SpringMVC防止XSS注入
xss(Cross Site Scripting)注入就是,跨站脚本攻击,和sql注入类似的,在请求中添加恶意脚本,实现控制用户。
XssHttpServletRequestWrappe.java
重写XssHttpServletRequestWrapper中的方法:
package com.henu.util; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; /** * XSS * * @author duxiangyu * */ public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { public XssHttpServletRequestWrapper(HttpServletRequest servletRequest) { super(servletRequest); } public String[] getParameterValues(String parameter) { String[] values = super.getParameterValues(parameter); if (values == null) return null; int count = values.length; String[] encodedValues = new String[count]; for (int i = 0; i < count; i++) { encodedValues[i] = cleanXSS(values[i]); } return encodedValues; } public String getParameter(String parameter) { String value = super.getParameter(parameter); if (value == null) return null; return cleanXSS(value); } public String getHeader(String name) { String value = super.getHeader(name); if (value == null) return null; return cleanXSS(value); } // 这里可以自己实现转义,也可以直接用工具类进行转义,比如说org.apache.common.lang.StringEscapeUtils和org.springframework.web.util.HtmlUtils private String cleanXSS(String str) { StringBuffer sb = new StringBuffer(); for (int i = 0; i < str.length(); i++) { char c = str.charAt(i); switch (c) { case '\n': sb.append(c); break; case '<': sb.append("<"); break; case '>': sb.append(">"); break; case '&': sb.append("&"); break; case '\'': sb.append("'"); break; case '"': sb.append("""); break; default: if ((c < ' ') || (c > '~')) { sb.append("&#x"); sb.append(Integer.toString(c, 16)); sb.append(';'); } else { sb.append(c); } break; } } return sb.toString(); } }
XssFilter.java
写个拦截器,对请求进行拦截过滤:
package com.henu.util; import java.io.IOException; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; /** * XSS 过滤器 * * @author duxiangyu * */ public class XssFilter implements Filter { FilterConfig filterConfig = null; public void init(FilterConfig filterConfig) throws ServletException { this.filterConfig = filterConfig; } public void destroy() { this.filterConfig = null; } // 对request进行包装 public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { chain.doFilter(new XssHttpServletRequestWrapper( (HttpServletRequest) request), response); } }
在web.xml中配置拦截器,对所有的.ht请求进行过滤:
<filter> <filter-name>xssFilter</filter-name> <filter-class>com.henu.util.XssFilter</filter-class> </filter> <filter-mapping> <filter-name>xssFilter</filter-name> <url-pattern>*.ht</url-pattern> <dispatcher>REQUEST</dispatcher> </filter-mapping>