【SpringBoot XSS存储漏洞 拦截器】Java纯后端对于前台输入值的拦截校验实现 一个类加一个注解结束

2024-04-12 14:20
文章标签 java 实现 springboot 拦截 校验 输入 漏洞 spring 注解 存储 拦截器 前台 xss 结束 类加 纯后

本文主要是介绍【SpringBoot XSS存储漏洞 拦截器】Java纯后端对于前台输入值的拦截校验实现 一个类加一个注解结束，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

先看效果：

1.js注入拦截：
在这里插入图片描述

2.sql注入拦截

在这里插入图片描述

生效只需要两步：

1.创建Filter类，粘贴如下代码：

package cn.你的包命.filter;
import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.PrintWriter;
import java.util.*;
import java.util.regex.Pattern;
import javax.servlet.DispatcherType;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletInputStream;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import javax.servlet.http.HttpServletResponse;
import com.alibaba.fastjson.JSON;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.util.StreamUtils;
import org.springframework.util.StringUtils;/*** LX:XSS对输入值进行过滤，包括数据库关键词、js注入关键词*/
@WebFilter(filterName = "xssFilter",urlPatterns = "/*",dispatcherTypes = DispatcherType.REQUEST)
public class CrosXssFilter implements Filter {private static final Logger logger = LoggerFactory.getLogger(CrosXssFilter.class);private static final String xssMsg = "XssERROR 拦截:发现非法的输入值!";@Overridepublic void init(FilterConfig filterConfig) throws ServletException {}@Overridepublic void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {HttpServletRequest request = (HttpServletRequest) servletRequest;HttpServletResponse response = (HttpServletResponse) servletResponse;if(servletResponse instanceof HttpServletResponse){HttpServletResponse httpServletResponse=(HttpServletResponse)servletResponse;httpServletResponse.setHeader("Access-Control-Allow-Origin", "*");httpServletResponse.setHeader("Access-Control-Allow-Methods", "*");httpServletResponse.setHeader("Access-Control-Max-Age", "86400");httpServletResponse.setHeader("Access-Control-Allow-Headers", "*");}XssAndSqlHttpServletRequestWrapper xssRequest=new XssAndSqlHttpServletRequestWrapper(request);String method = ((HttpServletRequest) request).getMethod();String param = "";if ("POST".equalsIgnoreCase(method)) {param = this.getBodyString(xssRequest.getReader());if(StringUtils.hasText(param)){if(xssRequest.checkXSSAndSql(param)){response.setCharacterEncoding("UTF-8");response.setStatus(200);response.setContentType("application/json;charset=UTF-8");PrintWriter out = servletResponse.getWriter();Map res = new LinkedHashMap();res.put("status","0");res.put("msg",xssMsg);out.print(JSON.toJSON(res));out.flush();out.close();return;}}}if (xssRequest.checkParameter()) {response.setCharacterEncoding("UTF-8");response.setStatus(200);response.setContentType("application/json;charset=UTF-8");PrintWriter out = servletResponse.getWriter();Map res = new LinkedHashMap();res.put("status","0");res.put("msg",xssMsg);out.print(JSON.toJSON(res));out.flush();out.close();return;}filterChain.doFilter(xssRequest, servletResponse);}// 获取request请求body中参数public String getBodyString(BufferedReader br) {String inputLine;String str = "";try {while ((inputLine = br.readLine()) != null) {str += inputLine;}br.close();} catch (IOException e) {logger.error("IOException: " ,e);}return str;}@Overridepublic void destroy() {}private class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {private final Logger logger = LoggerFactory.getLogger(XssAndSqlHttpServletRequestWrapper.class);//在这里配置要防的词汇private String key = "insert|select|delete|drop|update|truncate";private Set<String> notAllowedKeyWords = new HashSet<String>(0);HttpServletRequest orgRequest = null;private Map<String, String[]> parameterMap;private final byte[] body; //用于保存读取body中数据public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException{super(request);orgRequest = request;parameterMap = request.getParameterMap();body = StreamUtils.copyToByteArray(request.getInputStream());String keyStr[] = key.split("\\|");for (String str : keyStr) {notAllowedKeyWords.add(str);}}@Overridepublic Enumeration<String> getParameterNames() {Vector<String> vector = new Vector<String>(parameterMap.keySet());return vector.elements();}/*** 参数值进行检查*/@Overridepublic String getParameter(String name) {String[] results = parameterMap.get(name);if (results == null || results.length == 0)return null;else {String value = results[0];if (value != null) {value = xssEncode(value);}return value;}}/*** 对于数组型的参数值进行检查*/@Overridepublic String[] getParameterValues(String name) {String[] results = parameterMap.get(name);if (results == null || results.length == 0)return null;else {int length = results.length;for (int i = 0; i < length; i++) {results[i] = xssEncode(results[i]);}return results;}}/*** 对参数名进行检查*/@Overridepublic String getHeader(String name) {String value = super.getHeader(xssEncode(name));if (value != null) {value = xssEncode(value);}return value;}/*** LX:在这儿，就可以防住有时候客户输入了单双引号，导致页面的js被截断的问题** @param s* @return*/private String xssEncode(String s) {if (s == null || s.isEmpty()) {return s;} else {s = stripXSSAndSql(s);}StringBuilder sb = new StringBuilder(s.length() + 16);for (int i = 0; i < s.length(); i++) {char c = s.charAt(i);switch (c) {case '\'':sb.append("＇");// 转义单引号break;case '\"':sb.append("＂");// 转义双引号break;case '&':sb.append("＆");// 转义&break;default:sb.append(c);break;}}return sb.toString();}public HttpServletRequest getOrgRequest() {return orgRequest;}@SuppressWarnings("unused")public HttpServletRequest getOrgRequest(HttpServletRequest req) {if (req instanceof XssAndSqlHttpServletRequestWrapper) {return ((XssAndSqlHttpServletRequestWrapper) req).getOrgRequest();}return req;}/**** 防止xss跨脚本攻击（替换，根据实际情况调整）*/public String stripXSSAndSql(String value) {if (value != null) {/** value = value.replaceAll("", ""); ***/Pattern scriptPattern = Pattern.compile("&lt;[\r\n| | ]*script[\r\n| | ]*&gt;(.*?)<!--[\r\n| | ]*script[\r\n| | ]*-->", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome  tagscriptPattern = Pattern.compile("<!--[\r\n| | ]*script[\r\n| | ]*-->", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome <script ...> tagscriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid eval(...) expressionsscriptPattern = Pattern.compile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid e-xpression(...) expressionsscriptPattern = Pattern.compile("e-xpression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid javascript:... expressionsscriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid vbscript:... expressionsscriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid οnlοad= expressionsscriptPattern = Pattern.compile("onload(.*?)=",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");}return value;}public boolean checkXSSAndSql(String value) {boolean flag = false;if (value != null) {// Avoid anything between script tagsPattern scriptPattern = Pattern.compile("<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid anything in a// src="http://www.yihaomen.com/article/java/..." type of// e-xpressionscriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Remove any lonesome </script> tagscriptPattern = Pattern.compile("<!--[\r\n| | ]*script[\r\n| | ]*-->", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Remove any lonesome <script ...> tagscriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid eval(...) expressionsscriptPattern = Pattern.compile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid e-xpression(...) expressionsscriptPattern = Pattern.compile("e-xpression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid javascript:... expressionsscriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid vbscript:... expressionsscriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid οnlοad= expressionsscriptPattern = Pattern.compile("onload(.*?)=",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}flag=checkSqlKeyWords(value);}return flag;}public boolean checkSqlKeyWords(String value){String paramValue = value.toLowerCase();//转成小写for (String keyword : notAllowedKeyWords) {if (paramValue.length() > keyword.length() + 4&& (paramValue.contains(" "+keyword)||paramValue.contains(keyword+" ")||paramValue.contains(" "+keyword+" "))) {logger.error(this.getRequestURI()+ "SQL参数中包含敏感词汇(" + keyword+ ")");return true;}}return false;}public final boolean checkParameter() {@SuppressWarnings({ "unchecked", "rawtypes" })Map<String, String[]> submitParams = new HashMap(parameterMap);Set<String> submitNames = submitParams.keySet();for (String submitName : submitNames) {Object submitValues = submitParams.get(submitName);if ((submitValues instanceof String)) {if (checkXSSAndSql((String) submitValues)) {return true;}} else if ((submitValues instanceof String[])) {for (String submitValue : (String[])submitValues){if (checkXSSAndSql(submitValue)) {return true;}}}}return false;}@Overridepublic BufferedReader getReader() throws IOException {return new BufferedReader(new InputStreamReader(getInputStream()));}@Overridepublic ServletInputStream getInputStream() throws IOException {final ByteArrayInputStream bais = new ByteArrayInputStream(body);return new ServletInputStream() {@Overridepublic int read() throws IOException {return bais.read();}};}}}

2.springboot启动类上加上扫描注解：

@ServletComponentScan

这篇关于【SpringBoot XSS存储漏洞 拦截器】Java纯后端对于前台输入值的拦截校验实现 一个类加一个注解结束的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！

原文地址:
本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.chinasem.cn/article/897373。

