spring boot 防止SQL注入和XSS攻击

1.创建XssAndSqlHttpServletRequestWrapper类

package common;import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Map;
import java.util.Set;
import java.util.Vector;
import java.util.regex.Pattern;import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;import org.springframework.util.StreamUtils;public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper{HttpServletRequest orgRequest = null;private Map<String, String[]> parameterMap;private final byte[] body; //用于保存读取body中数据public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException{super(request);orgRequest = request;parameterMap = request.getParameterMap();body = StreamUtils.copyToByteArray(request.getInputStream());}// 重写几个HttpServletRequestWrapper中的方法/*** 获取所有参数名** @return 返回所有参数名*/@Overridepublic Enumeration<String> getParameterNames() {Vector<String> vector = new Vector<String>(parameterMap.keySet());return vector.elements();}/*** 覆盖getParameter方法，将参数名和参数值都做xss & sql过滤。<br/>* 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖*/@Overridepublic String getParameter(String name) {String[] results = parameterMap.get(name);if (results == null || results.length <= 0)return null;else {String value = results[0];if (value != null) {value = xssEncode(value);}return value;}}/*** 获取指定参数名的所有值的数组，如：checkbox的所有数据 接收数组变量 ，如checkobx类型*/@Overridepublic String[] getParameterValues(String name) {String[] results = parameterMap.get(name);if (results == null || results.length <= 0)return null;else {int length = results.length;for (int i = 0; i < length; i++) {results[i] = xssEncode(results[i]);}return results;}}/*** 覆盖getHeader方法，将参数名和参数值都做xss & sql过滤。<br/>* 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>* getHeaderNames 也可能需要覆盖*/@Overridepublic String getHeader(String name) {String value = super.getHeader(xssEncode(name));if (value != null) {value = xssEncode(value);}return value;}/*** 将容易引起xss & sql漏洞的半角字符直接替换成全角字符** @param s* @return*/private static String xssEncode(String s) {if (s == null || s.isEmpty()) {return s;} else {s = stripXSSAndSql(s);}StringBuilder sb = new StringBuilder(s.length() + 16);for (int i = 0; i < s.length(); i++) {char c = s.charAt(i);switch (c) {case '>':sb.append("＞");// 转义大于号break;case '<':sb.append("＜");// 转义小于号break;// case '\'':// sb.append("＇");// 转义单引号// break;// case '\"':// sb.append("＂");// 转义双引号// break;case '&':sb.append("＆");// 转义&break;case '#':sb.append("＃");// 转义#break;default:sb.append(c);break;}}return sb.toString();}/*** 获取最原始的request** @return*/public HttpServletRequest getOrgRequest() {return orgRequest;}/*** 获取最原始的request的静态方法** @return*/public static HttpServletRequest getOrgRequest(HttpServletRequest req) {if (req instanceof XssAndSqlHttpServletRequestWrapper) {return ((XssAndSqlHttpServletRequestWrapper) req).getOrgRequest();}return req;}/**** 防止xss跨脚本攻击（替换，根据实际情况调整）*/public static String stripXSSAndSql(String value) {if (value != null) {// NOTE: It's highly recommended to use the ESAPI library and// uncomment the following line to// avoid encoded attacks.// value = ESAPI.encoder().canonicalize(value);// Avoid null characters/** value = value.replaceAll("", ""); ***/// Avoid anything between script tagsPattern scriptPattern = Pattern.compile("<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid anything in a// src="http://www.yihaomen.com/article/java/..." type of// e-xpressionscriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome </script> tagscriptPattern = Pattern.compile("</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome <script ...> tagscriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid eval(...) expressionsscriptPattern = Pattern.compile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid e-xpression(...) expressionsscriptPattern = Pattern.compile("e-xpression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid javascript:... expressionsscriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid vbscript:... expressionsscriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid onload= expressionsscriptPattern = Pattern.compile("onload(.*?)=",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");}return value;}public static boolean checkXSSAndSql(String value) {boolean flag = false;if (value != null) {// NOTE: It's highly recommended to use the ESAPI library and// uncomment the following line to// avoid encoded attacks.// value = ESAPI.encoder().canonicalize(value);// Avoid null characters/** value = value.replaceAll("", ""); ***/// Avoid anything between script tagsPattern scriptPattern = Pattern.compile("<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid anything in a// src="http://www.yihaomen.com/article/java/..." type of// e-xpressionscriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Remove any lonesome </script> tagscriptPattern = Pattern.compile("</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Remove any lonesome <script ...> tagscriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid eval(...) expressionsscriptPattern = Pattern.compile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid e-xpression(...) expressionsscriptPattern = Pattern.compile("e-xpression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid javascript:... expressionsscriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid vbscript:... expressionsscriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid onload= expressionsscriptPattern = Pattern.compile("onload(.*?)=",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}}return flag;}public final boolean checkParameter() {Map<String, String[]> submitParams = new HashMap(parameterMap);Set<String> submitNames = submitParams.keySet();for (String submitName : submitNames) {Object submitValues = submitParams.get(submitName);if ((submitValues instanceof String)) {if (checkXSSAndSql((String) submitValues)) {return true;}} else if ((submitValues instanceof String[])) {for (String submitValue : (String[])submitValues){if (checkXSSAndSql(submitValue)) {return true;}}}}return false;}@Overridepublic BufferedReader getReader() throws IOException {return new BufferedReader(new InputStreamReader(getInputStream()));}@Overridepublic ServletInputStream getInputStream() throws IOException {final ByteArrayInputStream bais = new ByteArrayInputStream(body);return new ServletInputStream() {@Overridepublic int read() throws IOException {return bais.read();}@Overridepublic boolean isFinished() {// TODO Auto-generated method stubreturn false;}@Overridepublic boolean isReady() {// TODO Auto-generated method stubreturn false;}@Overridepublic void setReadListener(ReadListener arg0) {// TODO Auto-generated method stub}};}
}

