpression(...) 表达式

scriptPattern = Pattern.compile("e­xpression\((.*?)\)",

Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll("");

// 避免 javascript: 表达式

scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);

value = scriptPattern.matcher(value).replaceAll("");

// 避免 vbscript:表达式

scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);

value = scriptPattern.matcher(value).replaceAll("");

// 避免 οnlοad= 表达式

scriptPattern = Pattern.compile("onload(.*?)=",

Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll("");

}

return value;

}

}

定义过滤器：

public class XSSHttpServletRequestFilter implements Filter {

private final Logger logger = LoggerFactory.getLogger(getClass());

@Override

public void init(FilterConfig filterConfig) throws ServletException {

logger.info("##init XSSFilter");

}

@Override

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {

try {

//将请求转换为 自定义的请求包装类

chain.doFilter(new XSSHttpServletRequestWrapper((HttpServletRequest) request), response);

} catch (Exception e) {

throw e;

}

}

@Override

public void destroy() {

logger.info("##destroy XSSFilter");

}

}

将过滤器注册到spring的bean容器中:

@Bean

public FilterRegistrationBean xSSHttpServletRequestFilterRegistrationBean() {

FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();

filterRegistrationBean.setFilter(new XSSHttpServletRequestFilter());

filterRegistrationBean.setName("xSSHttpServletRequestFilter");

filterRegistrationBean.setUrlPatterns(Arrays.asList("/xxx"));

filterRegistrationBean.setOrder(1);

return filterRegistrationBean;

}

这里使用的springboot，如果是spring，相当于在web.xml中加入一下配置：

xSSHttpServletRequestFilter

com.xxx.xxx.xxxx.XSSHttpServletRequestFilter

xSSHttpServletRequestFilter

/xxx