重写HttpServletRequest的获取参数防止xss攻击代码,Java代码库,德仔网

代码语言
代码分类
【Java】重写HttpServletRequest的获取参数防止xss攻击
作者:天远 / 发布于2017/10/12/ 1070
java 过滤器
import java.io.IOException;
 
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
 
import com.soufun.wap.servlet.XSSRequestWrapper;
 
public class SqlXssFilter implements Filter {
 
    private FilterConfig config = null;    //配置文件（可以从 web中获取参数）
    
   @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        this.config = filterConfig;
    }
 
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
       //对不是 get请求和post 请求 进行拦截
      if(!(req.getMethod().equalsIgnoreCase("get")||req.getMethod().equalsIgnoreCase("post"))) {  //
			return;
	  }
        chain.doFilter(new XSSRequestWrapper(req), response); //放行
    }
 
    public void destroy() {
    }

    /**
     *  获取敏感字
     *  在 web.xml 中获取获取敏感字符所在的路径
     *  在把它变为流 读进集合里面
     */
    private List<String> getDirtyWords(){
        List<String> dirtyWords = new ArrayList<String>();
        String dirtyWordPath = config.getInitParameter("dirtyWord");  //获取参数值
        InputStream inputStream = config.getServletContext().getResourceAsStream(dirtyWordPath); //传入路径变为流
        InputStreamReader is = null;
        try {
            is = new InputStreamReader(inputStream,"UTF-8");   //把流转换为utf-8编码
        } catch (UnsupportedEncodingException e2) {
            e2.printStackTrace();
        }
        BufferedReader reader = new BufferedReader(is);
        String line;
        try {
            while ((line = reader.readLine())!= null) {//如果 line为空说明读完了
                dirtyWords.add(line);  //把敏感字符丢进集合里面
            }
        } catch (IOException e) {
            e.printStackTrace();
        } 
        return dirtyWords;
    }



}

装饰着模式 重写httpservlet中的方法
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
 
import org.apache.commons.lang.StringEscapeUtils;
 
public class XSSRequestWrapper extends HttpServletRequestWrapper {
    public XSSRequestWrapper(HttpServletRequest servletRequest) {
        super(servletRequest);
    }
 
    /*
     *重写getParameterValues方法
     */
    @Override
    public String[] getParameterValues(String parameter) {
        String[] values = super.getParameterValues(parameter);  //调用父类getParameterValues 获取原始值
        if ("pageChildren".equals(parameter)) {      //对原始值进行判断做出选择
            return values;
        }
        if (values == null) {
            return null;
        }
        int count = values.length;
        String[] encodedValues = new String[count];  //创建一个字符数组
        for (int i = 0; i < count; i++) {
            encodedValues[i] = stripXSS(values[i]);   //循坏替换 值中的关键字
        }
        return encodedValues;
    }
 
     /* 
      *重写getParameter方法方法
      */
    @Override
    public String getParameter(String parameter) {
        String value = super.getParameter(parameter);  //调用父类获取原始值
        return stripXSS(value); //替换
    }
    
    /*
     *对值中的关键字进行替换
     */
    private String stripXSS(String value) {
        if (null != value) {
            value = value.replaceAll("<", "<").replaceAll(">", ">");
            value = value.replaceAll("\\(", "(").replaceAll("\\)", ")");
            value = value.replaceAll("'", "'");
            value = value.replaceAll("eval\\((.*)\\)", "");
            value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
            value = value.replaceAll("script", "");
            value = StringEscapeUtils.escapeSql(value);
        }
        return value;
    }
}

web.xml

<filter>
    <filter-name>sqlXssFilter</filter-name>
    <filter-class>com.soufun.wap.filter.SqlXssFilter</filter-class>
    <!-- 配置要过滤的敏感字符文件 -->
      <init-param>
         <param-name>dirtyWord</param-name>    
         <param-value>/WEB-INF/DirtyWord.txt</param-value>
    </init-param>
</filter>

<filter-mapping>
    <filter-name>sqlXssFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
试试其它关键字
同语言下
可能有用的
天远贡献的其它代码(16)