2.创建XssAndSqlFilter过滤器

package common;import java.io.BufferedReader;
import java.io.IOException;
import java.io.PrintWriter;import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import org.apache.commons.lang3.StringUtils;public class XssAndSqlFilter implements Filter {@Overridepublic void destroy() {// TODO Auto-generated method stub}@Overridepublic void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)throws IOException, ServletException {String method = "GET";String param = "";XssAndSqlHttpServletRequestWrapper xssRequest = null;if (request instanceof HttpServletRequest) {method = ((HttpServletRequest) request).getMethod();xssRequest = new XssAndSqlHttpServletRequestWrapper((HttpServletRequest) request);}if ("POST".equalsIgnoreCase(method)) {param = this.getBodyString(xssRequest.getReader());if(StringUtils.isNotBlank(param)){if(xssRequest.checkXSSAndSql(param)){response.setCharacterEncoding("UTF-8");response.setContentType("application/json;charset=UTF-8");PrintWriter out = response.getWriter();
//                    out.write(JSONResponseUtil.getWrappedERRString("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!"));out.write("您所访问的页面请求/提交的参数中有违反安全规则元素存在，拒绝访问!");return;}}}if (xssRequest.checkParameter()) {response.setCharacterEncoding("UTF-8");response.setContentType("application/json;charset=UTF-8");PrintWriter out = response.getWriter();
//            out.write(JSONResponseUtil.getWrappedERRString("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!"));out.write("您所访问的页面请求/提交的参数中有违反安全规则元素存在，拒绝访问!");return;}chain.doFilter(xssRequest, response);}@Overridepublic void init(FilterConfig arg0) throws ServletException {// TODO Auto-generated method stub}// 获取request请求body中参数public static String getBodyString(BufferedReader br) {String inputLine;String str = "";try {while ((inputLine = br.readLine()) != null) {str += inputLine;}br.close();} catch (IOException e) {System.out.println("IOException: " + e);}return str;}
}

