spring-boot-plus XSS跨站腳本攻擊處理

XSS跨站腳本攻擊處理

XSS：Cross Site Scripting

• 跨站腳本攻擊（XSS），是目前最普遍的Web應用安全漏洞。這類漏洞能夠使得攻擊者嵌入惡意腳本代碼到正常用戶會訪問到的頁面中，當正常用戶訪問該頁面時，則可導致嵌入的惡意腳本代碼的執行，從而達到惡意攻擊用戶的目的。

處理方法

將參數中的特殊字符進行轉換

• 例如 input參數值，用戶輸入為：

<script>alert(1);</script>

• 處理后為：

<script>alert(1);</script>

后台處理

pom.xml依賴

使用 commons-text包中的StringEscapeUtils.escapeHtml4();方法

<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-text</artifactId>
    <version>1.8</version>
</dependency>

XssHttpServletRequestWrapper

對HttpServletRequest 對象的請求參數進行處理

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {

    public XssHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
    }

    @Override
    public String getQueryString() {
        String value = super.getQueryString();
        return StringEscapeUtils.escapeHtml4(value);
    }

    @Override
    public String getParameter(String name) {
        String value = super.getParameter(name);
        return StringEscapeUtils.escapeHtml4(value);
    }

    @Override
    public String[] getParameterValues(String name) {
        String[] values = super.getParameterValues(name);
        if (ArrayUtils.isEmpty(values)) {
            return values;
        }
        int length = values.length;
        String[] escapeValues = new String[length];
        for (int i = 0; i < length; i++) {
            String value = values[i];
            escapeValues[i] = StringEscapeUtils.escapeHtml4(value);
        }
        return escapeValues;
    }

}

XssFilter

使用WebFilter注解，攔截所有請求，過濾請求參數

@Slf4j
@WebFilter(filterName = "xssFilter", urlPatterns = "/*", asyncSupported = true)
public class XssFilter implements Filter {
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        XssHttpServletRequestWrapper xssHttpServletRequestWrapper = new XssHttpServletRequestWrapper(request);
        filterChain.doFilter(xssHttpServletRequestWrapper, servletResponse);
    }
}

啟動類添加@ServletComponentScan注解

掃描使用servlet注解的類，啟用 XssFilter

@ServletComponentScan

JSON字符串請求參數處理

實現Jackson反序列化方法，將參數值轉義處理

public class XssJacksonDeserializer extends JsonDeserializer<String> {

    @Override
    public String deserialize(JsonParser jsonParser, DeserializationContext deserializationContext) throws IOException, JsonProcessingException {
        return StringEscapeUtils.escapeHtml4(jsonParser.getText());
    }

}

JSON字符串響應結果處理

實現Jackson序列化方法，將參數值轉義處理

@Slf4j
public class XssJacksonSerializer extends JsonSerializer<String> {

    @Override
    public void serialize(String s, JsonGenerator jsonGenerator, SerializerProvider serializerProvider) throws IOException {
        jsonGenerator.writeString(StringEscapeUtils.escapeHtml4(s));
    }

}

重點，Jackson配置Xss

@Configuration
public class JacksonConfig implements WebMvcConfigurer {
    @Override
    public void extendMessageConverters(List<HttpMessageConverter<?>> converters) {
        // code...
        // XSS序列化
        simpleModule.addSerializer(String.class, new XssJacksonSerializer());
        simpleModule.addDeserializer(String.class, new XssJacksonDeserializer());
        // code...
    }
}

總結

實現字符串轉義的核心方法：

• org.apache.commons.text.StringEscapeUtils

StringEscapeUtils.escapeHtml4();