Spring boot 添加 XssFilter过滤器
第一步部分代码： XSS_ERROR(90006, “入参含有非法字符”)
@Component
@Slf4j
@WebFilter(filterName = "xssFilter", urlPatterns = "/*")
@Order(5)
public class XssFilter implements Filter {
private static final String SCRIPT_LOW_REGEX = ".*((((\\%3C)|<)[^\\n]+((\\%3E)|>))|(((\\%22)|"|(\\%27)|')[(\\%20) ]*((\\%2B)|\\+|(\\%3B)|;))|(((\\%3D)|=)[(\\%20) ]*((\\%22)|"|(\\%27)|'))).*";
private static final String SCRIPT_UPPER_REGEX = ".*((((\\％3C)|<)[^\\n]+((\\％3E)|>))|(((\\％22)|"|(\\％27)|')[(\\％20) ]*((\\％2B)|\\+|(\\％3B)|;))|(((\\％3D)|=)[(\\％20) ]*((\\％22)|"|(\\％27)|'))).*";
private static final String SQL_REGEX = ".*((\\%27)|(\\')).*((\\-\\-)|(((\\%6F)|o|(\\%4F))((\\%72)|r|(\\%52)))|((\\%3B)|(;))).*";
private static final String NOT_PROTECT = "/undefined$";
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
System.out.println("*************执行过滤xssFilter******");
HttpServletResponse res = (HttpServletResponse) servletResponse;
res.setCharacterEncoding("UTF-8");
res.setContentType("application/json; charset=utf-8");
HttpServletRequest request ;
if (servletRequest instanceof HttpServletRequest) {
request = new XssHttpServletRequestWrapper((HttpServletRequest) servletRequest);
} else {
filterChain.doFilter(servletRequest, servletResponse);
return;
}
Map<String, String[]> parameterMap = getParams(request);
if (Objects.isNull(parameterMap) || parameterMap.size() == 0) {
parameterMap = request.getParameterMap();
}
String url = request.getRequestURI();
final Pattern scriptLowRegex = Pattern.compile(SCRIPT_LOW_REGEX);
final Pattern sqlRegex = Pattern.compile(SQL_REGEX);
final Pattern notProject = Pattern.compile(NOT_PROTECT);
final Pattern scriptUpperRegex = Pattern.compile(SCRIPT_UPPER_REGEX);
if (!notProject.matcher(url).find()) {
if (Objects.nonNull(parameterMap) && parameterMap.size() > 0) {
Iterator<Map.Entry<String, String[]>> iterator = parameterMap.entrySet().iterator();
while (iterator.hasNext()) {
Map.Entry<String, String[]> next = iterator.next();
String[] value = next.getValue();
for (int i = 0; i < value.length; i++) {
String paraValue = value[i].toUpperCase();
paraValue = replaceStr(paraValue);
if (scriptLowRegex.matcher(paraValue).matches()|| sqlRegex.matcher(paraValue).matches() || scriptUpperRegex.matcher(paraValue).matches()) {
PrintWriter writer = null;
try {
writer = res.getWriter();
String resultVal = JSON.toJSONString(ApiRes.getInstance(ResultEnum.XSS_ERROR));
writer.write(resultVal);
writer.flush();
writer.close();
} catch (Exception e) {
log.error("AuthPathFilter Error" + e.getMessage(), e);
} finally {
if (null != writer) {
writer.close();
}
}
return;
}
}
}
}
}
filterChain.doFilter(request, servletResponse);
return;
}
@Override
public void destroy() {
}
private Map<String, String[]> getParams(HttpServletRequest request) {
Map<String, String[]> paras = null;
BufferedReader streamReader = null;
try {
streamReader = new BufferedReader(new InputStreamReader(request.getInputStream(), "UTF-8"));
StringBuilder responseStrBuilder = new StringBuilder();
String inputStr;
while ((inputStr = streamReader.readLine()) != null) {
responseStrBuilder.append(inputStr);
}
String jString = responseStrBuilder.toString();
if (StringUtils.isNotBlank(jString)) {
boolean valid = isJSONValid(jString);
if (valid) {
paras = new HashMap<>();
JSONObject jsonObject = JSONObject.parseObject(jString);
Iterator<Map.Entry<String, Object>> iterator = jsonObject.entrySet().iterator();
while (iterator.hasNext()) {
Map.Entry<String, Object> next = iterator.next();
String key = next.getKey();
if (Objects.isNull(next.getValue())) {
paras.put(key, new String[]{""});
} else {
String value = next.getValue().toString();
paras.put(key, new String[]{value});
}
}
}
}
} catch (Exception e) {
log.error("参数解析错误", e);
}
return paras;
}
private boolean isJSONValid(String jsonInString) {
try {
final ObjectMapper mapper = new ObjectMapper();
mapper.readTree(jsonInString);
return true;
} catch (IOException e) {
return false;
}
}
private String replaceStr(String value) {
value = value.replace("+", "％2B")
//.replace("/", "％2F")
.replace("?", "％3F")
.replace("%", "％25")
.replace("#", "％23")
.replace("&", "％26")
.replace("=", "％3D")
.replace("@", "％40")
.replace(":", "％3A")
.replace(";", "％3B")
.replace("<", "％3C")
.replace(">", "％3E")
.replace("\\", "％5C")
.replace("|", "％7C")
.replace("$", "％24")
.replace("^", "％5E")
.replace(",", "％2C")
.replace("'", "％27")
.replace("=", "％3D")
.replace("[", "％5B")
.replace("]", "％5D")
.replace("{", "％7B")
.replace("}", "％7D")
.replace("\"", "％22");
return value;
}
}
第二部分代码：
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
private final byte[] bytes;
/**
* Constructs a request object wrapping the given request.
*
* @param request The request to wrap
* @throws IllegalArgumentException if the request is null
*/
public XssHttpServletRequestWrapper(HttpServletRequest request) throws IOException {
super(request);
// 读取输入流里的请求参数，并保存到bytes里
bytes = IOUtils.toByteArray(request.getInputStream());
}
@Override
public ServletInputStream getInputStream() throws IOException {
return new BufferedServletInputStream(this.bytes);
}
class BufferedServletInputStream extends ServletInputStream {
private ByteArrayInputStream inputStream;
public BufferedServletInputStream(byte[] buffer) {
//此处即赋能，可以详细查看ByteArrayInputStream的该构造函数；
this.inputStream = new ByteArrayInputStream( buffer );
}
@Override
public int available() throws IOException {
return inputStream.available();
}
@Override
public int read() throws IOException {
return inputStream.read();
}
@Override
public int read(byte[] b, int off, int len) throws IOException {
return inputStream.read( b, off, len );
}
@Override
public boolean isFinished() {
return false;
}
@Override
public boolean isReady() {
return false;
}
@Override
public void setReadListener(ReadListener listener) {
}
}
}