3.springboot 启动类中引入过滤器

@Beanpublic FilterRegistrationBean xssFilterRegistrationBean() {FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();filterRegistrationBean.setFilter(new XssAndSqlFilter());filterRegistrationBean.setOrder(1);filterRegistrationBean.setEnabled(true);filterRegistrationBean.addUrlPatterns("/*");filterRegistrationBean.setName("XssAndSqlFilter");Map<String, String> initParameters = new HashMap();initParameters.put("excludes", "/favicon.ico,/img/*,/js/*,/css/*");initParameters.put("isIncludeRichText", "true");filterRegistrationBean.setInitParameters(initParameters);return filterRegistrationBean;}

感谢原文作者，点击查看原文

spring boot 防止SQL注入和XSS攻击相关推荐

[网络安全提高篇] 一〇四.网络渗透靶场Oracle+phpStudy本地搭建万字详解（SQL注入、XSS攻击、文件上传漏洞）
当您阅读到该篇文章时,作者已经将"网络安全自学篇"设置成了收费专栏,首先说声抱歉.感谢这一年来大家的阅读和陪伴,这100篇安全文章记录了自己从菜鸡到菜鸟的成长史,该部分知识也花了很 ...
防止SQL注入和XSS攻击Filter
nbsp;今天系统使用IBM的安全漏洞扫描工具扫描出一堆漏洞,下面的filter主要是解决防止SQL注入和XSS攻击一个是Filter负责将请求的request包装一下. 一个是request包装器 ...
企业级解决SQL注入、XSS攻击解决案例
SQL注入和XSS攻击实际上的原理都是通过拼接从而完成攻击,通过简单的黑名单或编码在有些时候并不能完全防御以上两种问题.本文中使用OWASP的owasp-java-html-sanitizer组件,通 ...
Nginx 防止SQL注入、XSS攻击的实践配置方法
下班的时候,发现博客访问缓慢,甚至出现504错误,通过 top -i 命令查看服务器负载发现负载数值飙升到3.2之多了,并且持续时间越来越频繁直至持续升高的趋势,还以为是被攻击了,对来访IP进行了阈值 ...
浅谈SQL注入，XSS攻击
作为计算机小白,一直都认为黑客很牛逼所以简单的了解一下这反面的知识--信息安全黑客是个英译词,译作Hacker.黑客攻击或者黑计算机的方式多种多样,主要分为两种: (1)非破坏性的攻击:一般是为了扰 ...
解决SQL注入与XSS攻击
最近接手之前同事的几个项目,公司利用扫描工具进行全项目扫描,发现了部分项目代码存在安全漏洞,所以需要进行项目代码修复以避免有人恶意攻击.这个任务自然而然的就落到我手上.在这里记录一下操作的过程. 扫描 ...
php判断post是否xss,PHP实现表单提交数据的验证处理功能【防SQL注入和XSS攻击等】...
本文实例讲述了PHP实现表单提交数据的验证处理功能.分享给大家供大家参考,具体如下: 防XSS攻击代码: /** * 安全过滤函数 * * @param $string * @return strin ...
java拦截器实现防止SQL注入与xss攻击拦截
一.SQL注入简介 SQL注入是比较常见的网络攻击方式之一,它不是利用操作系统的BUG来实现攻击,而是针对程序员编程时的疏忽,通过SQL语句,实现无帐号登录,甚至篡改数据库. 二.SQL注入攻击的总体 ...
Pipy：保护 Kubernetes 上的应用程序免受 SQL 注入和 XSS 攻击
注入攻击在 OWASP Web 应用 10 大安全风险[1] 排名 2021 年下滑至第 3 位,多年来一直位居前十.SQL 注入 (SQLi) 是一种用于攻击网站和 Web 应用程序的常见注入技术. ...

spring boot 防止SQL注入和XSS攻击

spring boot 防止SQL注入和XSS攻击相关推荐

最新文章

热门文章