SpringBoot 防止XSS攻击和SQL攻击拦截器(Filter)
2024-05-15 11:29:44
什么是SQL攻击、什么是XSS攻击
SQL 攻击:把SQL命令插入到Web表单并提交,欺骗服务器执行恶意的SQL命令。
XSS 攻击:向有XSS漏洞的网站中输入(传入)恶意的HTML代码，当其它用户浏览该网站时，这段HTML代码会自动执行，从而达到攻击的目的。
创建拦截器第一步：
创建XssAndSqlHttpServletRequestWrapper包装器，这是实现XSS和SQL过滤的关键，在其内重写了getParameter，getParameterValues，getHeader等方法，对http请求内的参数进行了过滤。
import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Map;
import java.util.Set;
import java.util.Vector;
import java.util.regex.Pattern;import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;import org.springframework.util.StreamUtils;public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {HttpServletRequest orgRequest = null;private Map<String, String[]> parameterMap;private final byte[] body; // 用于保存读取body中数据public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException {super(request);orgRequest = request;parameterMap = request.getParameterMap();body = StreamUtils.copyToByteArray(request.getInputStream());}// 重写几个HttpServletRequestWrapper中的方法/*** 获取所有参数名** @return 返回所有参数名*/@Overridepublic Enumeration<String> getParameterNames() {Vector<String> vector = new Vector<String>(parameterMap.keySet());return vector.elements();}/*** 覆盖getParameter方法，将参数名和参数值都做xss & sql过滤。<br/>* 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖*/@Overridepublic String getParameter(String name) {String[] results = parameterMap.get(name);if (results == null || results.length <= 0)return null;else {String value = results[0];if (value != null) {value = xssEncode(value);}return value;}}/*** 获取指定参数名的所有值的数组，如：checkbox的所有数据 接收数组变量 ，如checkobx类型*/@Overridepublic String[] getParameterValues(String name) {String[] results = parameterMap.get(name);if (results == null || results.length <= 0)return null;else {int length = results.length;for (int i = 0; i < length; i++) {results[i] = xssEncode(results[i]);}return results;}}/*** 覆盖getHeader方法，将参数名和参数值都做xss & sql过滤。<br/>* 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>* getHeaderNames 也可能需要覆盖*/@Overridepublic String getHeader(String name) {String value = super.getHeader(xssEncode(name));if (value != null) {value = xssEncode(value);}return value;}/*** 将容易引起xss & sql漏洞的半角字符直接替换成全角字符** @param s* @return*/private static String xssEncode(String s) {if (s == null || s.isEmpty()) {return s;} else {s = stripXSSAndSql(s);}StringBuilder sb = new StringBuilder(s.length() + 16);for (int i = 0; i < s.length(); i++) {char c = s.charAt(i);switch (c) {case '>':sb.append("＞");// 转义大于号break;case '<':sb.append("＜");// 转义小于号break;// case '\'':// sb.append("＇");// 转义单引号// break;// case '\"':// sb.append("＂");// 转义双引号// break;case '&':sb.append("＆");// 转义&break;case '#':sb.append("＃");// 转义#break;default:sb.append(c);break;}}return sb.toString();}/*** 获取最原始的request** @return*/public HttpServletRequest getOrgRequest() {return orgRequest;}/*** 审查参数的具体方法* @param value* @return*/public static boolean checkXSSAndSql(String value) {boolean flag = false;if (value != null) {// NOTE: It's highly recommended to use the ESAPI library and// uncomment the following line to// avoid encoded attacks.// value = ESAPI.encoder().canonicalize(value);// Avoid null characters/** value = value.replaceAll("", ""); ***/// Avoid anything between script tagsPattern scriptPattern = Pattern.compile("<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid anything in a// src="http://www.yihaomen.com/article/java/..." type of// e-xpressionscriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Remove any lonesome </script> tagscriptPattern = Pattern.compile("</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Remove any lonesome <script ...> tagscriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid eval(...) expressionsscriptPattern = Pattern.compile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid e-xpression(...) expressionsscriptPattern = Pattern.compile("e-xpression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid javascript:... expressionsscriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid vbscript:... expressionsscriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid οnlοad= expressionsscriptPattern = Pattern.compile("onload(.*?)