springboot基于filter防xss案例

野性酷女 2023-09-29 23:45 2阅读 0赞

## springboot防xss案例 ##

#### 一、引入freemaker依赖 ####

<dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-freemarker</artifactId>
            </dependency>

#### 二、开启freemaker支持 ####

spring:
      freemarker:
        #指定HttpServletRequest的属性是否可以覆盖controller的model的同名项
        allow-request-override: false
        #req访问request
        request-context-attribute: req
        #后缀名freemarker默认后缀为.ftl，当然你也可以改成自己习惯的.html
        suffix: .ftl
        #设置响应的内容类型
        content-type: text/html;charset=utf-8
        #是否允许mvc使用freemarker
        enabled: true
        #是否开启template caching
        cache: false
        #设定模板的加载路径，多个以逗号分隔，默认: [“classpath:/templates/”]
        template-loader-path: classpath:/templates/
        #设定Template的编码
        charset: UTF-8

#### 三、XssController ####

import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.RequestMapping;
    
    import javax.servlet.http.HttpServletRequest;
    
    @Controller
    @RequestMapping("/api/xss")
    public class XssController {
        
    
        @RequestMapping("/javascript")
        public String index(HttpServletRequest request) {
        
            request.setAttribute("info", request.getParameter("xss"));
    //        测试用例
    //       http://localhost:8080/api/xss/javascript?xss=<script type="text/javascript"> window.location.href="https://www.baidu.com/"; </script>
            return "testXss";
        }
    
    }

#### 四、过滤器 ####

import org.springframework.stereotype.Component;
    
    import javax.servlet.*;
    import javax.servlet.annotation.WebFilter;
    import javax.servlet.http.HttpServletRequest;
    import java.io.IOException;
    
    @Component
    @WebFilter(filterName = "XssFilter", urlPatterns = "/*")
    public class XssFilter implements Filter {
        
        @Override
        public void init(FilterConfig filterConfig) throws ServletException {
        
            Filter.super.init(filterConfig);
        }
    
        @Override
        public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        
            filterChain.doFilter(new XssHttpServletRequestWrapper((HttpServletRequest) servletRequest), servletResponse);
        }
    
        @Override
        public void destroy() {
        
            Filter.super.destroy();
        }
    
    }

*  自定义过滤规则

import org.springframework.util.StringUtils;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletRequestWrapper;
    
    public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
        
        public XssHttpServletRequestWrapper(HttpServletRequest request) {
        
            super(request);
        }
    
        @Override
        public String getParameter(String name) {
        
            String oldValue = super.getParameter(name);
            if (StringUtils.isEmpty(oldValue)) {
        
                return oldValue;
            }
    //         通过转义，来实现过滤js脚本
            String newValue = oldValue.replaceAll("<", "<").replaceAll(">", ">");
            return newValue;
        }
    }

#### 五、主类 ####

@SpringBootApplication
    @ServletComponentScan(basePackages = "com.example.springbootxss.filter")
    public class SpringbootXssApplication {
        
    
        public static void main(String[] args) {
        
            SpringApplication.run(SpringbootXssApplication.class, args);
        }
    
    }

#### 六、整体项目结构 ####

![在这里插入图片描述][c802ac12f13d4d9b89cb4bc70740eaa8.png]

[c802ac12f13d4d9b89cb4bc70740eaa8.png]: https://img-blog.csdnimg.cn/c802ac12f13d4d9b89cb4bc70740eaa8.png