SpringBoot增加过滤XSS脚本攻击

SpringBoot增加过滤XSS脚本攻击

Bug #133595

[步骤]考试管理-添加考试，考试名称输入<script>alert(1)</script>

[结果]页面弹出alert框。。。存在xss注入

一、XSS攻击是什么

XSS攻击全称跨站脚本攻击，是为不和层叠样式表(Cascading Style Sheets, CSS)的缩写混淆，故将跨站脚本攻击缩写为XSS，XSS是一种在web应用中的计算机安全漏洞，它允许恶意web用户将代码植入到提供给其它用户使用的页面中。

简而言之，就是作恶用户通过表单提交一些前端代码，如果不做处理的话，这些前端代码将会在展示的时候被浏览器执行。

二、解决方案

解决XSS攻击，可以通过后端对输入的数据做过滤或者转义，使XSS攻击代码失效。

1、自定义类继承HttpServletRequestWrapper

重写了两个方法：getParameter和getParameterValues，getParameter方法是直接通过request获得querystring类型的入参调用的方法。如果是通过springMVC注解类型来获得参数的话，走的是getParameterValues的方法。

package cn.pconline.pcloud.admin.config;

import org.apache.commons.lang3.StringUtils;
import org.apache.commons.text.StringEscapeUtils;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

/**
 * @Description 自定义类继承HttpServletRequestWrapper
 * @Author jie.zhao
 * @Date 2019/11/25 17:57
 */
public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {

    public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
    }

    @Override
    public String getHeader(String name) {
        return StringEscapeUtils.escapeHtml4(super.getHeader(name));
    }

    @Override
    public String getQueryString() {
        String rawStr = super.getQueryString();
        if (StringUtils.isNotBlank(rawStr)) {
            return StringEscapeUtils.escapeHtml4(rawStr);
        }
        return null;
    }

    @Override
    public String getParameter(String name) {
        return StringEscapeUtils.escapeHtml4(super.getParameter(name));
    }

    @Override
    public String[] getParameterValues(String name) {
        String[] parameterValues = super.getParameterValues(name);
        if (parameterValues == null) {
            return null;
        }
        for (int i = 0; i < parameterValues.length; i++) {
            String value = parameterValues[i];
            parameterValues[i] = StringEscapeUtils.escapeHtml4(value);
        }
        return parameterValues;
    }
}

StringEscapeUtils.escapeHtml4这个方法来自Apache的工具类:

<dependency>
 <groupId>org.apache.commons</groupId>
 <artifactId>commons-text</artifactId>
 <version>1.4</version>
</dependency>

2、实现自己的XssFilter

实现过滤表单的代码：

package cn.pconline.pcloud.admin.config;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

/**
 * @Description 实现自己的XssFilter过滤表单
 * @Author jie.zhao
 * @Date 2019/11/25 17:57
 */
@WebFilter(filterName = "xssFilter", urlPatterns = "/*", asyncSupported = true)
public class XssFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        XssAndSqlHttpServletRequestWrapper xssRequestWrapper = new XssAndSqlHttpServletRequestWrapper(req);
        chain.doFilter(xssRequestWrapper, response);
    }

    @Override
    public void destroy() {

    }

}

实现过滤json类型的代码：

package cn.pconline.pcloud.admin.config;

import com.fasterxml.jackson.core.JsonGenerator;
import com.fasterxml.jackson.databind.JsonSerializer;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.SerializerProvider;
import com.fasterxml.jackson.databind.module.SimpleModule;
import org.apache.commons.text.StringEscapeUtils;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Primary;
import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;

import java.io.IOException;

@Configuration
public class XssStringJsonSerializer extends JsonSerializer<String> {

    /**
     * 过滤json类型的
     */
    @Bean
    @Primary
    public ObjectMapper xssObjectMapper(Jackson2ObjectMapperBuilder builder) {
        //解析器
        ObjectMapper objectMapper = builder.createXmlMapper(false).build();
        //注册xss解析器
        SimpleModule xssModule = new SimpleModule("XssStringJsonSerializer");
        xssModule.addSerializer(new XssStringJsonSerializer());
        objectMapper.registerModule(xssModule);
        //返回
        return objectMapper;
    }

    @Override
    public Class<String> handledType() {
        return String.class;
    }

    @Override
    public void serialize(String value, JsonGenerator jsonGenerator,
                          SerializerProvider serializerProvider) throws IOException {
        if (value != null) {
            String encodedValue = StringEscapeUtils.escapeHtml4(value);
            jsonGenerator.writeString(encodedValue);
        }
    }
}

XSS注入已修复。。。

参考文档：

https://juejin.im/post/5d079e555188251ad81a28d9