=",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}scriptPattern = Pattern.compile("\\b(and|exec|insert|select|drop|grant|alter|delete|update|count|chr|mid|master|truncate|char|declare|or)\\b|(\\*|;|\\+|'|%)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}}return flag;}/*** 检查参数方法* @return*/public final boolean checkParameter() {Map<String, String[]> submitParams = new HashMap(parameterMap);Set<String> submitNames = submitParams.keySet();for (String submitName : submitNames) {Object submitValues = submitParams.get(submitName);if ((submitValues instanceof String)) {if (checkXSSAndSql((String) submitValues)) {return true;}} else if ((submitValues instanceof String[])) {for (String submitValue : (String[])submitValues){if (checkXSSAndSql(submitValue)) {return true;}}}}return false;}/*** 获取最原始的request的静态方法** @return*/public static HttpServletRequest getOrgRequest(HttpServletRequest req) {if (req instanceof XssAndSqlHttpServletRequestWrapper) {return ((XssAndSqlHttpServletRequestWrapper) req).getOrgRequest();}return req;}/**** 防止xss跨脚本攻击（替换，根据实际情况调整）*/public static String stripXSSAndSql(String value) {if (value != null) {// NOTE: It's highly recommended to use the ESAPI library and// uncomment the following line to// avoid encoded attacks.// value = ESAPI.encoder().canonicalize(value);// Avoid null characters/** value = value.replaceAll("", ""); ***/// Avoid anything between script tagsPattern scriptPattern = Pattern.compile("<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid anything in a// src="http://www.yihaomen.com/article/java/..." type of// e-xpressionscriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome </script> tagscriptPattern = Pattern.compile("</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome <script ...> tagscriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid eval(...) expressionsscriptPattern = Pattern.compile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid e-xpression(...) expressionsscriptPattern = Pattern.compile("e-xpression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid javascript:... expressionsscriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid vbscript:... expressionsscriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid οnlοad= expressionsscriptPattern = Pattern.compile("onload(.*?)=",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");}return value;}/****application/x- www-form-urlencoded是Post请求默认的请求体内容类型，也是form表单默认的类型。* Servlet API规范中对该类型的请求内容提供了request.getParameter()方法来获取请求参数值。* 但当请求内容不是该类型时，需要调用request.getInputStream()或request.getReader()方法来获取请求内容值。*//*** 获取请求内容* @return* @throws IOException*/@Overridepublic BufferedReader getReader() throws IOException {return new BufferedReader(new InputStreamReader(getInputStream()));}/*** 返回请求内容字节流，多用于文件上传，* request.getReader()是对前者返回内容的封装，可以让调用者更方便字符内容的处理（不用自己先获取字节流再做字符流的转换操作）* @return* @throws IOException*/@Overridepublic ServletInputStream getInputStream() throws IOException {final ByteArrayInputStream bais = new ByteArrayInputStream(body);return new ServletInputStream() {@Overridepublic int read() throws IOException {return bais.read();}@Overridepublic boolean isFinished() {// TODO Auto-generated method stubreturn false;}@Overridepublic boolean isReady() {// TODO Auto-generated method stubreturn false;}@Overridepublic void setReadListener(ReadListener arg0) {// TODO Auto-generated method stub}};}}
创建拦截器第二步：
编写过滤器
import java.io.BufferedReader;
import java.io.IOException;
import java.io.PrintWriter;import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;import org.apache.commons.lang3.StringUtils;import com.alibaba.fastjson.JSONObject;
import com.digipower.common.entity.Result;
import com.digipower.http.servlet.request.wrapper.XssAndSqlHttpServletRequestWrapper;/*** 防止XSS 攻击和SQL注入攻击的Filter* @ClassName: XssAndSqlFilter * @Description:TODO(这里用一句话描述这个类的作用) * @author:* @date: 2021年3月22日 下午2:29:12 * * @Copyright: 2021 www.digipower.cn * 注意：*/
