xss漏洞攻击，Filter实现xss漏洞

最新推荐文章于 2023-09-01 16:03:00 发布

生命无须向死而生

最新推荐文章于 2023-09-01 16:03:00 发布

阅读量2k

点赞数

分类专栏： spring boot java xss 文章标签： xss xss攻击 java xss java xss攻击 xss漏洞

本文链接：https://blog.csdn.net/zlxls/article/details/107432468

版权

java 同时被 3 个专栏收录

33 篇文章 3 订阅

订阅专栏

spring boot

25 篇文章 2 订阅

订阅专栏

xss

1 篇文章 0 订阅

订阅专栏

该文章主要使用Filter针对Xss攻击，sql注入，服务器访问白名单，以及csrf进行安全校验

1，主要实现的是四大块功能：Xss攻击，sql注入，服务器白名单，以及csrf

2，此Filter为真实项目部署，在XssHttpServletRequestWrapper.java文件中的cleanSqlKeyWords方法为具体的Xss拦截逻辑，可根根据自己的需要进行完善

3，服务器白名单为单独的一个工具包，在文章最后给出

4，文章开发环境为JDK1.8,使用SpringBoot框架进行开发

5，文章会分享出整个Filter文件包，包含四个java文件：

5.1，public class CrosXssFilter implements Filter

5.2，public class CrosXssFilterConfig implements WebMvcConfigurer

5.3，public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter

5.4，public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper

6，服务器白名单校验的java文件：

6.1，public class ServerWhiteListUtil

7，如果不要需要使用服务器白名单功能，那么，注释CrosXssFilter.java 文件的36-39行文件代码即可

CrosXssFilter文件：

package com.fc.test.common.filter;

import com.fc.test.util.ServerWhiteListUtil;
import com.qiniu.util.Json;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 *跨域：由于浏览器的安全性限制，不允许AJAX访问 协议不同、域名不同、端口号不同的 数据接口;
 * 前后端都需要设置允许跨域
 * @author zlxls
 * @date 2020年05月18日
 */
public class CrosXssFilter implements Filter {
    private static final Logger logger = LoggerFactory.getLogger(CrosXssFilter.class);
    private FilterConfig filterConfig = null;
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        this.filterConfig = filterConfig;
        logger.info("CrosXssFilter.......init");
    }
    @Override
    public void doFilter(ServletRequest request, ServletResponse response,FilterChain chain) throws IOException, ServletException {
        request.setCharacterEncoding("utf-8");
        response.setContentType("text/html;charset=utf-8");
        // 头攻击检测
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        String requestHost = httpRequest.getServerName();
        System.out.println("requestHost:"+requestHost);
        if (requestHost != null && !ServerWhiteListUtil.isWhite(requestHost)) {
            httpResponse.setStatus(403);
            return;
        }
        //跨域设置
        if(response instanceof HttpServletResponse){
            HttpServletResponse httpServletResponse=(HttpServletResponse)response;
            //通过在响应 header 中设置 ‘*’ 来允许来自所有域的跨域请求访问。
            httpServletResponse.setHeader("Access-Control-Allow-Origin", "*");
            //通过对 Credentials 参数的设置，就可以保持跨域 Ajax 时的 Cookie
            //设置了Allow-Credentials，Allow-Origin就不能为*,需要指明具体的url域
            //httpServletResponse.setHeader("Access-Control-Allow-Credentials", "true");
            //请求方式
            httpServletResponse.setHeader("Access-Control-Allow-Methods", "*");
            // 解决IFrame拒绝的问题
            //httpServletResponse.setHeader("X-Frame-Options", "SAMEORIGIN");
            //（预检请求）的返回结果（即 Access-Control-Allow-Methods 和Access-Control-Allow-Headers 提供的信息） 可以被缓存多久
            //httpServletResponse.setHeader("Access-Control-Max-Age", "86400");
            //首部字段用于预检请求的响应。其指明了实际请求中允许携带的首部字段
            httpServletResponse.setHeader("Access-Control-Allow-Headers", "*");
        }
        //sql,xss过滤
        HttpServletRequest httpServletRequest=(HttpServletRequest)request;
        //logger.info("CrosXssFilter.......orignal url:{},ParameterMap:{}",httpServletRequest.getRequestURI(), Json.encode(httpServletRequest.getParameterMap()));
        XssHttpServletRequestWrapper xssHttpServletRequestWrapper=new XssHttpServletRequestWrapper(httpServletRequest);
        chain.doFilter(xssHttpServletRequestWrapper, response);
        //logger.info("CrosXssFilter..........doFilter url:{},ParameterMap:{}",xssHttpServletRequestWrapper.getRequestURI(),Json.encode(xssHttpServletRequestWrapper.getParameterMap()));
    }
    @Override
    public void destroy() {
        this.filterConfig = null;
    }

