springboot 防止xss 和sql 注入改写 http 请求 getParameter，getParameterValues，getHeader等方法有点东西

1.springboot 启动类引入过滤器配置

2.过滤器

3.XssAndSqlHttpServletRequestWrapper包装器包装类

4.修改验证登录代码这里只写了基础的了解意思即可

5.测试内容

6.测试结果

7.反黑客小介绍（黑客大哥们好小弟这没啥大用O(∩_∩)O~，但是对待小白黑客还好）

1.springboot 启动类引入过滤器配置

package com.superman;import java.util.HashMap;
import java.util.Map;import org.apache.log4j.BasicConfigurator;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;import com.superman.conf.filter.XssAndSqlFilter;
import com.superman.tonifi.InitInfo;/*** 项目启动类* * @author yushen**/
@SpringBootApplication
public class Provider_App {/*** 项目启动入口* * @param args*/public static void main(String[] args) {SpringApplication.run(Provider_App.class, args);InitInfo.Info(); //初始化内容// 自动快速地使用缺省Log4j环境。BasicConfigurator.configure();}/*** 防止xss 和 sql 注入 * * @return*/@SuppressWarnings({ "unchecked", "rawtypes" })@Beanpublic FilterRegistrationBean xssFilterRegistrationBean() {FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();filterRegistrationBean.setFilter(new XssAndSqlFilter());filterRegistrationBean.setOrder(1);filterRegistrationBean.setEnabled(true);filterRegistrationBean.addUrlPatterns("/*");filterRegistrationBean.setName("XssAndSqlFilter");Map<String, String> initParameters = new HashMap();initParameters.put("excludes", "/favicon.ico,/img/*,/js/*,/css/*");initParameters.put("isIncludeRichText", "true");filterRegistrationBean.setInitParameters(initParameters);return filterRegistrationBean;}}

这个可以注册到的的地方除了springbootappliaction 以外别的配置也可以注册更具自己选择，最好方springbootappliaction 中方便省事

2.过滤器

package com.superman.conf.filter;import java.io.BufferedReader;
import java.io.IOException;
import java.io.PrintWriter;import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;import org.apache.commons.lang3.StringUtils;/*** 防止* xss 和 sql 注入漏洞* @author yushen* 20200611**/
public class XssAndSqlFilter implements Filter {/*** TODO 这个可以注册到的的地方除了springbootappliaction 以外别的 配置也可以注册更具自己选择，最好方springbootappliaction 中 方便省事** @Beanpublic FilterRegistrationBean xssFilterRegistrationBean() {FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();filterRegistrationBean.setFilter(new XssAndSqlFilter());filterRegistrationBean.setOrder(1);filterRegistrationBean.setEnabled(true);filterRegistrationBean.addUrlPatterns("/*");filterRegistrationBean.setName("XssAndSqlFilter");Map<String, String> initParameters = new HashMap();initParameters.put("excludes", "/favicon.ico,/img/*,/js/*,/css/*");initParameters.put("isIncludeRichText", "true");filterRegistrationBean.setInitParameters(initParameters);return filterRegistrationBean;}*/@Overridepublic void destroy() {// TODO Auto-generated method stub}@Overridepublic void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)throws IOException, ServletException {String method = "GET";String param = "";XssAndSqlHttpServletRequestWrapper xssRequest = null;if (request instanceof HttpServletRequest) {method = ((HttpServletRequest) request).getMethod();xssRequest = new XssAndSqlHttpServletRequestWrapper((HttpServletRequest) request);}if ("POST".equalsIgnoreCase(method)) {param = this.getBodyString(xssRequest.getReader());if(StringUtils.isNotBlank(param)){if(xssRequest.checkXSSAndSql(param)){response.setCharacterEncoding("UTF-8");response.setContentType("application/json;charset=UTF-8");PrintWriter out = response.getWriter();
//                    out.write(JSONResponseUtil.getWrappedERRString("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!"));out.write("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!");return;}}}if (xssRequest.checkParameter()) {response.setCharacterEncoding("UTF-8");response.setContentType("application/json;charset=UTF-8");PrintWriter out = response.getWriter();
//            out.write(JSONResponseUtil.getWrappedERRString("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!"));out.write("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!");return;}chain.doFilter(xssRequest, response);}@Overridepublic void init(FilterConfig arg0) throws ServletException {// TODO Auto-generated method stub}// 获取request请求body中参数public static String getBodyString(BufferedReader br) {String inputLine;String str = "";try {while ((inputLine = br.readLine()) != null) {str += inputLine;}br.close();} catch (IOException e) {System.out.println("IOException: " + e);}return str;}}

