如何通过重写HttpServletRequest参数获取方法有效预防XSS攻击？

本文共计529个文字，预计阅读时间需要3分钟。

java创建过滤器，处理异常和配置

java 过滤器

import java.io.IOException; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import com.soufun.wap.servlet.XSSRequestWrapper; public class SqlXssFilter implements Filter { private FilterConfig config = null; //配置文件（可以从 web中获取参数） @Override public void init(FilterConfig filterConfig) throws ServletException { this.config = filterConfig; } public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest req = (HttpServletRequest) request; //对不是 get请求和post 请求 进行拦截 if(!(req.getMethod().equalsIgnoreCase("get")||req.getMethod().equalsIgnoreCase("post"))) { // return; } chain.doFilter(new XSSRequestWrapper(req), response); //放行 } public void destroy() { } /** * 获取敏感字 * 在 web.xml 中获取获取敏感字符所在的路径 * 在把它变为流 读进集合里面 */ private List getDirtyWords(){ List dirtyWords = new ArrayList (); String dirtyWordPath = config.getInitParameter("dirtyWord"); //获取参数值 InputStream inputStream = config.getServletContext().getResourceAsStream(dirtyWordPath); //传入路径变为流 InputStreamReader is = null; try { is = new InputStreamReader(inputStream,"UTF-8"); //把流转换为utf-8编码 } catch (UnsupportedEncodingException e2) { e2.printStackTrace(); } BufferedReader reader = new BufferedReader(is); String line; try { while ((line = reader.readLine())!= null) {//如果 line为空说明读完了 dirtyWords.add(line); //把敏感字符丢进集合里面 } } catch (IOException e) { e.printStackTrace(); } return dirtyWords; } } 装饰着模式 重写httpservlet中的方法

import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; import org.apache.commons.lang.StringEscapeUtils; public class XSSRequestWrapper extends HttpServletRequestWrapper { public XSSRequestWrapper(HttpServletRequest servletRequest) { super(servletRequest); } /* *重写getParameterValues方法 */ @Override public String[] getParameterValues(String parameter) { String[] values = super.getParameterValues(parameter); //调用父类getParameterValues 获取原始值 if ("pageChildren".equals(parameter)) { //对原始值进行判断做出选择 return values; } if (values == null) { return null; } int count = values.length; String[] encodedValues = new String[count]; //创建一个字符数组 for (int i = 0; i < count; i++) { encodedValues[i] = stripXSS(values[i]); //循坏替换 值中的关键字 } return encodedValues; } /* *重写getParameter方法方法 */ @Override public String getParameter(String parameter) { String value = super.getParameter(parameter); //调用父类获取原始值 return stripXSS(value); //替换 } /* *对值中的关键字进行替换 */ private String stripXSS(String value) { if (null != value) { value = value.replaceAll("<", "<").replaceAll(">", ">"); value = value.replaceAll("\\(", "(").replaceAll("\\)", ")"); value = value.replaceAll("'", "'"); value = value.replaceAll("eval\\((.*)\\)", ""); value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\""); value = value.replaceAll("script", ""); value = StringEscapeUtils.escapeSql(value); } return value; } } web.xml

sqlXssFilter com.soufun.wap.filter.SqlXssFilter

dirtyWord

/WEB-INF/DirtyWord.txt sqlXssFilter /*