SSM---后端通过过滤器解决XSS攻击

红太狼 2023-07-23 13:56 0阅读 0赞

**XSS攻击**

**        攻击者通过前端页面恶意提交一些js代码，在数据回显的时候，这些js代码会被执行，可能造成数据泄露。前端可以校验XSS攻击，但不够彻底，攻击者可通过抓包工具进行数据篡改。后端通过过滤器来做XSS攻击校验能够彻底解决根源问题。**

**编写过滤器**

import javax.servlet.*;
    import javax.servlet.http.HttpServletRequest;
    import java.io.IOException;
    
    /**
     * DESC :  XSS攻击过滤器
     * @author Lonely
     *
     */
    public class XssFilter implements Filter {
        @Override
        public void init(FilterConfig filterConfig) throws ServletException {}
    
        @Override
        public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
            //使用包装器
            XssFilterWrapper xssFilterWrapper=new XssFilterWrapper((HttpServletRequest) servletRequest);
            filterChain.doFilter(xssFilterWrapper,servletResponse);
        }
    
        @Override
        public void destroy() {}
    }

import org.springframework.web.util.HtmlUtils;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletRequestWrapper;
    
    /**
     * XSS过滤逻辑
     * @author Lonely
     *
     */
    public class XssFilterWrapper extends HttpServletRequestWrapper {
    	public XssFilterWrapper(HttpServletRequest request) {
    		super(request);
    	}
    
    	/**
    	 * 对数组参数进行特殊字符过滤
    	 */
    	@Override
    	public String[] getParameterValues(String name) {
    		//过滤掉不拦截的
    		if ("articleData.content".equalsIgnoreCase(name)) {
    			return super.getParameterValues(name);
    		}
    
    		String[] values = super.getParameterValues(name);
    		if (values == null) {
    			return null;
    		}
    		String[] newValues = new String[values.length];
    		for (int i = 0; i < values.length; i++) {
    			newValues[i] = HtmlUtils.htmlEscape(values[i]);// spring的HtmlUtils进行转义
    		}
    		return newValues;
    	}
    }

**web.xml配置XSS过滤器**

<filter>
        <filter-name>XssFilter</filter-name>
        <filter-class>com.ssm.filter.XssFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>XssFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

**SpringBoot中也是一样的，通过过滤器解决XSS攻击问题**

[SpringBoot整合过滤器][SpringBoot]

[SpringBoot]: https://blog.csdn.net/qq_39115469/article/details/105325768