java跨站攻击,抓住XSS（跨站脚本）攻击（Java）的最佳正则表达式？

Jeff actually posted about this in Sanitize HTML. But his example is in C# and I'm actually more interested in a Java version. Does anyone have a better version for Java? Is his example good enough to just convert directly from C# to Java?

[Update] I have put a bounty on this question because SO wasn't as popular when I asked the question as it is today (*). As for anything related to security, the more people look into it, the better it is!

(*) In fact, I think it was still in closed beta

解决方案

Don't do this with regular expressions. Remember, you're not protecting just against valid HTML; you're protecting against the DOM that web browsers create. Browsers can be tricked into producing valid DOM from invalid HTML quite easily.

For example, see this list of obfuscated XSS attacks. Are you prepared to tailor a regex to prevent this real world attack on Yahoo and Hotmail on IE6/7/8?

How about this attack that works on IE6?

How about attacks that are not listed on this site? The problem with Jeff's approach is that it's not a whitelist, as claimed. As someone on that page adeptly notes:

The problem with it, is that the html

must be clean. There are cases where

you can pass in hacked html, and it

won't match it, in which case it'll

return the hacked html string as it

won't match anything to replace. This

isn't strictly whitelisting.

I would suggest a purpose built tool like AntiSamy. It works by actually parsing the HTML, and then traversing the DOM and removing anything that's not in the configurable whitelist. The major difference is the ability to gracefully handle malformed HTML.

The best part is that it actually unit tests for all the XSS attacks on the above site. Besides, what could be easier than this API call:

public String toSafeHtml(String html) throws ScanException, PolicyException {

Policy policy = Policy.getInstance(POLICY_FILE);

AntiSamy antiSamy = new AntiSamy();

CleanResults cleanResults = antiSamy.scan(html, policy);

return cleanResults.getCleanHTML().trim();

}