xss攻击字符过滤器 Java_利用简单的过滤器 过滤特殊字符实现 防止XSS攻击

web.xml配置文件

XSSFilter

com.neusoft.common.filter.XSSFilter

XSSFilter

/*

package com.neusoft.common.filter;

import java.io.IOException;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

public class XSSFilter implements Filter {

@Override

public void destroy() {

// TODO Auto-generated method stub

}

@Override

public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2)

throws IOException, ServletException {

// TODO Auto-generated method stub

arg2.doFilter(new XSSRequestWrapper((HttpServletRequest) arg0), arg1);

}

@Override

public void init(FilterConfig arg0) throws ServletException {

// TODO Auto-generated method stub

}

}

package com.neusoft.common.filter;

import java.util.regex.Pattern;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;

public class XSSRequestWrapper extends HttpServletRequestWrapper {

public XSSRequestWrapper(HttpServletRequest request) {

super(request);

}

@Override

public String[] getParameterValues(String parameter) {

String[] values = super.getParameterValues(parameter);

if (values == null) {

return null;

}

int count = values.length;

String[] encodedValues = new String[count];

for (int i = 0; i < count; i++) {

encodedValues[i] = stripXSS(values[i]);

}

return encodedValues;

}

@Override

public String getParameter(String parameter) {

String value = super.getParameter(parameter);

return stripXSS(value);

}

@Override

public String getHeader(String name) {

String value = super.getHeader(name);

//return stripXSS(value);

return value;

}

public String getQueryString() {

String value = super.getQueryString();

if (value != null) {

value = stripXSS(value);

}

return value;

}

private String stripXSS(String value) {

if (value != null) {

// Avoid anything between script tags

Pattern scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);

value = scriptPattern.matcher(value).replaceAll("");

// Avoid anything in a

// e­xpression

scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'",

Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll("");

scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"",

Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll("");

// Remove any lonesome tag

scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);

value = scriptPattern.matcher(value).replaceAll("");

// Remove any lonesome

scriptPattern = Pattern.compile("

Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll("");

// Avoid eval(...) e­xpressions

scriptPattern = Pattern.compile("eval\\((.*?)\\)",

Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll("");

// Avoid e­xpression(...) e­xpressions

scriptPattern = Pattern.compile("e­xpression\\((.*?)\\)",

Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll("");

// Avoid javascript:... e­xpressions

scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);

value = scriptPattern.matcher(value).replaceAll("");

// Avoid vbscript:... e­xpressions

scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);

value = scriptPattern.matcher(value).replaceAll("");

// Avoid οnlοad= e­xpressions

scriptPattern = Pattern.compile("onload(.*?)=",

Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll("");

}

return value;

}

}