sql注入，XSS攻击可通过继承HttpServletRequestWrapper重写request实现修改request请求

最新推荐文章于 2024-09-01 21:49:00 发布

wst260

最新推荐文章于 2024-09-01 21:49:00 发布

阅读量1.2k

点赞数

分类专栏： Java 文章标签： java

本文链接：https://blog.csdn.net/wst260/article/details/103702764

版权

本文介绍了如何通过继承HttpServletRequestWrapper来重写request请求，以防御SQL注入和XSS攻击。首先，创建一个继承ServletRequestWrapper的类，接着实现过滤敏感内容的逻辑。然后，设置一个过滤器来应用这个自定义请求包装器。最后，在web.xml配置文件中配置该过滤器以拦截并处理所有请求。

摘要由CSDN通过智能技术生成

首先创建一个类继承ServletRequestWrapper类，重写request请求

import java.io.StringReader;
import java.io.StringWriter;
import java.text.CharacterIterator;
import java.text.StringCharacterIterator;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

import com.blogspot.radialmind.html.HTMLParser;
import com.blogspot.radialmind.xss.XSSFilter;

public class ServletRequestWrapper extends HttpServletRequestWrapper {

	HttpServletRequest orgRequest = null;
	private static String[] keywords ={"|","&",";","$","%","@","'","\'","\"","/>","<>","()","+","cr","lf","\\","ASCII",
			"../","./","*","=","char","sysopen","execute","exec","net user","/add"
			,"create","modify","union","join","select","insert", "update", "delete", "drop", "truncate"};
	public servletRequestWrapper(HttpServletRequest request) {
		super(request);
		orgRequest = request;
	}

	/**
	 * 覆盖getParameter方法，将参数名和参数值都做xss过滤。