WEB安全實戰--XSS 攻擊的解決方案（一）

首先，項目中需要引入 xssProtect-0.1.jar、antlr-3.0.1.jar、antlr-runtime-3.0.1.jar 等3個 jar 包。

然后，封裝 request，代碼如下。

public class NewXssHttpServletRequestWrapper extends HttpServletRequestWrapper {  
      
        HttpServletRequest orgRequest = null;  
          
        public NewXssHttpServletRequestWrapper(HttpServletRequest request) {  
            super(request);  
            orgRequest = request;  
        }  
          
      
        /** 
         * 覆蓋getParameter方法，將參數名和參數值都做xss過濾。<br/> 
         * 如果需要獲得原始的值，則通過super.getParameterValues(name)來獲取<br/> 
         * getParameterNames,getParameterValues和getParameterMap也可能需要覆蓋 
         */  
        @Override  
        public String getParameter(String name)  
        {  
            System.out.println("NewXssFilter處理前的 Value = " + super.getParameterValues(name));  
              
            String value = super.getParameter(xssEncode(name));  
            if (value != null)  
            {  
                value = xssEncode(value);  
            }  
              
            System.out.println("NewXssFilter處理后的 Value = " + value);  
              
            return value;  
        }  
      
        /** 
         * 覆蓋getHeader方法，將參數名和參數值都做xss過濾。<br/> 
         * 如果需要獲得原始的值，則通過super.getHeaders(name)來獲取<br/> getHeaderNames 也可能需要覆蓋 
         */  
        @Override  
        public String getHeader(String name)  
        {  
      
            String value = super.getHeader(xssEncode(name));  
            if (value != null)  
            {  
                value = xssEncode(value);  
            }  
            return value;  
        }  
      
        /** 
         * 將容易引起xss漏洞的半角字符直接替換成全角字符 
         *  
         * @param s 
         * @return 
         */  
        private static String xssEncode(String s)  
        {  
            if (s == null || s.isEmpty())  
            {  
                return s;  
            }  
              
            StringReader reader = new StringReader( s );  
            StringWriter writer = new StringWriter();  
            try {  
                HTMLParser.process( reader, writer, new XSSFilter(), true );  
                  
                return writer.toString();  
            }   
            catch (NullPointerException e) {  
                return s;  
            }  
            catch(Exception ex)  
            {  
                ex.printStackTrace();  
            }  
              
            return null;  
              
        }  
      
        /** 
         * 獲取最原始的request 
         *  
         * @return 
         */  
        public HttpServletRequest getOrgRequest()  
        {  
            return orgRequest;  
        }  
      
        /** 
         * 獲取最原始的request的靜態方法 
         *  
         * @return 
         */  
        public static HttpServletRequest getOrgRequest(HttpServletRequest req)  
        {  
            if (req instanceof NewXssHttpServletRequestWrapper)  
            {  
                return ((NewXssHttpServletRequestWrapper) req).getOrgRequest();  
            }  
      
            return req;  
        }  
      
    }

創建過濾器 NewXssFilter

public class NewXssFilter implements Filter {  
  
    FilterConfig filterConfig = null;  
  
    @Override  
    public void destroy() {  
        this.filterConfig = null;  
    }  
  
    @Override  
    public void doFilter(ServletRequest request, ServletResponse response,  
            FilterChain chain) throws IOException, ServletException {  
        String path = ((HttpServletRequest) request).getContextPath();  
        String basePath = request.getScheme() + "://" + request.getServerName()  
                + ":" + request.getServerPort() + path + "/";  
  
        // HTTP 頭設置 Referer過濾  
        String referer = ((HttpServletRequest) request).getHeader("Referer"); // REFRESH  
        if (referer != null && referer.indexOf(basePath) < 0) {  
            ((HttpServletRequest) request).getRequestDispatcher(  
                    ((HttpServletRequest) request).getRequestURI()).forward(  
                    ((HttpServletRequest) request), response);  
            System.out.println("referer不為空，referer >>>>>>>>>>>>>> " + referer);  
        }  
        NewXssHttpServletRequestWrapper xssRequest = new NewXssHttpServletRequestWrapper((HttpServletRequest) request);  
        chain.doFilter(xssRequest, response);  
    }  
  
    @Override  
    public void init(FilterConfig filterConfig) throws ServletException {  
        this.filterConfig = filterConfig;  
    }  
  
}

在 web.xml 中配置過濾器

 

<filter>  
    <filter-name>XssSqlFilter</filter-name>  
    <filter-class>com.***.web.common.NewXssFilter</filter-class>  
</filter>  
<filter-mapping>  
    <filter-name>XssSqlFilter</filter-name>  
    <url-pattern>/*</url-pattern>  
    <dispatcher>REQUEST</dispatcher>  
</filter-mapping>