SpringMVC防止XSS攻击

XSS全称为跨站脚本攻击 , 具体见百度百科

最常见的是用Filter来预防 , 就是创建一个新的httpRequest类XsslHttpServletRequestWrapper，然后重写一些get方法（获取参数时对参数进行XSS判断预防）.

1 . 在web.xml中添加Filter

<filter><filter-name>XssFilter</filter-name><filter-class>com.xbz.filter.XssFilter</filter-class></filter><filter-mapping><filter-name>XssFilter</filter-name><url-pattern>/*</url-pattern></filter-mapping>

2 . 编写XssFilter类

package com.xbz.filter;import java.io.IOException;import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;public class XssFilter implements Filter{FilterConfig fc = null;public void destroy() {fc = null;}public void doFilter(ServletRequest req, ServletResponse resp,FilterChain fc) throws IOException, ServletException {fc.doFilter(new XssHttpServletRequestWrapper((HttpServletRequest)req), resp);}public void init(FilterConfig fc) throws ServletException {this.fc = fc;}}

3 . 编写XssHttpServletRequestWrapper类

package com.xbz.filter;import java.util.HashMap;
import java.util.Map;
import java.util.regex.Pattern;import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {public XssHttpServletRequestWrapper(HttpServletRequest request) {super(request);}public String[] getParameterValues(String parameter) {String[] values = super.getParameterValues(parameter);if (values == null) {return null;}int count = values.length;String[] encodedValues = new String[count];for (int i = 0; i < count; i++) {encodedValues[i] = cleanXSS(values[i]);}return encodedValues;}public Map<String, String[]> getParameterMap() {Map<String, String[]> map = super.getParameterMap();Map<String, String[]> encodedMap = new HashMap<String, String[]>();encodedMap.putAll(map);for (Map.Entry<String, String[]> entry : encodedMap.entrySet()) {String[] value = entry.getValue();String[] encodedValues = new String[value.length];for (int i = 0; i < value.length; i++) {encodedValues[i] = cleanXSS(value[i]);}encodedMap.put(entry.getKey(), encodedValues);}return encodedMap;}public String getParameter(String parameter) {String value = super.getParameter(parameter);if (value == null) {return null;}return cleanXSS(value);}public String getHeader(String name) {String value = super.getHeader(name);if (value == null)return null;return cleanXSS(value);}private String cleanXSS(String value) {if (value != null) {// Avoid null charactersvalue = value.replaceAll("", "");// Avoid anything between script tagsPattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid anything in a// src="http://www.yihaomen.com/article/java/..." type of// expressionscriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome </script> tagscriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome <script ...> tagscriptPattern = Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid eval(...) expressionsscriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid expression(...) expressionsscriptPattern = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid javascript:... expressionsscriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid vbscript:... expressionsscriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid οnlοad= expressionsscriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");}return filter(value);}/** * 过滤特殊字符 */public static String filter(String value) {if (value == null) {return null;}StringBuffer result = new StringBuffer(value.length());for (int i = 0; i < value.length(); ++i) {switch (value.charAt(i)) {case '<':result.append("<");break;case '>':result.append(">");break;case '"':result.append("\"");break;case '\'':result.append("'");break;case '%':result.append("%");break;case ';':result.append(";");break;case '(':result.append("(");break;case ')':result.append(")");break;case '&':result.append("&");break;case '+':result.append("+");break;default:result.append(value.charAt(i));break;}}return result.toString();}
}

另外, SpringBoot的写法请参考另一篇文章SpringBoot防止XSS攻击

SpringMVC防止XSS攻击相关推荐

SpringBoot防XSS攻击
1 . pom中增加依赖  <dependency><groupId>org.jsoup</groupId><ar ...
java 过滤攻击报文_Spring Boot XSS 攻击过滤插件使用
XSS 是什么 XSS(Cross Site Scripting)攻击全称跨站脚本攻击,为了不与 CSS(Cascading Style Sheets)名词混淆,故将跨站脚本攻击简称为 XSS,XSS ...
springboot防止XSS攻击和sql注入
文章目录 1. XSS跨站脚本攻击 ①:XSS漏洞介绍 ②:XSS漏洞分类 ③:防护建议 2. SQL注入攻击 ①:SQL注入漏洞介绍 ②:防护建议 3. SpringBoot中如何防止XSS攻击和s ...
Spring Boot 防止XSS攻击
跨站脚本工具(cross 斯特scripting),为不和层叠样式表(cascading style sheets,CSS)的缩写混淆, 故将跨站脚本攻击缩写为XSS.恶意攻击者往web页面里插入恶意 ...
安全测试之xss攻击和mysql注入
xss概念: xss(Cross Site Script)跨站脚本攻击,为不和层叠样式表(css)混淆,写为xss 存在位置:web应用系统最常见软件安全漏洞后果:代码植入到系统页面,篡改数据.盗取 ...
vue 如何防止xss攻击框架_LearningNotes-1/Vue/Vue中防止XSS脚本攻击 at master · axuu/LearningNotes-1 · GitHub...
Vue中防止XSS脚本攻击最近写了一个博客评论模块,因为引入了表情包,所以就将原来的v-text的形式,改成了v-html,也就是渲染html标签,但是这样不可不免的会带来问题,就是XSS跨站脚本攻 ...
安全测试之XSS攻击
XSS (跨站脚本攻击)是什么?它的全名是:Cross-site scripting,为了和CSS层叠样式表区分所以取名XSS.是一种网站应用程序的安全漏洞攻击,是代码注入的一种.它允许恶意用户将代码 ...
AntiXSS - 支持Html同时防止XSS攻击
跨站脚本攻击(XSS)已经不是什么新鲜的话题了,甚至很多大公司也为此吃尽苦头.最简单直接的防范方法,就是不允许任何html标签输入,对用户输入进行编码(htmlencode). 但是如果想用户输入支持 ...
如何php防止XSS攻击
什么是XSS:这里通俗的讲,就像是SQL注入一样,XSS攻击也可以算是对HTML和JS的一种注入.你本来希望得到是从用户那得到一段有用的文本文字,但用户提交给你的却是别有用心的可执行javascrip ...

SpringMVC防止XSS攻击

SpringMVC防止XSS攻击相关推荐

最新文章

热门文章