java xss 配置不作用_Spring防止Xss配置

最新推荐文章于 2024-02-16 10:30:00 发布

weixin_39882589

最新推荐文章于 2024-02-16 10:30:00 发布

阅读量307

点赞数

文章标签： java xss 配置不作用

本文链接：https://blog.csdn.net/weixin_39882589/article/details/114797566

版权

本文介绍了如何在Spring项目中配置和使用XssFilter，通过web.xml和自定义的XssFilter及XssHttpServletRequestWrapperNew类，对HTTP请求的参数和头信息进行XSS过滤，以增强应用程序的安全性。

摘要由CSDN通过智能技术生成

web.xml配置

<filter-name>XssFilter</filter-name>

<filter-class>com.zyyt.sipctask.common.filter.XssFilter</filter-class>

</filter>

<filter-mapping>

<filter-name>XssFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

XssFilter.java

package com.zyyt.sipctask.common.filter;

import java.io.IOException;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

public class XssFilter implements Filter {

FilterConfig filterConfig = null;

public void init(FilterConfig filterConfig) throws ServletException {

this.filterConfig = filterConfig;

}

public void destroy() {

this.filterConfig = null;

}

public void doFilter(ServletRequest request, ServletResponse response,

FilterChain chain) throws IOException, ServletException {

chain.doFilter(new XssHttpServletRequestWrapperNew(

(HttpServletRequest) request), response);

}

XssHttpServletRequestWrapperNew.java

package com.zyyt.sipctask.common.filter;

import java.text.CharacterIterator;

import java.text.StringCharacterIterator;

import java.util.regex.Pattern;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;

public class XssHttpServletRequestWrapperNew extends HttpServletRequestWrapper {

HttpServletRequest orgRequest = null;

public XssHttpServletRequestWrapperNew(HttpServletRequest request) {

super(request);

orgRequest = request;

}

/**

* 覆盖getParameter方法，将参数名和参数值都做xss过滤。

* 如果需要获得原始的值，则通过super.getParameterValues(name)来获取

* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖

@Override

public String getParameter(String name) {

String value = super.getParameter(xssEncode(name));

if (value != null) {

value = xssEncode(value);

value = HTMLEncode(value);

}

return value;

}

/**

* spring是使用的getParameterValues方法

@Override

public String[] getParameterValues(String name) {

String[] value = super.getParameterValues(name);

if (value == null) {

return null;

}

for (int i = 0;i < value.length;i++) {

value[i] = xssEncode(value[i]);

value[i] = HTMLEncode(value[i]);

}

return value;

}

/**

* 对一些特殊字符进行转义

public static String HTMLEncode(String aText) {

final StringBuilder result = new StringBuilder();

final StringCharacterIterator iterator = new StringCharacterIterator(aText);

char character = iterator.current();

while (character != CharacterIterator.DONE) {

if (character == '<') {

result.append("＜");

} else if (character == '>') {

result.append("＞");

} else if (character == '\"') {

result.append("｀");

} else {

// the char is not a special one

// add it to the result as is

result.append(character);

}

character = iterator.next();

}

return result.toString();

}

/**

* 覆盖getHeader方法，将参数名和参数值都做xss过滤。如果需要获得原始的值，则通过super.getHeaders(name)来获取

* getHeaderNames 也可能需要覆盖

@Override

public String getHeader(String name) {

String value = super.getHeader(xssEncode(name));

if (value != null) {

value = xssEncode(value);

}

return value;

}

/**

* 将容易引起xss漏洞的半角字符直接替换成全角字符

* 目前xssProject对注入代码要求是必须开始标签和结束标签(如<script></script>)正确匹配才能解析，否则报错；因此只能替换调xssProject换为自定义实现

* @param s

* @return

private static String xssEncode(String s) {

// if (s == null || s.isEmpty()) {

// return s;

// }

// StringReader reader = new StringReader(s);

// StringWriter writer = new StringWriter();

// try {

// HTMLParser.process(reader, writer, new XSSFilter(), true);

// String result = writer.toString();

// System.out.println("xssEncode-------------------------" + s + " = "

// + result);

// return result;

// } catch (NullPointerException e) {

// return s;

// } catch (Exception ex) {

// ex.printStackTrace();

// }

// return null;

if (s == null || s.isEmpty()) {

return s;

}

String result = stripXSS(s);

if (null != result) {

result = escape(result);

}

return result;

}

public static String escape(String s) {

StringBuilder sb = new StringBuilder(s.length() + 16);

for (int i = 0; i < s.length(); i++) {

char c = s.charAt(i);

switch (c) {

case '>':

sb.append('＞');// 全角大于号

break;

case '<':

sb.append('＜');// 全角小于号

break;

case '\'':

sb.append('‘');// 全角单引号

break;

case '\"':

sb.append('“');// 全角双引号

break;

case '\\':

sb.append('＼');// 全角斜线

break;

case '%':

sb.append('％'); // 全角冒号

break;

default:

sb.append(c);

break;

}

return sb.toString();

}

private static String stripXSS(String value) {

if (value != null) {

// NOTE: It's highly recommended to use the ESAPI library and

// uncomment the following line to

// avoid encoded attacks.

// value = ESAPI.encoder().canonicalize(value);

// Avoid null characters

value = value.replaceAll("", "");

// Avoid anything between script tags

Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);