jsp spring boot / cloud 使用filter防止xss
一.前言
xss(跨站脚本攻击)
跨站脚本攻击(cross site scripting)，为不和层叠样式表(cascading style sheets, css)的缩写混淆，故将跨站脚本攻击缩写为xss。恶意攻击者往web页面里插入恶意script代码，当用户浏览该页之时，嵌入其中web里面的script代码会被执行，从而达到恶意攻击用户的目的。
二.思路
基于filter拦截,将特殊字符替换为html转意字符 (如: "<" 转意为 "<") , 需要拦截的点如下:
- 请求头 requestheader
- 请求体 requestbody
- 请求参数 requestparameter
三.实现
1.创建xsshttpservletrequestwrapper类
在获取请求头,请求参数的这些地方,将目标值使用htmlutils.htmlescape方法转意为html字符,而避免恶意代码参与到后续的流程中
/**
* xsshttpservletrequestwrapper.java
* created at 2016-09-19
* created by wangkang
* copyright (c) 2016 egridcloud.com, all rights reserved.
*/
package com.egridcloud.udf.core.xss;
import javax.servlet.http.httpservletrequest;
import javax.servlet.http.httpservletrequestwrapper;
import org.springframework.web.util.htmlutils;
/**
* 描述 : 跨站请求防范
*
* @author wangkang
*
*/
public class xsshttpservletrequestwrapper extends httpservletrequestwrapper {
/**
* 描述 : 构造函数
*
* @param request 请求对象
*/
public xsshttpservletrequestwrapper(httpservletrequest request) {
super(request);
}
@override
public string getheader(string name) {
string value = super.getheader(name);
return htmlutils.htmlescape(value);
}
@override
public string getparameter(string name) {
string value = super.getparameter(name);
return htmlutils.htmlescape(value);
}
@override
public string[] getparametervalues(string name) {
string[] values = super.getparametervalues(name);
if (values != null) {
int length = values.length;
string[] escapsevalues = new string[length];
for (int i = 0; i < length; i++) {
escapsevalues[i] = htmlutils.htmlescape(values[i]);
}
return escapsevalues;
}
return super.getparametervalues(name);
}
}
2.创建xssstringjsonserializer类
其次是涉及到json转换的地方,也一样需要进行转意,比如,rerquestbody,responsebody
/**
* xssstringjsonserializer.java
* created at 2016-09-19
* created by wangkang
* copyright (c) 2016 egridcloud.com, all rights reserved.
*/
package com.egridcloud.udf.core.xss;
import java.io.ioexception;
import org.springframework.web.util.htmlutils;
import com.fasterxml.jackson.core.jsongenerator;
import com.fasterxml.jackson.databind.jsonserializer;
import com.fasterxml.jackson.databind.serializerprovider;
/**
* 描述 : 基于xss的jsonserializer
*
* @author wangkang
*
*/
public class xssstringjsonserializer extends jsonserializer<string> {
@override
public class<string> handledtype() {
return string.class;
}
@override
public void serialize(string value, jsongenerator jsongenerator,
serializerprovider serializerprovider) throws ioexception {
if (value != null) {
string encodedvalue = htmlutils.htmlescape(value);
jsongenerator.writestring(encodedvalue);
}
}
}
3.创建bean
在启动类中,创建xssobjectmapper的bean,替换spring boot原有的实例,用于整个系统的json转换.
/**
* 描述 : xssobjectmapper
*
* @param builder builder
* @return xssobjectmapper
*/
@bean
@primary
public objectmapper xssobjectmapper(jackson2objectmapperbuilder builder) {
//解析器
objectmapper objectmapper = builder.createxmlmapper(false).build();
//注册xss解析器
simplemodule xssmodule = new simplemodule("xssstringjsonserializer");
xssmodule.addserializer(new xssstringjsonserializer());
objectmapper.registermodule(xssmodule);
//返回
return objectmapper;
}
4.创建xssfilter
首先是拦截所有的请求,然后在dofilter方法中,将httpservletrequest强制类型转换成xsshttpservletrequestwrapper
然后传递下去.
/**
* xssfilter.java
* created at 2016-09-19
* created by wangkang
* copyright (c) 2016 egridcloud.com, all rights reserved.
*/
package com.egridcloud.udf.core.xss;
import java.io.ioexception;
import javax.servlet.filter;
import javax.servlet.filterchain;
import javax.servlet.filterconfig;
import javax.servlet.servletexception;
import javax.servlet.servletrequest;
import javax.servlet.servletresponse;
import javax.servlet.annotation.webfilter;
import javax.servlet.http.httpservletrequest;
import org.slf4j.logger;
import org.slf4j.loggerfactory;
/**
* 描述 : 跨站请求防范
*
* @author wangkang
*
*/
@webfilter(filtername = "xssfilter", urlpatterns = "/*", asyncsupported = true)
public class xssfilter implements filter {
/**
* 描述 : 日志
*/
private static final logger logger = loggerfactory.getlogger(xssfilter.class);
@override
public void init(filterconfig filterconfig) throws servletexception {
logger.debug("(xssfilter) initialize");
}
@override
public void dofilter(servletrequest request, servletresponse response, filterchain chain)
throws ioexception, servletexception {
xsshttpservletrequestwrapper xssrequest =
new xsshttpservletrequestwrapper((httpservletrequest) request);
chain.dofilter(xssrequest, response);
}
@override
public void destroy() {
logger.debug("(xssfilter) destroy");
}
}
四.结束
本文虽基于spring boot实现主题,但是思路是一致的,不限于任何框架.
感谢阅读，希望能帮助到大家，谢谢大家对本站的支持！
【说明】：本文章由站长整理发布，文章内容不代表本站观点，如文中有侵权行为，请与本站客服联系(QQ:254677821)！