3.XssAndSqlHttpServletRequestWrapper包装器包装类

package com.superman.conf.filter;import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Map;
import java.util.Set;
import java.util.Vector;
import java.util.regex.Pattern;import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;import org.springframework.util.StreamUtils;/*** 过滤器相关* @author yushen* 20200611*  创建XssAndSqlHttpServletRequestWrapper包装器，这是实现XSS过滤的关键，*    在其内重写了getParameter，getParameterValues，getHeader等方法，对http请求内的参数进行了过滤**/
public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {HttpServletRequest orgRequest = null;private Map<String, String[]> parameterMap;private final byte[] body; //用于保存读取body中数据public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException{super(request);orgRequest = request;parameterMap = request.getParameterMap();body = StreamUtils.copyToByteArray(request.getInputStream());}// 重写几个HttpServletRequestWrapper中的方法/*** 获取所有参数名** @return 返回所有参数名*/@Overridepublic Enumeration<String> getParameterNames() {Vector<String> vector = new Vector<String>(parameterMap.keySet());return vector.elements();}/*** 覆盖getParameter方法，将参数名和参数值都做xss & sql过滤。<br/>* 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖*/@Overridepublic String getParameter(String name) {String[] results = parameterMap.get(name);if (results == null || results.length <= 0)return null;else {String value = results[0];if (value != null) {value = xssEncode(value);}return value;}}/*** 获取指定参数名的所有值的数组，如：checkbox的所有数据 接收数组变量 ，如checkobx类型*/@Overridepublic String[] getParameterValues(String name) {String[] results = parameterMap.get(name);if (results == null || results.length <= 0)return null;else {int length = results.length;for (int i = 0; i < length; i++) {results[i] = xssEncode(results[i]);}return results;}}/*** 覆盖getHeader方法，将参数名和参数值都做xss & sql过滤。<br/>* 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>* getHeaderNames 也可能需要覆盖*/@Overridepublic String getHeader(String name) {String value = super.getHeader(xssEncode(name));if (value != null) {value = xssEncode(value);}return value;}/*** 将容易引起xss & sql漏洞的半角字符直接替换成全角字符* * @param s* @return*/private static String xssEncode(String s) {if (s == null || s.isEmpty()) {return s;} else {s = stripXSSAndSql(s);}StringBuilder sb = new StringBuilder(s.length() + 16);for (int i = 0; i < s.length(); i++) {char c = s.charAt(i);switch (c) {case '>':sb.append("＞");// 转义大于号break;case '<':sb.append("＜");// 转义小于号break;// case '\'':// sb.append("＇");// 转义单引号// break;// case '\"':// sb.append("＂");// 转义双引号// break;case '&':sb.append("＆");// 转义&break;case '#':   sb.append("＃");// 转义#break;default:sb.append(c);break;}}return sb.toString();}/*** 获取最原始的request* * @return*/public HttpServletRequest getOrgRequest() {return orgRequest;}/*** 获取最原始的request的静态方法* * @return*/public static HttpServletRequest getOrgRequest(HttpServletRequest req) {if (req instanceof XssAndSqlHttpServletRequestWrapper) {return ((XssAndSqlHttpServletRequestWrapper) req).getOrgRequest();}return req;}/*** * 防止xss跨脚本攻击（替换，根据实际情况调整）*/public static String stripXSSAndSql(String value) {if (value != null) {// NOTE: It's highly recommended to use the ESAPI library and// uncomment the following line to// avoid encoded attacks.// value = ESAPI.encoder().canonicalize(value);// Avoid null characters/** value = value.replaceAll("", ""); ***/// Avoid anything between script tagsPattern scriptPattern = Pattern.compile("<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid anything in a// src="http://www.yihaomen.com/article/java/..." type of// e-xpressionscriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome </script> tagscriptPattern = Pattern.compile("</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome <script ...> tagscriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid eval(...) expressionsscriptPattern = Pattern.compile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid e-xpression(...) expressionsscriptPattern = Pattern.compile("e-xpression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid javascript:... expressionsscriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid vbscript:... expressionsscriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid onload= expressionsscriptPattern = Pattern.compile("onload(.*?)=",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");}return value;}public static boolean checkXSSAndSql(String value) {boolean flag = false;if (value != null) {// NOTE: It's highly recommended to use the ESAPI library and// uncomment the following line to// avoid encoded attacks.// value = ESAPI.encoder().canonicalize(value);// Avoid null characters/** value = value.replaceAll("", ""); ***/// Avoid anything between script tagsPattern scriptPattern = Pattern.compile("<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid anything in a// src="http://www.yihaomen.com/article/java/..." type of// e-xpressionscriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Remove any lonesome </script> tagscriptPattern = Pattern.compile("</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Remove any lonesome <script ...> tagscriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid eval(...) expressionsscriptPattern = Pattern.compile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid e-xpression(...) expressionsscriptPattern = Pattern.compile("e-xpression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid javascript:... expressionsscriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid vbscript:... expressionsscriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid onload= expressionsscriptPattern = Pattern.compile("onload(.*?)=",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}}return flag;}public final boolean checkParameter() {Map<String, String[]> submitParams = new HashMap(parameterMap);Set<String> submitNames = submitParams.keySet();for (String submitName : submitNames) {Object submitValues = submitParams.get(submitName);if ((submitValues instanceof String)) {if (checkXSSAndSql((String) submitValues)) {return true;}} else if ((submitValues instanceof String[])) {for (String submitValue : (String[])submitValues){if (checkXSSAndSql(submitValue)) {return true;}}}}return false;}@Override    public BufferedReader getReader() throws IOException {    return new BufferedReader(new InputStreamReader(getInputStream()));    }    @Override    public ServletInputStream getInputStream() throws IOException {    final ByteArrayInputStream bais = new ByteArrayInputStream(body);    return new ServletInputStream() {    @Override    public int read() throws IOException {    return bais.read();    }  @Override  public boolean isFinished() {  // TODO Auto-generated method stub  return false;  }  @Override  public boolean isReady() {  // TODO Auto-generated method stub  return false;  }  @Override  public void setReadListener(ReadListener arg0) {  // TODO Auto-generated method stub  }    };    }}

