Filter过滤器过滤XSS攻击

一.springmvc框架

1.添加自定义过滤器文件XssFilter.java和XssHttpServletRequestWrapper.java
XssFilter.java

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import org.apache.commons.lang.StringUtils;
import org.springframework.web.multipart.MultipartHttpServletRequest;
import org.springframework.web.multipart.commons.CommonsMultipartResolver;/*** 过滤器* Created by adonis on 2020/12/12*/
public class XssFilter implements Filter{// 配置信息对象public FilterConfig filterConfig;private FilterConfig config;/*** 初始化* 与我们编写的Servlet程序一样，Filter的创建和销毁由WEB服务器负责。 * Web应用程序启动时，Web服务器将创建Filter的实例对象，并调用其init方法，读取web.xml配置，* 完成对象的初始化功能，从而为后续的用户请求作好拦截的准备工作。* Filter对象只会创建一次，init方法也只会执行一次。* 开发人员通过init方法的参数，可获得代表当前Filter配置信息的FilterConfig对象。*/@Overridepublic void init(FilterConfig filterConfig) throws ServletException {filterConfig = config;}/*** 拦截请求* 这个方法完成实际的过滤操作。当客户请求访问与过滤器关联的URL的时候，Servlet过滤器将先执行doFilter方法。* FilterChain参数用于访问后续过滤器。*/@Overridepublic void doFilter(ServletRequest request, ServletResponse response,FilterChain chain) throws IOException, ServletException {HttpServletRequest httpRequest = (HttpServletRequest) request;String enctype = httpRequest.getContentType();if(StringUtils.isNotBlank(enctype) && enctype.contains("multipart/form-data")){// 上传文件CommonsMultipartResolver commonsMultipartResolver = new CommonsMultipartResolver(httpRequest.getSession().getServletContext());MultipartHttpServletRequest multipartRequest = commonsMultipartResolver.resolveMultipart(httpRequest);XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(multipartRequest);chain.doFilter(xssRequest, response);}else{// 普通表单和AjaxXssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest) request);chain.doFilter(xssRequest, response);}}/*** 销毁* Filter对象创建后会驻留在内存，当Web应用移除或服务器停止时才销毁。在Web容器卸载Filter对象之前被调用。* 该方法在Filter的生命周期中仅执行一次。在这个方法中，可以释放过滤器使用的资源。*/@Overridepublic void destroy() {this.filterConfig = null;}}

XssHttpServletRequestWrapper.java

import java.util.Map;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import org.apache.commons.lang.StringEscapeUtils;
import org.springframework.web.util.HtmlUtils;/*** 用户请求包装类* Created by adonis on 2020/12/12*/
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper{public XssHttpServletRequestWrapper(HttpServletRequest request) {  super(request);}@Override  public String getParameter(String name) {  String value = super.getParameter(name);  if (value != null) {  value = xssEncode(value);  }  return value;  }@Overridepublic String[] getParameterValues(String name) {String[] value = super.getParameterValues(name);if(value != null){for (int i = 0; i < value.length; i++) {value[i] = xssEncode(value[i]);}}return value;}@Overridepublic Map getParameterMap() {return super.getParameterMap();}/*** 请求头不过滤*/@Override  public String getHeader(String name) {  return super.getHeader(name);}  /** * 将容易引起注入的关键字的半角字符直接替换成全角字符* @param value 过滤前的值* @return 过滤后的值*/  private static String xssEncode(String value) {  if (value == null || value.isEmpty()) {return value;}// 防SQL注入转义value = StringEscapeUtils.escapeSql(value);// HTML防注入，个人建议使用第三种// 1.防HTML注入转义(HtmlUtils工具类，汉字不转义，双引号转义，存在JSON封装需要反转义)value = HtmlUtils.htmlEscape(value);return value;}
}

2.配置文件web.xml添加Filter配置

<filter><filter-name>xssFilter</filter-name><filter-class>你的文件路径.XssFilter</filter-class></filter><filter-mapping><filter-name>xssFilter</filter-name><url-pattern>/*</url-pattern></filter-mapping>

二. springboot框架

1.导入依赖库，因为Hutool工具包带有XSS转义的工具类，所以我们要导入Hutool，然后利用Servlet规范提供的请求包装类，定义数据转义功能。

<dependency><groupId>cn.hutool</groupId><artifactId>hutool-all</artifactId><version>5.4.0</version>
</dependency>