}

CrosXssFilterConfig 文件：

package com.fc.test.common.filter;

import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.filter.DelegatingFilterProxy;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import javax.servlet.Filter;

@Configuration
public class CrosXssFilterConfig implements WebMvcConfigurer {
    @Bean
    public Filter generalFilter() {
        return new CrosXssFilter();
    }
    @Bean
    public FilterRegistrationBean uploadFilterRegistration() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(new DelegatingFilterProxy("generalFilter"));
        registration.addUrlPatterns("/*");
        registration.setName("generalFilter");
        registration.setOrder(1);
        return registration;
    }
}

WebSecurityConfiguration 文件：

package com.fc.test.common.filter;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;

@Configuration
public class WebSecurityConfiguration  extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.headers().frameOptions().disable();
        http.csrf().csrfTokenRepository(new CookieCsrfTokenRepository()).requireCsrfProtectionMatcher(
            /**
             * 拦截“/login”开头的访问路径，不让访问
             * 拦截所有“POST”请求，不让访问
             */
            httpServletRequest -> ( httpServletRequest.getRequestURI().indexOf("edit")>-1 ||
                                    httpServletRequest.getRequestURI().indexOf("list")>-1 ||
                                    httpServletRequest.getRequestURI().indexOf("add")>-1) &&
                                    httpServletRequest.getMethod().equals("POST")
            //httpServletRequest -> httpServletRequest.getMethod().equals("POST")
        );
    }
}

XssHttpServletRequestWrapper 文件：

package com.fc.test.common.filter;
import com.fc.test.common.exception.LllegalStringExtension;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.util.StringUtils;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;

/**
 * 防止sql注入,xss攻击
 * 前端可以对输入信息做预处理，后端也可以做处理。
 * @author zlxls
 * @date 2020年05月18日
 */
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
    private final Logger log = LoggerFactory.getLogger(getClass());
    //private static String key = "and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|;|or|-|+";
    private static String key = "and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|or|>|<|eval|javascript:|script|union|</";
    private static Set<String> notAllowedKeyWords = new HashSet<String>(0);
    private static String replacedString="INVALID";
    static {
        String keyStr[] = key.split("\\|");
        for (String str : keyStr) {
            notAllowedKeyWords.add(str);
        }
    }
    private String currentUrl;

    public XssHttpServletRequestWrapper(HttpServletRequest servletRequest) {
        super(servletRequest);
        currentUrl = servletRequest.getRequestURI();
    }

