XSS攻击预防

 

public class XssHttpServletRequestWrapper  extends HttpServletRequestWrapper {

 

HttpServletRequest orgRequest = null;

 

public XssHttpServletRequestWrapper(HttpServletRequest request) {

super(request);

orgRequest = request;

}

 

/**

* 覆盖getParameter方法，将参数名和参数值都做xss过滤。<br/>

* 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>

* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖

*/

@Override

public String getParameter(String name) {

String value = super.getParameter(stripXSS(name));

if (value != null) {

value = xssEncode(value);

value = stripXSS(value);

}

return value;

}

 

/**

* 覆盖getHeader方法，将参数名和参数值都做xss过滤。<br/>

* 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>

* getHeaderNames 也可能需要覆盖

*/

@Override

public String getHeader(String name) {

 

String value = super.getHeader(stripXSS(name));

if (value != null) {

value = stripXSS(value);

value = xssEncode(value);

}

return value;

}

 

/**

* 将容易引起xss漏洞的半角字符直接替换成全角字符

* 

* @param s

* @return

*/

private static String xssEncode(String s) {

if (s == null || s.isEmpty()) {

return s;

}

StringBuilder sb = new StringBuilder(s.length() + 16);

for (int i = 0; i < s.length(); i++) {

char c = s.charAt(i);

switch (c) {

/*case '>':

sb.append("＞");// 转义大于号

break;

case '<':

sb.append("＜");// 转义小于号

break;

case '\'':

sb.append("＇");// 转义单引号

break;

case '\"':

sb.append("＂");// 转义双引号

break;

case ';':

sb.append("；");// 转义&

break;*/

default:

sb.append(c);

break;

}

}

return sb.toString();

}

 

 

    private String stripXSS(String value) {  

        if (value != null) {  

            // Avoid anything between script tags  

            Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);  

            value = scriptPattern.matcher(value).replaceAll("");  

            // Avoid anything in a  

            // e­xpression  

            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll("");  

            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll("");  

            // Remove any lonesome </script> tag  

            scriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE);  

            value = scriptPattern.matcher(value).replaceAll("");  

            // Remove any lonesome <script ...> tag  

            scriptPattern = Pattern.compile("<script(.*?)>",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll("");  

            // Avoid eval(...) e­xpressions  

            scriptPattern = Pattern.compile("eval\\((.*?)\\)",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll("");  

            // Avoid e­xpression(...) e­xpressions  

            scriptPattern = Pattern.compile("e­xpression\\((.*?)\\)",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll("");  

            // Avoid javascript:... e­xpressions  

            scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);  

            value = scriptPattern.matcher(value).replaceAll("");  

            // Avoid vbscript:... e­xpressions  

            scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);  

            value = scriptPattern.matcher(value).replaceAll("");  

            // Avoid onload= e­xpressions  

            scriptPattern = Pattern.compile("onload(.*?)=",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll(""); 

            // Avoid alert() 

            scriptPattern = Pattern.compile("alert\\((.*?)\\)",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll(""); 

           // Avoid confirm() 

            scriptPattern = Pattern.compile("confirm\\((.*?)\\)",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll(""); 

           // Avoid prompt() 

            scriptPattern = Pattern.compile("prompt\\((.*?)\\)",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll(""); 

           // Avoid onfocus() 

            scriptPattern = Pattern.compile("onfocus\\((.*?)\\)",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll(""); 

           // Avoid onmouseover() 

            scriptPattern = Pattern.compile("onmouseover\\((.*?)\\)",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll("");

            // Avoid onerror() 

            scriptPattern = Pattern.compile("onerror\\((.*?)\\)",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll("");

            // Avoid xss() 

            scriptPattern = Pattern.compile("/xss/",  

                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);  

            value = scriptPattern.matcher(value).replaceAll("");

        }  

        return value;  

    }  

 

/**

* 获取最原始的request

* 

* @return

*/

public HttpServletRequest getOrgRequest() {

return orgRequest;

}

 

/**

* 获取最原始的request的静态方法

* 

* @return

*/

public static HttpServletRequest getOrgRequest(HttpServletRequest req) {

if (req instanceof XssHttpServletRequestWrapper) {

return ((XssHttpServletRequestWrapper) req).getOrgRequest();

}

 

return req;

}

 

}