记一次,非法字符验证
在项目中,会遇到关于sql注入,以及跨站脚本,XSS,链接注入等攻击,这里就需要做一些验证,当时接到这个需求,在网上查找了半天终于找到一篇文章,并拿来测试,但是,这个里面是有一些错误的。
package com.cn.util; import java.io.IOException; import java.io.PrintWriter; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; /** * * @ClassName: IllegalCharacter * @Description: 此模块用于非法字符验证 * @author huxd * @date 2017年3月26日 下午12:07:28 * */ public class IllegalCharacter implements Filter{ private String[] characterParams = null; private boolean OK=true; public void destroy() { } /** * 此程序块主要用来解决参数带非法字符等过滤功能 */ public void doFilter(ServletRequest request, ServletResponse response, FilterChain arg2) throws IOException, ServletException { HttpServletRequest servletrequest = (HttpServletRequest) request; HttpServletResponse servletresponse = (HttpServletResponse) response; boolean status = false; java.util.Enumeration params = request.getParameterNames(); String param=""; String paramValue = ""; servletresponse.setContentType("text/html"); servletresponse.setCharacterEncoding("utf-8"); while (params.hasMoreElements()) { param = (String) params.nextElement();
// 这里原代码是用的 String[] 接的数据,这样会造成一些非法字符 <,> 等,这些都是无法转换的!造成是空,这个坑了我2个小时才找到 String values = request.getParameter(param); paramValue = ""; if(OK){//过滤字符串为0个时 不对字符过滤 paramValue=paramValue+values; for(int i=0;i<characterParams.length;i++) if (paramValue.indexOf(characterParams[i]) >= 0) { status = true; break; } if(status)break; } } if (status) { PrintWriter out = servletresponse.getWriter(); out .print("<script language='javascript'>alert(\"您提交的相关表单数据字符含有非法字符。如:\\\"'\\\".\");location.href('" + servletrequest.getRequestURL() + "');</script>"); }else arg2.doFilter(request, response); } public void init(FilterConfig config) throws ServletException { if(config.getInitParameter("characterParams").length()<1) OK=false; else this.characterParams = config.getInitParameter("characterParams").split(","); } }
web.xml配置
<!-- 跨域脚本攻击防御 --> <!-- 非法字符过滤器 --> <filter> <filter-name>IllegalCharacter</filter-name> <filter-class>com.cn.util.IllegalCharacter</filter-class> <init-param> <param-name>characterParams</param-name> <param-value><,>,;,",”,“,*,@,IMG,SRC,$,@,',",|,>,+,CR,LF</param-value><!-- 此处加入要过滤的字符或字符串,以逗号隔开 --> </init-param> </filter> <filter-mapping> <filter-name>IllegalCharacter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>