xss攻击

• List item
  xss攻击就是将js脚本保存到数据中,通过参数等方式传给前端,当页面加载的时候,直接加载js脚本,比如一段js脚本为获取本地用户cookie,拿到后上传到一些黑客服务器,则可以拿到用户信息，通过用户身份进行登录,从而做一些操作。

抵御Xss攻击：通过参数转义，将转义后的参数存入数据库即可，如“hutool”类库提供一些转义操作。

1.导入hutool包

cn.hutool
hutool-all
5.4.0

2.创建包装类
package com.emos.config.xss;

import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import cn.hutool.json.JSONUtil;

import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.*;
import java.nio.charset.Charset;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.Map;

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {

public XssHttpServletRequestWrapper(HttpServletRequest request) {
    super(request);
}

@Override
public String getParameter(String name) {
    String value = super.getParameter(name);
    if (!StrUtil.hasEmpty(value)) {
        value = HtmlUtil.filter(value);
    }
    return value;
}

@Override
public String[] getParameterValues(String name) {
    String[] values = super.getParameterValues(name);
    if (values != null) {
        for (int i = 0; i < values.length; i++) {
            String value = values[i];
            if (!StrUtil.hasEmpty(value)) {
                value = HtmlUtil.filter(value);
            }
            values[i] = value;
        }
    }
    return values;
}

@Override
public Map<String, String[]> getParameterMap() {
    Map<String, String[]> parameters = super.getParameterMap();
    Map<String, String[]> map = new LinkedHashMap<>();
    if (parameters != null) {
        for (String key : parameters.keySet()) {
            String[] values = parameters.get(key);
            for (int i = 0; i < values.length; i++) {
                String value = values[i];
                if (!StrUtil.hasEmpty(value)) {
                    value = HtmlUtil.filter(value);
                }
                values[i] = value;
            }
            map.put(key, values);
        }
    }
    return map;
}

@Override
public String getHeader(String name) {
    String value = super.getHeader(name);
    if (!StrUtil.hasEmpty(value)) {
        value = HtmlUtil.filter(value);
    }
    return value;
}

@Override
public ServletInputStream getInputStream() throws IOException {
    InputStream in = super.getInputStream();
    StringBuffer body = new StringBuffer();
    InputStreamReader reader = new InputStreamReader(in, Charset.forName("UTF-8"));
    BufferedReader buffer = new BufferedReader(reader);
    String line = buffer.readLine();
    while (line != null) {
        body.append(line);
        line = buffer.readLine();
    }
    buffer.close();
    reader.close();
    in.close();

    Map<String, Object> map = JSONUtil.parseObj(body.toString());
    Map<String, Object> resultMap = new HashMap(map.size());
    for (String key : map.keySet()) {
        Object val = map.get(key);
        if (map.get(key) instanceof String) {
            resultMap.put(key, HtmlUtil.filter(val.toString()));
        } else {
            resultMap.put(key, val);
        }
    }
    String str = JSONUtil.toJsonStr(resultMap);
    final ByteArrayInputStream bain = new ByteArrayInputStream(str.getBytes());
    return new ServletInputStream() {
        @Override
        public int read() throws IOException {
            return bain.read();
        }

        @Override
        public boolean isFinished() {
            return false;
        }

        @Override
        public boolean isReady() {
            return false;
        }

        @Override
        public void setReadListener(ReadListener listener) {
        }
    };
}

}

3.创建过滤器，把所有请求对象传入包装类
package com.example.emos.wx.config.xss;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

@WebFilter(urlPatterns = “/*”)
public class XssFilter implements Filter {

public void init(FilterConfig config) throws ServletException {
}

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
    XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(
            (HttpServletRequest) request);
    chain.doFilter(xssRequest, response);
}

@Override
public void destroy() {
}

}

4.给SpringBoot主类添加@ServletComponentScan注解。