SpringBoot解决xss攻击问题--688IT编程网

SpringBoot解决xss攻击问题

⾃定义Filter

package com.stylefeng.sso.xss;

slf4j.Slf4j;

import org.apachemons.lang3.BooleanUtils;

import org.apachemons.lang3.StringUtils;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import t.annotation.Configuration;

import org.springframework.stereotype.Component;

import javax.servlet.*;

import javax.servlet.annotation.WebFilter;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.URLDecoder;

import java.util.ArrayList;

import java.util.HashMap;

import java.util.List;

import java.util.Map;

import Matcher;

import Pattern;

* 拦截防⽌xss注⼊

* 通过Jsoup过滤请求参数内的特定字符

@WebFilter(filterName = "xssFilter", urlPatterns = "/*", asyncSupported = true)

@Slf4j

@Configuration

@Component

public class XssFilter implements Filter {

private static Logger logger = Logger(XssFilter.class);

private static boolean IS_INCLUDE_RICH_TEXT = false;//是否过滤富⽂本内容

public List<String> excludes = new ArrayList<String>();

public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException,ServletException {

if(logger.isDebugEnabled()){

logger.debug("xss filter is open");

}

HttpServletRequest req = (HttpServletRequest) request;

HttpServletResponse resp = (HttpServletResponse) response;

if(handleExcludeURL(req, resp)){

filterChain.doFilter(request, response);

return;

}

//xss攻击过滤

Map<String, String[]> parameterMap = ParameterMap();

Map<String, String[]> map =new HashMap<>();

for (String s : parameterMap.keySet()) {

String[] arr = (s);

if(arr != null){

for (int i=0;i<arr.length;i++) {

//解码

logger.debug("解码前："+arr[i]);

String decode = URLDecoder.decode(arr[i], "UTF-8");

logger.debug("解码后"+decode);

arr[i]= xssEncode(decode);

// arr[i] = JsoupUtil.clean(decode);

logger.debug("转义后"+arr[i]);

}

map.put(s,arr);

}

XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest) request,IS_INCLUDE_RICH_TEXT); xssRequest.setParameterMap(parameterMap);

filterChain.doFilter(xssRequest, response);

}

private boolean handleExcludeURL(HttpServletRequest request, HttpServletResponse response) {

if (excludes == null || excludes.isEmpty()) {

return false;

}

String url = ServletPath();

for (String pattern : excludes) {

Pattern p = Patternpile("^" + pattern);

Matcher m = p.matcher(url);

if (m.find()) {

return true;

}

return false;

}

@Override

public void init(FilterConfig filterConfig) throws ServletException {

if(logger.isDebugEnabled()){

logger.debug("xss filter init~~~~~~~~~~~~");

}

String isIncludeRichText = InitParameter("isIncludeRichText"); if(StringUtils.isNotBlank(isIncludeRichText)){

IS_INCLUDE_RICH_TEXT = Boolean(isIncludeRichText); }

String temp = InitParameter("excludes");

if (temp != null) {

String[] url = temp.split(",");

for (int i = 0; url != null && i < url.length; i++) {

excludes.add(url[i]);

}

@Override

public void destroy() {}

/**

* 将容易引起xss漏洞的半⾓字符直接替换成全⾓字符

* @param s

* @return

private static String xssEncode(String s) {

if (s == null || "".equals(s)) {

return s;

}

StringBuilder sb = new StringBuilder(s.length() + 16);

for (int i = 0; i < s.length(); i++) {

char c = s.charAt(i);

switch (c) {

case '>':

sb.append('＞');// 全⾓⼤于号

break;

case '<':

sb.append('＜');// 全⾓⼩于号

break;

case '\'':

sb.append('‘');// 全⾓单引号

break;

case '\"':

sb.append('“');// 全⾓双引号

break;

case '&':

sb.append('＆');// 全⾓＆

break;

case '\\':

sb.append('＼');// 全⾓斜线

break;

case '/':

sb.append('／');// 全⾓斜线

break;

case '#':

sb.append('＃');// 全⾓井号

break;

case '(':

sb.append('（');// 全⾓(号

break;

case ')':

sb.append('）');// 全⾓)号

break;

default:

sb.append(c);

break;

}

String value = String());

return value;

}

/**

*过滤script脚本

* @param value

* @return

private static String stripXss(String value) {

if (StringUtils.isNotEmpty(value)) {

Pattern scriptPattern = Patternpile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);