XSS攻击和跨站脚本安全漏洞防护

```java
 
<%
 
...
 
Statement stmt = conn.createStatement();
 
ResultSet rs = stmt.executeQuery("select * from users where id =" + id);
 
String address = null;
 
if (rs != null) {
 
rs.next();
 
address = rs.getString("address");
 
}
 
%>
 
家庭地址: <%= address %>
 
```

```java
 
<%
 
String name= request.getParameter("username"); %>
 
...
 
姓名: <%= name%>
 
...
 
```

2、请求过滤业务实现类

package com.hlframe.modules.frame.interceptor;
import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;
import java.util.Set;
 
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
 
import com.hlframe.modules.frame.utils.XSSUtils;
import org.springframework.util.StringUtils;
import org.springframework.web.multipart.MultipartHttpServletRequest;
import org.springframework.web.multipart.commons.CommonsMultipartResolver;
 
/**
 * 请求过滤业务实现类
 */
public class XssRequestWrappers extends HttpServletRequestWrapper{
 
    private CommonsMultipartResolver multiparResolver = new CommonsMultipartResolver();
 
    public XssRequestWrappers(HttpServletRequest request) {
        super(request);
 
        String type = request.getHeader("Content-Type");
        if (!StringUtils.isEmpty(type) && type.contains("multipart/form-data")) {
            MultipartHttpServletRequest multipartHttpServletRequest = multiparResolver.resolveMultipart(request);
            Map stringMap = multipartHttpServletRequest.getParameterMap();
            if (!stringMap.isEmpty()) {
                for (String key : stringMap.keySet()) {
                    String value = multipartHttpServletRequest.getParameter(key);
                    XSSUtils.striptXSS(key);
                    XSSUtils.striptXSS(value);
                }
            }
            super.setRequest(multipartHttpServletRequest);
        }
    }
 
    @Override
    public String[] getParameterValues(String parameter) {
        String[] values = super.getParameterValues(parameter);
        if (values == null) {
            return null;
        }
        int count = values.length;
        String[] encodedValues = new String[count];
        for (int i = 0; i < count; i++) {
            encodedValues[i] = XSSUtils.striptXSS(values[i]);
        }
        return encodedValues;
    }
 
    @Override
    public String getParameter(String parameter) {
        String value = super.getParameter(parameter);
        return XSSUtils.striptXSS(value);
    }
 
    @Override
    public String getHeader(String name) {
        String value = super.getHeader(name);
        return XSSUtils.striptXSS(value);
    }
 
    @Override
    public Map getParameterMap() {
        Map map1 = super.getParameterMap();
        Map escapseMap = new HashMap();
        Set keys = map1.keySet();
        for (String key : keys) {
            String[] valArr = map1.get(key);
            if (valArr != null && valArr.length > 0) {
                String[] escapseValArr = new String[valArr.length];
                for (int i = 0; i < valArr.length; i++) {
                    String escapseVal = XSSUtils.striptXSS(valArr[i]);
                    escapseValArr[i] = escapseVal;
                }
                escapseMap.put(key, escapseValArr);
            }
        }
 
        return escapseMap;
    }
 
}

 3、XSSFilter拦截类

package com.hlframe.modules.frame.interceptor;
import com.hlframe.modules.frame.utils.XSSUtils;
import org.springframework.stereotype.Component;
 
import java.io.IOException;
 
import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
 
/**
 * 存储型XSS、跨站脚本过滤器
 * @author zyw
 * @since 2022-09-01 20:09:31
 */
@Component
@WebFilter(filterName = "XSSFilter",
        /**
         * 通配符（*）表示对所有的web资源进行拦截
        */
        urlPatterns = "/*"
)
public class XSSFilter implements Filter  {
    @Override
    public void init(FilterConfig arg0) throws ServletException {
        System.out.println("初始化过滤器!");
    }
 
    @Override
    public void destroy() {
        System.out.println("销毁过滤器!");
    }
 
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        //过滤请求
//        chain.doFilter(new XssRequestWrappers((HttpServletRequest) request), response);
 
        //过滤返回
        ResponseWrapper wrapperResponse = new ResponseWrapper((HttpServletResponse)response);//转换成代理类
 
        chain.doFilter(new XssRequestWrappers((HttpServletRequest) request), wrapperResponse);
        byte[] content = wrapperResponse.getContent();//获取返回值
        //判断是否有值
        if (content.length > 0)
        {
 
            String str = new String(content, "UTF-8");
            System.out.println("返回值:" + str);
            String ciphertext = null;
 
            try
            {
                System.out.println("str = " + str);
                //......根据需要处理返回值
                ciphertext = XSSUtils.striptXSS(str);
                System.out.println("ciphertext = " + ciphertext);
 
 
            }
            catch (Exception e)
            {
                e.printStackTrace();
            }
            //把返回值输出到客户端
            ServletOutputStream out = response.getOutputStream();
            out.write(ciphertext.getBytes());
            out.flush();
        }
    }
 
}

4、返回值输出代理类

/**
 * 返回值输出代理类
 *
 * @Title: ResponseWrapper
 * @Description:
 * @author zyw
 * @date 9:52:11
 */
public class ResponseWrapper extends HttpServletResponseWrapper {
    private ByteArrayOutputStream buffer;
 
    private ServletOutputStream out;
 
    public ResponseWrapper(HttpServletResponse httpServletResponse)
    {
        super(httpServletResponse);
        buffer = new ByteArrayOutputStream();
        out = new WrapperOutputStream(buffer);
    }
 
    @Override
    public ServletOutputStream getOutputStream()
            throws IOException
    {
        return out;
    }
 
    @Override
    public void flushBuffer()
            throws IOException
    {
        if (out != null)
        {
            out.flush();
        }
    }
 
    public byte[] getContent()
            throws IOException
    {
        flushBuffer();
        return buffer.toByteArray();
    }
 
    class WrapperOutputStream extends ServletOutputStream
    {
        private ByteArrayOutputStream bos;
 
        public WrapperOutputStream(ByteArrayOutputStream bos)
        {
            this.bos = bos;
        }
 
        @Override
        public void write(int b)
                throws IOException
        {
            bos.write(b);
        }
 
        @Override
        public boolean isReady()
        {
 
            // TODO Auto-generated method stub
            return false;
 
        }
 
        @Override
        public void setWriteListener(WriteListener arg0)
        {
 
            // TODO Auto-generated method stub
 
        }
    }

注意：SpingBoot3.0.0之前旧版本不支持通过正则表达式对响应进行过滤

此时可以通过String类中的各种方法直接对响应或请求中的内容进行修改

package com.hlframe.modules.frame.utils;
 
import java.util.regex.Pattern;
 
/**
 * 跨站脚本和存储型XSS攻击防御工具类
 * @author zyw
 * @date 16:52:11
 */
public class XSSUtils {
    
    public static String striptXSS(String value) {
        if (value != null) {
 
            value = value.replaceAll("", "");
            value = value.replace('<',' ');
            value = value.replace('>',' ');
 
        }
 
        return value;
    }
 
 
}