【技术总结】使用Filter进行XSS过滤

爱被打了一巴掌 2023-06-14 04:24 1阅读 0赞

一般来说，系统进行表单数据处理时都需要解决类似XSS攻击以及转义这样的问题，这样的问题具有普遍性，不可能在每个提交表单数据的处理中都加入重复的处理代码。通常通过 Filter 或 Interceptor 来拦截处理。

这里介绍下通过 Filter 进行XSS过滤的方法。

![大致流程][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0NvZGVfc2hhZG93_size_16_color_FFFFFF_t_70]  
流程：使用Filter拦截请求，将普通请求转化为包装过的可以处理XSS的自定义请求，之后获取参数时都会经过XSS处理。

# 主要实现类： #

XssFilter

public class XssFilter implements Filter { 
    
        private static final String[] EXCLUDE_URIS = new String[] { 
                "/archivefiles/ajaxsimpleupload"// 上传全文
                , "/archivefiles/ajaxuploadannex"// 上传附件
                , "/importfilelist"// 导入文件
                , "/export"// 导出文件
        };
    
        @Override
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
                throws IOException, ServletException { 
            HttpServletRequest req = (HttpServletRequest) request;
            String reqURI = UrlUtils.getReqURI(req);
    
            // 默认是需要进行XSS过滤的，当请求为排除的URI时，替换为原来的request
            ServletRequest newRequest = new XsslHttpServletRequestWrapper((HttpServletRequest) request);
            for (String excludeUri : EXCLUDE_URIS) { 
                if (reqURI.contains(excludeUri)) { 
                    newRequest = request;
                    break;
                }
            }
            chain.doFilter(newRequest, response);
        }
    
        @Override
        public void init(FilterConfig filterConfig) { 
        }
    
        @Override
        public void destroy() { 
        }
    }

XssHttpServletRequestWrapper

/** * xss 通过重写参数获取方法实现. */
    public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { 
    
      HttpServletRequest xssRequest = null;
    
      public XsslHttpServletRequestWrapper(HttpServletRequest request) { 
        super(request);
        xssRequest = request;
      }
    
      @Override
      public String getParameter(String name) { 
        String value = super.getParameter(name);
        if (value != null) { 
          value = xssReplace(value);
        }
        return value;
      }
    
      @Override
      public String[] getParameterValues(String name) { 
        String[] values = super.getParameterValues(name);
        if (values != null && values.length > 0) { 
          for (int i = 0; i < values.length; i++) { 
            values[i] = xssReplace(values[i]);
          }
        }
        return values;
      }
    
      @Override
      public String getHeader(String name) { 
        String value = super.getHeader(name);
        if (value != null) { 
          value = xssReplace(value);
        }
        return value;
      }
    
      private String xssReplace(String value) { 
        String reslut = "";
        if (JacksonUtils.isJsonObjectOrJsonArray(value)) { 
          reslut = XssUtils.transferJson(value);
        } else { 
          // 对参数值进行过滤.
          reslut = XssUtils.xssReplace(value);
        }
        return reslut;
      }
    }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0NvZGVfc2hhZG93_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20191118163624244.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0NvZGVfc2hhZG93,size_16,color_FFFFFF,t_70