public class XssAndSqlFilter implements Filter {@Overridepublic void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)throws IOException, ServletException {String method = "GET";//设置初始值String param = "";XssAndSqlHttpServletRequestWrapper xssRequest = null;if (request instanceof HttpServletRequest) {//判断左边的对象是否是它右边对象的实例method = ((HttpServletRequest) request).getMethod();//得到请求URL地址时使用的方法xssRequest = new XssAndSqlHttpServletRequestWrapper((HttpServletRequest) request);//创建对象}if ("POST".equalsIgnoreCase(method)) {//判断是否为postparam = this.getBodyString(xssRequest.getReader());//获取参数if(StringUtils.isNotBlank(param)){//等价于 str != null && str.length > 0 && str.trim().length > 0if(xssRequest.checkXSSAndSql(param)){//进行参数审查response.setCharacterEncoding("UTF-8");response.setContentType("application/json;charset=UTF-8");PrintWriter out = response.getWriter();out.write(JSONObject.toJSONString(Result.error("401", "您所访问的页面请求中有违反安全规则元素存在，拒绝访问!")));return;}}}/*** 检查参数的时候 同时检查请求的方法* 只检查get请求方法和post请求方法的的参数的数据是否合法* 并不是所有参数都要检查，首先必须是一个get或者post，再去校验参数* 因为PUT方法在进行参数审查的时候没办法通过所以直接过滤掉*/if (xssRequest.checkParameter()&&(method.equals("POST") || method.equals("GET"))){response.setCharacterEncoding("UTF-8");response.setContentType("application/json;charset=UTF-8");PrintWriter out = response.getWriter();out.write(JSONObject.toJSONString(Result.error("401", "您所访问的页面请求中有违反安全规则元素存在，拒绝访问!")));return;}chain.doFilter(xssRequest, response);}// 获取request请求body中参数public static String getBodyString(BufferedReader br) {String inputLine;String str = "";try {while ((inputLine = br.readLine()) != null) {str += inputLine;}br.close();} catch (IOException e) {System.out.println("IOException: " + e);}return str;}}
创建拦截器第三步
在webconfig中注册过滤器XssAndSqlFilter
@Configuration
@EnableWebMvc
public class SpringMVCConfig extends WebMvcConfigurerAdapter {@Beanpublic FilterRegistrationBean xssFilterRegistrationBean() {// 创建一个自定义的 FilterFilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();filterRegistrationBean.setFilter(new XssAndSqlFilter());filterRegistrationBean.setOrder(1);filterRegistrationBean.setEnabled(true);filterRegistrationBean.addUrlPatterns("/*");// 过滤指定请求地址Map<String, String> initParameters = new HashMap<String, String>();initParameters.put("excludes", "/auth/login,/auth/code,/auth/phone,/swagger-ui.html/**,/swagger-resources/**,/webjars/**,/v2/api-docs/**,/upload_file/**");initParameters.put("isIncludeRichText", "true");filterRegistrationBean.setInitParameters(initParameters);return filterRegistrationBean;}}备注
excludes用于配置不需要参数过滤的请求url。
isIncludeRichText默认为true，主要用于设置富文本内容是否需要过滤。
SpringBoot 防止XSS攻击和SQL攻击拦截器(Filter)相关推荐
- html页面设置拦截器,SpringBoot拦截器Filter的使用方法详解
SpringBoot拦截器Filter的使用方法详解 发布时间:2020-08-27 22:44:03 来源:脚本之家 阅读:107 作者:玉天恒 前言: 最新Servlet 3.0拦截器的使用 1. ...
- ASP.NET MVC案例教程——拦截器 Filter
摘要 本文将对"MVC公告发布系统"的发布公告功能添加日志功能和异常处理功能,借此来讨论ASP.NET MVC中拦截器的使用方法. 一个小难题 我们继续完善 ...
- js和css被屏蔽了,拦截器 Filter ,js、css、image等静态资源不被拦截解决方案
方案一: web.xml配置文件拦截范围缩小 ,没有必要 /*的配置拦截项目下所有资源. Login com.ssm.crm.filter.LoginFilter Login /* 修改如下: Log ...
- JavaWeb中post提交乱码之编码拦截器Filter
最近做项目比较忙,一直没有更新新的知识,有好多好的代码没给大家分享出来,后期我会抽空整理出来的 这两天遇到一个项目编码问题,搞了两天了也没解决.问题是这样的: 项目是gbk的编码(我知道看到这里要被吐 ...
- springboot 添加拦截器之后中文乱码_spring boot 2.x 添加拦截器配置未生效的问题
背景: 今天有一个需求需要拦截除登录相关请求以外的所有请求,并查看request 中是否包含指定的信息,而自然就想到了使用拦截器就可以轻松实现 编写拦截器,获取请求头信息中的test,并打印出来 @C ...
- 从零开始SpringCloud Alibaba实战（59）——过滤器filter、拦截器interceptor、和AOP的区别与联系及应用
文章目录 前言 过滤器 拦截器 过滤器与拦截器的区别 AOP(面向切面) 三者使用场景 Filter过滤器 Interceptor拦截器 Spring AOP拦截器 Filter与Intercepto ...
- ef mysql 读写分离_EF架构~通过EF6的DbCommand拦截器来实现数据库读写分离~终结~配置的优化和事务里读写的统一...
/// ///SQL命令拦截器///主要实现EF的读写分离/// public classCommandInterceptor : DbCommandInterceptor {staticComman ...
- java web 过滤器跟拦截器的区别和使用
2019独角兽企业重金招聘Python工程师标准>>> 1.首先要明确什么是拦截器.什么是过滤器 1.1 什么是拦截器: 拦截器,在AOP(Aspect-Oriented Progr ...
- Java拦截器的小例子
效果如图: 首先定义拦截器: package star.july.filter;import java.io.IOException;import javax.servlet.Filter; impo ...
最新文章
- c语言 如何读多种数据类型 非类,c语言程序设计教学大纲(非电气类)文档.doc
- 配置网络(静态ip)
- python 中if __name__ = '__main__' 的作用
- Liux技巧总结之--解压各种文件
- Python内置数据结构及其复杂度
- block 与 dispatch quene
- PHP封装对象名字的思路
- [RabbitMQ]什么是MQ
- DDD(Domain-Driven Design)领域驱动设计-(二)事件风暴
- android 系统应用在运行时被卸载
- [翻译] ios-image-filters
- 电商狂欢6月之代码也疯狂
- 老毛子 K2 通过SSH 抓包
- win10计算机休眠快捷键,键盘快捷键关闭或休眠Windows 10 | MOS86
- 怎么用计算机算到期收益率,怎样用计算器算出债券到期收益率？
- Chrome保存整个网页为图片(终极解决方案!)
- 第八章：加载Maya2011模型
- 免费中通快递对接快递鸟单号查询接口对接方法
- 奇迹服务器技能修改,奇迹技能修改教程-地狱火技能修改介绍
- BT之家种子连接提取