一、首先科普点知识

（一）什么是XSS？

xss又叫CSS(Cross-SiteScripting),跨站脚本攻击。恶意攻击者往Web页面里插入恶意html代码，当用户浏览该页之时，嵌入其中Web里面的html代码会被执行，从而达到恶意用户的特殊目的。主要指的自己构造XSS跨站漏洞网页或者寻找非目标机以外的有跨站漏洞的网页。

（二）Java中拦截器与过滤器的差异：

1、拦截器是基于java反射机制的，而过滤器是基于函数回调的。

2、过滤器依赖于servlet容器，而拦截器不依赖于servlet容器。

3、拦截器只对action起作用，而过滤器几乎可以对所有请求起作用。

4、拦截器可以访问action上下文、值栈里的对象，而过滤器不能。

5、在action的生命周期里，拦截器可以多起调用，而过滤器只能在容器初始化时调用一次。

二、写过滤器实现过滤

（一）首先自己写一个过滤器

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;public class XSSFilter implements Filter {  @Override  public void destroy() {  // TODO Auto-generated method stub  }  @Override  public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2)  throws IOException, ServletException {  // TODO Auto-generated method stub  arg2.doFilter(new XSSRequestWrapper((HttpServletRequest) arg0), arg1);  }  @Override  public void init(FilterConfig arg0) throws ServletException {  // TODO Auto-generated method stub  }  }  

（二）然后写一个自己用来实现业务的HttpServletRequestWrapper

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.util.regex.Pattern;public class XSSRequestWrapper extends HttpServletRequestWrapper {public XSSRequestWrapper(HttpServletRequest request) {super(request);}@Overridepublic String[] getParameterValues(String parameter) {String[] values = super.getParameterValues(parameter);if (values == null) {return null;}int count = values.length;String[] encodedValues = new String[count];for (int i = 0; i < count; i++) {encodedValues[i] = stripXSS(values[i]);}return encodedValues;}@Overridepublic String getParameter(String parameter) {String value = super.getParameter(parameter);return stripXSS(value);}@Overridepublic String getHeader(String name) {String value = super.getHeader(name);//return stripXSS(value);return value;}public String getQueryString() {String value = super.getQueryString();if (value != null) {value = stripXSS(value);}return value;}private String stripXSS(String value) {if (value != null) {// Avoid anything between script tagsPattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid anything in a// e­xpressionscriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome </script> tagscriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome <script ...> tagscriptPattern = Pattern.compile("<script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid eval(...) e­xpressionsscriptPattern = Pattern.compile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid e­xpression(...) e­xpressionsscriptPattern = Pattern.compile("e­xpression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid javascript:... e­xpressionsscriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid vbscript:... e­xpressionsscriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid onload= e­xpressionsscriptPattern = Pattern.compile("onload(.*?)=",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");/*过滤html标签*/Pattern p_html = Pattern.compile("<[^>]+>", Pattern.CASE_INSENSITIVE);value = p_html.matcher(value).replaceAll("");Pattern p_html1 = Pattern.compile("<[^>]+", Pattern.CASE_INSENSITIVE);value = p_html1.matcher(value).replaceAll("");}return value;}
}

（三）最后在web.xml中进行配置

<filter><filter-name>XSSFilter</filter-name><filter-class></filter-class></filter><filter-mapping><filter-name>XSSFilter</filter-name><url-pattern>/*</url-pattern></filter-mapping>

完事！