4.修改验证登录代码这里只写了基础的了解意思即可

//2.校验手机号和token号 String sql = "select * from userlogin where phonenum='"+phonenum+"' and token='"+tokennum+"' ";//3.不准确退回从新输入登录try {int resttokenjy = aed.queryApiInfo(sql).size();if(resttokenjy != 1){return new AsyncResult<>("验证码不正确！");}} catch (Exception e) {log.error(e.toString());return new AsyncResult<>("验证码不正确！");}

重点是加上try 如果发生异常也好吧信息异步返回回去
更具业务需求，返回自己特殊更多的内容，有需要进行其他安全设施的也可以像安全记录中进行记录数据
如发现危险用户恶意攻击系统等

5.测试内容

6.测试结果

Loading class `com.mysql.jdbc.Driver'. This is deprecated. The new driver class is `com.mysql.cj.jdbc.Driver'. The driver is automatically registered via the SPI and manual loading of the driver class is generally unnecessary.
2020-06-12 10:02:22.045 INFO  com.alibaba.druid.pool.DruidDataSource - {dataSource-1} inited
2020-06-12 10:02:22.192 ERROR com.superman.global.service.usercheck.UserLoginCheckService - org.springframework.jdbc.BadSqlGrammarException:
### Error querying database.  Cause: java.sql.SQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '＃'' at line 1
### The error may exist in file [D:\eclipseworks_2020\superporject\super_portal\target\classes\mybatis\mapper\ds1\ApiOneDao.xml]
### The error may involve com.superman.globaldao.ds1.ApiOneDao.queryApiInfo-Inline
### The error occurred while setting parameters
### SQL: select id from userlogin where phonenum='15600000000' and token='' or 1=1 ＃'
### Cause: java.sql.SQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '＃'' at line 1
; bad SQL grammar []; nested exception is java.sql.SQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '＃'' at line 1

7.反黑客小介绍（黑客大哥们好小弟这没啥大用O(∩_∩)O~，但是对待小白黑客还好）

ok 我们这里可以看到原本半角代码 # 已经变成全角代码＃如此以来就可以完全防止sql 和xss 注入了，当然，还有有高手
攻击破解系统，这时候就是继续再加点过滤器和系统安全防护策略，还有安全校验来实现，
总体来讲
要向防止系统被攻破
就要自己多方几堵墙阻挡破解的墙越多，黑客发现这么多阻挡，由于利益的权衡后发现，破解你的系统有些亏，大部分就
去破解别的系统去了^_^ , 这说法仅当参考哈，还是你们想和黑客战斗的大哥们去战斗比试比试吧，
pk 下谁更牛棒棒哒 O(∩_∩)O

springboot 防止xss 和sql 注入改写 http 请求 getParameter，getParameterValues，getHeader等方法有点东西相关推荐

