XSS抵御跨站脚本攻击

XSS抵御跨站脚本攻击

跨站脚本攻击（也称为XSS）指利用网站漏洞从用户那里恶意盗取信息。

解决的问题

本文主要解决提交到后台的内容存在js内容如：保存到数据库，再次查询时会出现弹出窗口的问题。

解决方式详解

1、自定义HttpServletRequestWrapper类，进行重写Request请求参数

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
    public XssHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
    }

    @Override
    public String getParameter(String name) {
        String value =  super.getParameter(name);
        if(!StrUtil.hasBlank(value)){
            value = HtmlUtil.filter(value);
        }
        return value;
    }

    @Override
    public String[] getParameterValues(String name) {
        String[] values = super.getParameterValues(name);
        if(values != null){
            for (int i = 0; i < values.length; i++) {
                String value =  values[i];
                if(!StrUtil.hasBlank(value)){
                    value = HtmlUtil.filter(value);
                }
                values[i] = value;
            }
        }
        return values;
    }

    @Override
    public Map<String, String[]> getParameterMap() {
        Map<String, String[]>  parameterMap = super.getParameterMap();
        LinkedHashMap<String, String[]> map = new LinkedHashMap();
        if(parameterMap != null){
            for (String key : parameterMap.keySet()){
                String[] values = parameterMap.get(key);
                for (int i = 0; i < values.length; i++) {
                    String value =  values[i];
                    if(!StrUtil.hasBlank(value)){
                        value = HtmlUtil.filter(value);
                    }
                    values[i] = value;
                }
                map.put(key,values);
            }
        }
        return map;
    }

    @Override
    public String getHeader(String name) {
        String value = super.getHeader(name);
        if(!StrUtil.hasBlank(value)){
            value = HtmlUtil.filter(value);
        }
        return value;
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {
        InputStream inputStream = super.getInputStream();
        InputStreamReader reader = new InputStreamReader(inputStream, Charset.forName("UTF-8"));
        BufferedReader bufferedReader = new BufferedReader(reader);
        StringBuffer res = new StringBuffer();
        String line = bufferedReader.readLine();
        while (line != null){
            res.append(line);
            line =  bufferedReader.readLine();
        }
        bufferedReader.close();
        reader.close();
        inputStream.close();

        Map<String,Object> map = JSONUtil.parseObj(res.toString());
        Map<String,Object> result = new LinkedHashMap<>();
        for (String key : map.keySet()){
            Object o = map.get(key);
            if(o instanceof String){
                if(!StrUtil.hasBlank(o.toString())){
                    result.put(key,HtmlUtil.filter(o.toString()));
                }
            }else {
                result.put(key,o);
            }
        }
        String json=JSONUtil.toJsonStr(result);
        ByteArrayInputStream bain=new ByteArrayInputStream(json.getBytes());
        return new ServletInputStream() {
            @Override
            public int read() throws IOException {
                return bain.read();
            }

            @Override
            public boolean isFinished() {
                return false;
            }

            @Override
            public boolean isReady() {
                return false;
            }

            @Override
            public void setReadListener(ReadListener readListener) {

            }
        };
    }
}

2、自定义Filter 拦截，并调用上面自定义的HttpServletRequestWrapper对Request请求参数进行重写

@WebFilter(urlPatterns = "/*")//拦截的请求路径
public class XssFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
    	//调用自定义的HttpServletRequestWrapper
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        XssHttpServletRequestWrapper xssHttpServletRequestWrapper = new XssHttpServletRequestWrapper(request);
        filterChain.doFilter(xssHttpServletRequestWrapper,servletResponse);
    }

    @Override
    public void destroy() {

    }
}

至此，对Request请求参数的重写已经完成。

---

青春短暂，我在路上