2.定义请求包装类

package com.example.emos.wx.config.xss;import cn.hutool.core.util.StrUtil;
import cn.hutool.http.HtmlUtil;
import cn.hutool.json.JSONUtil;import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.*;
import java.nio.charset.Charset;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.Map;public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {public XssHttpServletRequestWrapper(HttpServletRequest request) {super(request);}@Overridepublic String getParameter(String name) {String value = super.getParameter(name);if (!StrUtil.hasEmpty(value)) {value = HtmlUtil.filter(value);}return value;}@Overridepublic String[] getParameterValues(String name) {String[] values = super.getParameterValues(name);if (values != null) {for (int i = 0; i < values.length; i++) {String value = values[i];if (!StrUtil.hasEmpty(value)) {value = HtmlUtil.filter(value);}values[i] = value;}}return values;}@Overridepublic Map<String, String[]> getParameterMap() {Map<String, String[]> parameters = super.getParameterMap();Map<String, String[]> map = new LinkedHashMap<>();if (parameters != null) {for (String key : parameters.keySet()) {String[] values = parameters.get(key);for (int i = 0; i < values.length; i++) {String value = values[i];if (!StrUtil.hasEmpty(value)) {value = HtmlUtil.filter(value);}values[i] = value;}map.put(key, values);}}return map;}@Overridepublic String getHeader(String name) {String value = super.getHeader(name);if (!StrUtil.hasEmpty(value)) {value = HtmlUtil.filter(value);}return value;}@Overridepublic ServletInputStream getInputStream() throws IOException {InputStream in = super.getInputStream();StringBuffer body = new StringBuffer();InputStreamReader reader = new InputStreamReader(in, Charset.forName("UTF-8"));BufferedReader buffer = new BufferedReader(reader);String line = buffer.readLine();while (line != null) {body.append(line);line = buffer.readLine();}buffer.close();reader.close();in.close();Map<String, Object> map = JSONUtil.parseObj(body.toString());Map<String, Object> resultMap = new HashMap(map.size());for (String key : map.keySet()) {Object val = map.get(key);if (map.get(key) instanceof String) {resultMap.put(key, HtmlUtil.filter(val.toString()));} else {resultMap.put(key, val);}}String str = JSONUtil.toJsonStr(resultMap);final ByteArrayInputStream bain = new ByteArrayInputStream(str.getBytes());return new ServletInputStream() {@Overridepublic int read() throws IOException {return bain.read();}@Overridepublic boolean isFinished() {return false;}@Overridepublic boolean isReady() {return false;}@Overridepublic void setReadListener(ReadListener listener) {}};}}

3.创建过滤器

package com.example.emos.wx.config.xss;import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;@WebFilter(urlPatterns = "/*")
public class XssFilter implements Filter {public void init(FilterConfig config) throws ServletException {}public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)throws IOException, ServletException {XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest) request);chain.doFilter(xssRequest, response);}@Overridepublic void destroy() {}
}

4.在boot主类注册过滤器
给SpringBoot主类添加@ServletComponentscan注解。

Java添加过滤器过滤xss入侵相关推荐

java 过滤xss脚本_Java Web应用程序的反跨站点脚本（XSS）过滤器
java 过滤xss脚本这是为Java Web应用程序编写的一个好简单的反跨站点脚本(XSS)过滤器. 它的基本作用是从请求参数中删除所有可疑字符串,然后将其返回给应用程序. 这是我以前关于该主题的 ...
java过滤器过滤Emoji 表情
1.web.xml添加过滤器 <filter><filter-name>EmojiFilter</filter-name><filter-class>c ...
java 过滤脚本_【快学SpringBoot】过滤XSS脚本攻击(包括json格式)
XSS攻击是什么 XSS攻击全称跨站脚本攻击,是为不和层叠样式表(Cascading Style Sheets, CSS)的缩写混淆,故将跨站脚本攻击缩写为XSS,XSS是一种在web应用中的计算机安 ...
Springboot过滤xss
Springboot过滤xss 两种xss类型:存储型xss.反射型xss. 简介: 存储型:持久化,代码是存储在服务器中的,如在个人信息或发表文章等地方,加入代码,如果没有过滤或过滤不严,那么这些代 ...
如何用过滤器过滤HTTP协议和非HTTP协议编码
2019独角兽企业重金招聘Python工程师标准>>> 在编写web时,最苦恼的事情就是乱码了. 一直没怎么考虑过JSP第一句话中 <%@ page language=&quo ...
重温java web过滤器filter
点击上方"好好学java",选择"置顶公众号" 优秀学习资源.干货第一时间送达! 精彩内容 java实战练习项目教程 2018微服务资源springboot.s ...
过滤器过滤特定的url_如何从过滤器中排除URL
过滤器过滤特定的url 默认情况下,过滤器不支持排除特定的URL模式,每当您为过滤器定义URL模式时,任何与该模式匹配的请求都将由过滤器无例外处理. 从过滤器中排除URL的最简单方法是将过滤器映射到非 ...
如何右键菜单添加命令提示符_在右键菜单顶部添加过滤器命令
如何右键菜单添加命令提示符 Do you spend lots of time in Excel tables, filtering the data, then clearing those fil ...
HCSA-08 威胁防护介绍、ARP防护、网络攻击防护、病毒过滤、入侵防御、边界流量过滤
一.威胁防护 1.1 威胁防护介绍设备可检测并阻断网络的发生,减少对内网安全造成的损失: 威胁防护包括: 1.主机ARP防护 2.攻击防护 3.病毒过滤 4.入侵防御 5.异常行为检测(T) 6.高 ...

Java添加过滤器过滤xss入侵

Filter过滤器过滤XSS攻击

一.springmvc框架

二. springboot框架

Java添加过滤器过滤xss入侵相关推荐

最新文章

热门文章