    /**覆盖getParameter方法，将参数名和参数值都做xss过滤。
     * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取
     * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
     */
    @Override
    public String getParameter(String parameter) {
        String value = super.getParameter(parameter);
        if (value == null) {
            return null;
        }
        return cleanXSS(value);
    }
    @Override
    public String[] getParameterValues(String parameter) {
        String[] values = super.getParameterValues(parameter);
        if (values == null) {
            return null;
        }
        int count = values.length;
        String[] encodedValues = new String[count];
        for (int i = 0; i < count; i++) {
            encodedValues[i] = cleanXSS(values[i]);
        }
        return encodedValues;
    }
    @Override
    public Map<String, String[]> getParameterMap(){
        Map<String, String[]> values=super.getParameterMap();
        if (values == null) {
            return null;
        }
        Map<String, String[]> result=new HashMap<>();
        for(String key:values.keySet()){
            //System.out.println("这是getParameterMap的Key："+key);
            //String encodedKey=cleanXSS(key);//这个是前端传来的键值，不建议进行cleanXSS
            String encodedKey=key;
            int count=values.get(key).length;
            String[] encodedValues = new String[count];
            for (int i = 0; i < count; i++){
                encodedValues[i]=cleanXSS(values.get(key)[i]);
            }
            result.put(encodedKey,encodedValues);
        }
        return result;
    }
    /**
     * 覆盖getHeader方法，将参数名和参数值都做xss过滤。
     * 如果需要获得原始的值，则通过super.getHeaders(name)来获取
     * getHeaderNames 也可能需要覆盖
     */
    @Override
    public String getHeader(String name) {
        String value = super.getHeader(name);
        if (value == null) {
            return null;
        }
        return cleanXSS(value);
    }

    private String cleanXSS(String valueP) {
        // You'll need to remove the spaces from the html entities below
        /*String value = valueP.replaceAll("<", "&lt;");
        value = value.replaceAll("", "&gt;");
        //value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;");
        //value = value.replaceAll("'", "& #39;");
        value = value.replaceAll("", "");
        value = value.replaceAll("[\\\"\\\'][\\s]*(.*)[\\\"\\\']", "\"\"");
        value = value.replaceAll("", "");
        value = value.replaceAll("", "");
        value = value.replaceAll("", "");
        value = value.replaceAll("", "");*/
        return cleanSqlKeyWords(valueP);
    }

    private String cleanSqlKeyWords(String value) {
        if("password".equals(value)){
            return value;
        }
        String paramValue = value;
        for (String keyword : notAllowedKeyWords) {
            String v= value.toLowerCase();
            if(value.toLowerCase().indexOf(keyword)>=0){
            //if (v.length() > keyword.length() + 4 && (v.contains(" "+keyword)||v.contains(keyword+" ")||v.contains(" "+keyword+" "))) {
                //paramValue = StringUtils.replace(paramValue, keyword, replacedString);
                paramValue = "";
                log.error("sql注入:"+this.currentUrl + "已被过滤，因为参数中包含不允许sql的关键词(" + keyword+ ")"+";参数："+value+";过滤后的参数："+paramValue);
                throw new LllegalStringExtension();
            }
        }
        return paramValue;
    }

}

ServerWhiteListUtil文件：

package com.fc.test.util;

import java.util.List;
import java.io.InputStreamReader;
import com.google.gson.Gson;
import com.google.gson.reflect.TypeToken;
import org.apache.shiro.io.ResourceUtils;

/**
 * 服务器白名单列表
 */
public class ServerWhiteListUtil {
    private static List<String> whiteList = null;;

    static {
        try {
            // 读取白名单列表
            whiteList = new Gson().fromJson(
                    new InputStreamReader(ResourceUtils.getInputStreamForPath("classpath:serverWhiteList.json")),
                    new TypeToken<List<String>>() {
                    }.getType());
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    /**
     * 判断当前host是否在白名单内
     * @param host 待查host
     * @return boolean 是否在白名单内
     */
    public static boolean isWhite(String host) {
        if (whiteList == null || whiteList.size() == 0) {
            return true;
        }
        System.out.println("**********************************************************");
        for (String str : whiteList) {
            if (str != null && str.equals(host)) {
                return true;
            }
        }
        return false;
    }
}

外附上resources/serverWhiteList.json文件

[
  "10.181.1.54",
  "10.181.1.54:80",
  "10.181.1.54:8080",
  "10.181.1.54:443",
  "10.181.1.54:8443",
  "192.168.43.12",
  "127.0.0.1:9091",
  "127.0.0.1",
  "localhost:9091",
  "localhost:9091",
  "192.168.43.12:9091"
]

以上纯属经验分享，不足之处还望多多包涵，不喜勿喷