java xss_Java防止XSS攻击

public class XssHttpServletRequestWrapper extendsHttpServletRequestWrapper {/*** Constructs a request object wrapping the given request.

*

*@paramrequest The request to wrap

*@throwsIllegalArgumentException if the request is null*/

publicXssHttpServletRequestWrapper(HttpServletRequest request) {super(request);

}

@OverridepublicString getHeader(String name) {

String value= super.getHeader(name);if(StringUtils.isEmpty(value)){returnvalue;

}else{returncleanXSS(value);

}

}

@OverridepublicString getParameter(String name) {

String value= super.getParameter(name);if(StringUtils.isEmpty(value)){returnvalue;

}else{returncleanXSS(value);

}

}

@OverridepublicString[] getParameterValues(String name) {

String[] values= super.getParameterValues(name);if (values != null) {int length =values.length;

String[] escapseValues= newString[length];for (int i = 0; i < length; i++) {

escapseValues[i]=cleanXSS(values[i]);

}returnescapseValues;

}return super.getParameterValues(name);

}

@Overridepublic ServletInputStream getInputStream() throwsIOException {

String str=getRequestBody(super.getInputStream());

Map map= JSON.parseObject(str,Map.class);

Map resultMap=new HashMap<>();for(String key:map.keySet()){

Object val=map.get(key);if(map.get(key) instanceofString){

resultMap.put(key,cleanXSS(val.toString()));

}else{

resultMap.put(key,val);

}

}

str=JSON.toJSONString(resultMap);final ByteArrayInputStream bais = newByteArrayInputStream(str.getBytes());return newServletInputStream() {

@Overridepublic int read() throwsIOException {returnbais.read();

}

@Overridepublic booleanisFinished() {return false;

}

@Overridepublic booleanisReady() {return false;

}

@Overridepublic voidsetReadListener(ReadListener listener) {

}

};

}privateString getRequestBody(InputStream stream) {

String line= "";

StringBuilder body= newStringBuilder();int counter = 0;//读取POST提交的数据内容

BufferedReader reader = new BufferedReader(new InputStreamReader(stream, Charset.forName("UTF-8")));try{while ((line = reader.readLine()) != null) {

body.append(line);

counter++;

}

}catch(IOException e) {

e.printStackTrace();

}returnbody.toString();

}privateString cleanXSS(String value) {if(StringUtils.isEmpty(value)){returnvalue;

}else{if (value != null) {if (value != null) {//NOTE: It's highly recommended to use the ESAPI library and uncomment the following line to//avoid encoded attacks.//value = ESAPI.encoder().canonicalize(value);//Avoid null characters

value = value.replaceAll("", "");//Avoid anything between script tags

Pattern scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);

value= scriptPattern.matcher(value).replaceAll("");//Avoid anything in a src="http://www.yihaomen.com/article/java/..." type of e­xpression//会误伤百度富文本编辑器//scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);//value = scriptPattern.matcher(value).replaceAll("");//scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);//value = scriptPattern.matcher(value).replaceAll("");//Remove any lonesome tag

scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);

value= scriptPattern.matcher(value).replaceAll("");//Remove any lonesome

scriptPattern = Pattern.compile("

value= scriptPattern.matcher(value).replaceAll("");//Avoid eval(...) e­xpressions

scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |Pattern.DOTALL);

value= scriptPattern.matcher(value).replaceAll("");//Avoid e­xpression(...) e­xpressions

scriptPattern = Pattern.compile("e­xpression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |Pattern.DOTALL);

value= scriptPattern.matcher(value).replaceAll("");//Avoid javascript:... e­xpressions

scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);

value= scriptPattern.matcher(value).replaceAll("");//Avoid vbscript:... e­xpressions

scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);

value= scriptPattern.matcher(value).replaceAll("");//Avoid οnlοad= e­xpressions

scriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |Pattern.DOTALL);

value= scriptPattern.matcher(value).replaceAll("");

}

}returnvalue;

}

}

}