防止XSS Attack攻击的解决方案

本文主要是介绍防止XSS Attack攻击的解决方案，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

需求：

1.防止用户RequestBody里面数据包含XSS Attack代码

2.防止用户RequestURL地址中包含XSS Attack代码

解决方案及思路：

1.写个拦截器拦截用户请求，之后正则表达式去过滤RequestBody和RequestURL部分包含恶意攻击的代码。

2.具体代码如下


/*** Project Name: * File Name:SecurityFilter.java* Description: TODO* Copyright: Copyright (c) 2017 * Company:* * @author * @date Mar 19, 2019 4:01:44 PM* @version * @see* @since */import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.Reader;
import java.nio.charset.Charset;
import java.util.regex.Pattern;import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ReadListener;
import javax.servlet.ServletException;
import javax.servlet.ServletInputStream;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import javax.servlet.http.HttpServletResponse;import org.apache.commons.io.IOUtils;
import org.springframework.boot.web.servlet.ServletComponentScan;
import org.springframework.stereotype.Component;/*** ClassName: SecurityFilter Description: filter all request* * @author * @version* @see* @since*/
@Component
@ServletComponentScan
public class SecurityFilter implements Filter
{/*** Title: init Description:* * @param filterConfig* @throws ServletException*             (describe the param)* @see javax.servlet.Filter#init(javax.servlet.FilterConfig)*/@Overridepublic void init(FilterConfig filterConfig) throws ServletException{}/*** Title: doFilter Description:* * @param request* @param response* @param chain* @throws IOException* @throws ServletException*             (describe the param)* @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse,*      javax.servlet.FilterChain)*/@Overridepublic void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException{HttpServletRequest req = new XSSRequestWrapper((HttpServletRequest) request);HttpServletResponse resp = (HttpServletResponse) response;//clean xss attack code in reqeuest bodycleanRequestBody(req, resp);//clean xss attack code in request urlcleanRequsetUrl(req, resp, chain);}/*** Title: destroy Description:(describe the param)* * @see javax.servlet.Filter#destroy()*/@Overridepublic void destroy(){}public class XSSRequestWrapper extends HttpServletRequestWrapper{private final byte[] body;public XSSRequestWrapper(HttpServletRequest request) throws IOException{super(request);body = IOUtils.toString(request.getReader()).getBytes(Charset.forName("UTF-8"));}@Overridepublic BufferedReader getReader() throws IOException{return new BufferedReader(new InputStreamReader(getInputStream()));}@Overridepublic ServletInputStream getInputStream() throws IOException{final ByteArrayInputStream bais = new ByteArrayInputStream(body);return new ServletInputStream(){@Overridepublic int read() throws IOException{return bais.read();}@Overridepublic boolean isFinished(){return false;}@Overridepublic boolean isReady(){return false;}@Overridepublic void setReadListener(ReadListener listener){}};}}/*** * Title: stripXSS Description: replace potential xss attack code with ""* * @exception @see* @since {@inheritDoc}* @param value* @return*/private String stripXSS(String value){if (null != value && !value.isEmpty()){// Avoid anything between script tagsPattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE | Pattern.UNICODE_CASE);value = scriptPattern.matcher(value).replaceAll("");scriptPattern = Pattern.compile("src=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome </script> tagscriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");scriptPattern = Pattern.compile("alert\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.UNICODE_CASE);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome <script ...> tagscriptPattern = Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid eval(...) expressionsscriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid expression(...) expressions/** scriptPattern = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE |* Pattern.DOTALL); value = scriptPattern.matcher(value).replaceAll("");*/// Avoid javascript:... expressionsscriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid vbscript:... expressionsscriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid onload= expressionsscriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");}return value;}/*** * Title: cleanRequsetUrl Description: clean xss attack code of request url.* * @exception @see* @since {@inheritDoc}* @param req* @param resp* @param chain* @throws IOException* @throws ServletException*/private void cleanRequsetUrl(HttpServletRequest req, HttpServletResponse resp, FilterChain chain)throws IOException, ServletException{StringBuffer sb = new StringBuffer();String uri = req.getRequestURI();String queryString = req.getQueryString();String url = uri;if (null != queryString && !queryString.isEmpty()){url = sb.append(uri).append(SecurityConstants.QUESTION_MARK).append(queryString).toString();}String cleanUrl = stripXSS(url);if (null != cleanUrl && !cleanUrl.equals(url)){req.getRequestDispatcher(cleanUrl).forward(req, resp);}else{chain.doFilter(req, resp);}}/*** * Title: cleanRequestBody Description: clean XSS Attack code of request body* * @exception @see* @since {@inheritDoc}* @param req* @param resp* @throws IOException*/private String cleanRequestBody(HttpServletRequest req, HttpServletResponse resp) throws IOException{Reader reader = req.getReader();String payload = IOUtils.toString(reader);String body = stripXSS(payload);System.out.println("body is\n" + body);resp.getWriter().write(body);return body;}
}

遇到的问题：

1.The request was rejected because the URL was not normalized

原因：

1.1 是因为请求地址里面包含"//"

解决方案：

1.2 使用该方法获取请求地址：String uri = req.getRequestURI();而不用req.getRequestURL()。之后我们使用相对路径重新发一个请求即可：req.getRequestDispatcher(cleanUrl).forward(req, resp);

2.为什么不适用resp.sendRedirect(cleanUrl);

原因：

2.1 该方法一般情况下只能重新发一个GET请求，不能发POST或者PUT. 想用该方法发POST请求出去可以自己用JSP实现一个表格，较为麻烦。

解决方案：

用req.getRequestDispatcher(cleanUrl).forward(req, resp); 替换它。