相关文章

SpringBoot应用中出现的Full GC问题的场景与解决

SpringBoot应用中出现的Full GC问题的场景与解决

《SpringBoot应用中出现的FullGC问题的场景与解决》这篇文章主要为大家详细介绍了SpringBoot应用中出现的FullGC问题的场景与解决方法,文中的示例代码讲解详细,感兴趣的小伙伴可... 目录Full GC的原理与触发条件原理触发条件对Spring Boot应用的影响示例代码优化建议结论F
阅读更多...
SpringRetry重试机制之@Retryable注解与重试策略详解

SpringRetry重试机制之@Retryable注解与重试策略详解

《SpringRetry重试机制之@Retryable注解与重试策略详解》本文将详细介绍SpringRetry的重试机制,特别是@Retryable注解的使用及各种重试策略的配置,帮助开发者构建更加健... 目录引言一、SpringRetry基础知识二、启用SpringRetry三、@Retryable注解
阅读更多...
springboot项目中常用的工具类和api详解

springboot项目中常用的工具类和api详解

《springboot项目中常用的工具类和api详解》在SpringBoot项目中,开发者通常会依赖一些工具类和API来简化开发、提高效率,以下是一些常用的工具类及其典型应用场景,涵盖Spring原生... 目录1. Spring Framework 自带工具类(1) StringUtils(2) Coll
阅读更多...
SpringValidation数据校验之约束注解与分组校验方式

SpringValidation数据校验之约束注解与分组校验方式

《SpringValidation数据校验之约束注解与分组校验方式》本文将深入探讨SpringValidation的核心功能,帮助开发者掌握约束注解的使用技巧和分组校验的高级应用,从而构建更加健壮和可... 目录引言一、Spring Validation基础架构1.1 jsR-380标准与Spring整合1
阅读更多...
openCV中KNN算法的实现

openCV中KNN算法的实现

《openCV中KNN算法的实现》KNN算法是一种简单且常用的分类算法,本文主要介绍了openCV中KNN算法的实现,文中通过示例代码介绍的非常详细,对大家的学习或者工作具有一定的参考学习价值,需要的... 目录KNN算法流程使用OpenCV实现KNNOpenCV 是一个开源的跨平台计算机视觉库，它提供了各
阅读更多...
SpringBoot条件注解核心作用与使用场景详解

SpringBoot条件注解核心作用与使用场景详解

《SpringBoot条件注解核心作用与使用场景详解》SpringBoot的条件注解为开发者提供了强大的动态配置能力,理解其原理和适用场景是构建灵活、可扩展应用的关键,本文将系统梳理所有常用的条件注... 目录引言一、条件注解的核心机制二、SpringBoot内置条件注解详解1、@ConditionalOn
阅读更多...
OpenCV图像形态学的实现

OpenCV图像形态学的实现

《OpenCV图像形态学的实现》本文主要介绍了OpenCV图像形态学的实现,包括腐蚀、膨胀、开运算、闭运算、梯度运算、顶帽运算和黑帽运算,文中通过示例代码介绍的非常详细,需要的朋友们下面随着小编来一起... 目录一、图像形态学简介二、腐蚀（Erosion）1. 原理2. OpenCV 实现三、膨胀China编程（
阅读更多...
通过Spring层面进行事务回滚的实现

通过Spring层面进行事务回滚的实现

《通过Spring层面进行事务回滚的实现》本文主要介绍了通过Spring层面进行事务回滚的实现,包括声明式事务和编程式事务,具有一定的参考价值,感兴趣的可以了解一下... 目录声明式事务回滚：1. 基础注解配置2. 指定回滚异常类型3. ​不回滚特殊场景编程式事务回滚：1. ​使用 TransactionT
阅读更多...
Android实现打开本地pdf文件的两种方式

Android实现打开本地pdf文件的两种方式

《Android实现打开本地pdf文件的两种方式》在现代应用中,PDF格式因其跨平台、稳定性好、展示内容一致等特点,在Android平台上,如何高效地打开本地PDF文件,不仅关系到用户体验,也直接影响... 目录一、项目概述二、相关知识2.1 PDF文件基本概述2.2 android 文件访问与存储权限2.
阅读更多...
使用Python实现全能手机虚拟键盘的示例代码

使用Python实现全能手机虚拟键盘的示例代码

《使用Python实现全能手机虚拟键盘的示例代码》在数字化办公时代,你是否遇到过这样的场景：会议室投影电脑突然键盘失灵、躺在沙发上想远程控制书房电脑、或者需要给长辈远程协助操作？今天我要分享的Pyth... 目录一、项目概述：不止于键盘的远程控制方案1.1 创新价值1.2 技术栈全景二、需求实现步骤一、需求
阅读更多...

Copyright China编程 23002807@qq.com

沪ICP备2023033072号-2