php 完美防sql注入,PHP 完美的防XSS 防SQL注入的代码
PHP "完美"的防XSS 防SQL注入的代码 function gjj($str) { $farr = array( "/s+/", "/]*?)& ...
防御CSRF、XSS和SQL注入***
过滤器 package cn.bizws.ismp.common.web; /** * @author www.bizws.cn Tom */ import java.io.File; impor ...
从php角度分析预防xss和Sql注入
引言从php角度分析预防xss和Sql注入,是因为php对这方面做了很好的支持. XSS 概念: Xss即跨站脚本攻击,指攻击者在网页中嵌入恶意脚本程序(一般由html,css,js组成),当用户打 ...
实验三 XSS和SQL注入
实验三 XSS和SQL注入实验目的:了解什么是XSS:了解XSS攻击实施,理解防御XSS攻击的方法:了解SQL注入的基本原理:掌握PHP脚本访问MySQL数据库的基本方法:掌握程序设计中避免出现SQ ...
网络渗透测试实验三——XSS和SQL注入
网络渗透测试实验三--XSS和SQL注入实验目的了解什么是XSS:了解XSS攻击实施,理解防御XSS攻击的方法:了解SQL注入的基本原理:掌握PHP脚本访问MySQL数据库的基本方法:掌握程序设计 ...
PHP防SQL注入代码,PHP 预防CSRF、XSS、SQL注入攻击
1.服务端进行CSRF防御服务端的CSRF方式方法很多样,但总的思想都是一致的,就是在客户端页面增加伪随机数. (1).Cookie Hashing(所有表单都包含同一个伪随机值): 这可能是最简单 ...
PHP之SQL防注入代码，PHP防XSS 防SQL注入的代码
360提示XSS漏洞?这个XSS漏洞很不好修复.....如果是PHP程序的话,可以用下面的代码来过滤... PHP防XSS 防SQL注入的代码 class protection{public stat ...
xss sql注入 php,利用xss 执行sql注入
看见phpcms v9.1.15爆的xss和无权限的sql注入,于是就想测试下利用xss执行sql注入,虽然爆的这个phpcms漏洞还有很多其他的用法!但是,这个注入我没有找到phpcms v9.1. ...
45-互联网安全架构-Web常用攻击手段之XSS脚本SQL注入攻击
文章目录 1. 什么是XSS攻击&XSS攻击应用场景 2. XSS脚本攻击原理分析 3. 使用过滤器防御XSS攻击 4. 使用#传递参数防御SQL注入攻击 1. 什么是XSS攻击&XS ...
Web攻防之XSS,CSRF,SQL注入
摘要:对Web服务器的攻击也可以说是形形色色.种类繁多,常见的有挂马.SQL注入.缓冲区溢出.嗅探.利用IIS等针对Webserver漏洞进行攻击.本文结合WEB TOP10漏洞中常见的SQL注入,跨 ...

springboot 防止xss 和sql 注入改写 http 请求 getParameter，getParameterValues，getHeader等方法有点东西

1.springboot 启动类引入过滤器配置

2.过滤器

3.XssAndSqlHttpServletRequestWrapper包装器包装类

4.修改验证登录代码这里只写了基础的了解意思即可

5.测试内容

6.测试结果

7.反黑客小介绍（黑客大哥们好小弟这没啥大用O(∩_∩)O~，但是对待小白黑客还好）

springboot 防止xss 和sql 注入改写 http 请求 getParameter，getParameterValues，getHeader等方法有点东西相关推荐

最新文章

热门文章

springboot 防止xss 和sql 注入 改写 http 请求 getParameter，getParameterValues，getHeader等方法 有点东西

1.springboot 启动类 引入 过滤器配置

2.过滤器

3.XssAndSqlHttpServletRequestWrapper包装器 包装类

4.修改验证登录代码 这里只写了基础的 了解意思即可

5.测试内容

6.测试结果

7.反黑客小介绍（黑客大哥们好小弟这没啥大用O(∩_∩)O~，但是对待小白黑客还好）

springboot 防止xss 和sql 注入 改写 http 请求 getParameter，getParameterValues，getHeader等方法 有点东西相关推荐

最新文章

热门文章

springboot 防止xss 和sql 注入改写 http 请求 getParameter，getParameterValues，getHeader等方法有点东西

1.springboot 启动类引入过滤器配置

3.XssAndSqlHttpServletRequestWrapper包装器包装类

4.修改验证登录代码这里只写了基础的了解意思即可

springboot 防止xss 和sql 注入改写 http 请求 getParameter，getParameterValues，getHeader等方法有点东西相关推荐