記一次JAVA WEB項目解決XSS攻擊的辦法(親測有效)

• 什么是XSS攻擊

　　　　簡單來說,XSS 攻擊是頁面被注入了惡意的代碼,度娘一大堆的東西,不想說

• 系統架構主要是SSM框架,服務層另外使用了DubboX.

　　　  為啥說這個,因為SpringMVC對於Xss攻擊需要特殊處理

• 思路　　

　　　　其實XSS工具解決思路就是捕獲客戶端提交的參數進行捕獲,然后對參數值進行過濾處理,去除那些非法的字符.

　　　　但是請求通常分為GET請求與POST請求,針對不同的請求,處理方式是不一樣的

• 步驟:

　　　　1.針對GET與非文件格式上傳的post請求.(form 表單提交的時候 沒有這個參數enctype="multipart/form-data"),JSON請求等

1) web.xml配置過濾器

<!-- xxs過濾 --> 
<filter> 
    <filter-name>XssSqlFilter</filter-name> 
    <filter-class>cn.ffcs.web.filter.XssFilter</filter-class> 
</filter> 
<filter-mapping> 
    <filter-name>XssSqlFilter</filter-name> 
    <url-pattern>/*</url-pattern> 
    <dispatcher>REQUEST</dispatcher> 
</filter-mapping> 

2)過濾器實現 XssFilter.java,針對部分特殊請求,要求不走過濾的,可以在此過濾器中放行

package cn.ffcs.web.filter;

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.filter.OncePerRequestFilter;

public class XssFilter extends OncePerRequestFilter {
     private final Logger logger = LoggerFactory.getLogger(this.getClass());
     @Override
        protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
                throws ServletException, IOException {
            try {
                String uri = request.getRequestURI();
                //特殊url不走過濾器
                if (uri.contains("receipt") || uri.contains("mobile/buildingMgr")
                         || uri.contains("bestPay") || uri.contains("backNotify") || uri.contains("frontNotify")
                         || uri.contains("queryOrder") || uri.contains("refundNotify") || uri.contains("refund")
                         || uri.contains("reverse")) {
                    chain.doFilter(request, response);
                } else {
                    XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest) request);
                    chain.doFilter(xssRequest, response);
                }
            } catch (Exception e) {
                logger.error("Xss過濾器，包裝request對象失敗");
                chain.doFilter(request, response);
            }                
        }
}

3) XssHttpServletRequestWrapper

package cn.ffcs.web.filter;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {

    HttpServletRequest orgRequest = null;
     
    public XssHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
        orgRequest = request;
    }
 
    /**
     * 覆蓋getParameter方法，將參數名和參數值都做xss過濾
     */
    @Override
    public String getParameter(String name) {
        String value = super.getParameter(xssEncode(name));
        if (value != null) {
            value = xssEncode(value);
        }
        return value;
    }
    /**
     * 覆蓋getParameterValues方法，將參數名和參數值都做xss過濾
     */
    public String[] getParameterValues(String parameter) {
        String[] values = super.getParameterValues(parameter);
        if (values==null)  {
            return null;
        }
        int count = values.length;
        String[] encodedValues = new String[count];
        for (int i = 0; i < count; i++) {
            encodedValues[i] = xssEncode(values[i]);
        }
        return encodedValues;
    }
    
    /**
     * 獲取request的屬性時，做xss過濾
     */
     @Override
    public Object getAttribute(String name) {
        Object value = super.getAttribute(name);
        if (null != value && value instanceof String) {
            value = xssEncode((String) value);
        }
        return value;
    };
    
    /**
     * 覆蓋getHeader方法，將參數名和參數值都做xss過濾。<br/>
     */
    @Override
    public String getHeader(String name) {
        String value = super.getHeader(xssEncode(name));
        if (value != null) {
            value = xssEncode(value);
        }
        return value;
    }
    
    
    /**
     * 將容易引起xss漏洞的半角字符直接替換成全角字符
     * 
     * @param s
     * @return
     */
    private static String xssEncode(String s) {
        return XssEncode.xssEncode(s);
    }
 
    /**
     * 獲取最原始的request
     * 
     * @return
     */
    public HttpServletRequest getOrgRequest() {
        return orgRequest;
    }
 
    /**
     * 獲取最原始的request的靜態方法
     * 
     * @return
     */
    public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
        if (req instanceof XssHttpServletRequestWrapper) {
            return ((XssHttpServletRequestWrapper) req).getOrgRequest();
        }
 
        return req;
    }
    

}

4) 使用到的編碼工具,過濾參數使用了xss-html-filter工具,具體可以自行替換

package cn.ffcs.web.filter;

import net.sf.xsshtmlfilter.HTMLFilter;

public class XssEncode {
    public static String xssEncode(String s) {
        if (s == null || s.isEmpty()) {
            return s;
        }
        try {
            HTMLFilter htmlFilter = new HTMLFilter();
            String clean = htmlFilter.filter(s);
            return clean;
        } catch (NullPointerException e) {
            return s;
        } catch (Exception ex) {
            ex.printStackTrace();
        }
 
        return null;
    }
}

5) pom.xml 配置引用的jar

<dependency>
       <groupId>net.sf.xss-html-filter</groupId>
       <artifactId>xss-html-filter</artifactId>
       <version>1.5</version> 
</dependency>

　　　　2.針對enctype="multipart/form-data"格式的post提交

1) 更改springMVC默認Annotation適配器(org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter - ->    cn.ffcs.web.filter.XssAnnotationMethodHandlerAdapter),如果沒有則添加

<!-- annotation方法修飾器 -->
<bean id="handlerAdapter" class="cn.ffcs.web.filter.XssAnnotationMethodHandlerAdapter">

....

<bean>

2) 繼承AnnotationMethodHandlerAdapter 並覆蓋handle方法

package cn.ffcs.web.filter;

import java.util.Map;
import java.util.Set;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import net.sf.xsshtmlfilter.HTMLFilter;

import org.apache.commons.lang.StringUtils;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter;
@SuppressWarnings("deprecation")
public class XssAnnotationMethodHandlerAdapter extends
        AnnotationMethodHandlerAdapter {
    
    
    @SuppressWarnings({ "rawtypes", "unchecked" })
    private void myXss(HttpServletRequest request){
        Map map = request.getParameterMap();
        Set<String> keySet = map.keySet();
        for(String key : keySet){
            String[] values = request.getParameterValues(key);
            if(values!=null&&values.length>0){
                for(int i=0 ;i<values.length;i++){
                    if(!StringUtils.isBlank(values[i])){
                        values[i] = XssEncode.xssEncode(values[i]);
                    }
                }
            }
        }
    }
    
    @Override
    public ModelAndView handle(HttpServletRequest request,
            HttpServletResponse response, Object handler) throws Exception {
        myXss(request);
        return super.handle(request, response, handler);
    }
}

 

tip: 網上另外有說用反射實現帶@Controller的控制器,感覺思路可以,但是沒有成功.