XSS存储型攻击的末日

最新推荐文章于 2024-10-11 17:18:00 发布

Ben_Y_Y

最新推荐文章于 2024-10-11 17:18:00 发布

阅读量655

点赞数

CC 4.0 BY-SA版权

分类专栏：漏洞修补文章标签： filter

本文链接：https://blog.youkuaiyun.com/Ben_Y_Y/article/details/52850705

漏洞修补专栏收录该内容

1 篇文章

订阅专栏

本文介绍了如何使用HttpCharacterResponseWrapper过滤响应中的恶意XSS存储型攻击。通过创建一个包装了HttpServletResponse的类，重写getWriter()方法，将输出内容捕获到CharArrayWriter中，从而在输出前进行安全检查或转换，以防止XSS攻击。在web.xml中配置XSSFilter，确保所有请求都经过过滤，增强了应用的安全性。

package com.mapabc.wzt.filter;

import java.io.FileInputStream;
import java.io.IOException;
import java.util.Properties;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import javax.servlet.http.HttpServletResponse;

public class XSSFilter implements Filter {

private String[] words;
private String encoding;
private FilterConfig config;
private Properties pp = new Properties();

/**
* @see Filter#init(FilterConfig)
*/
public void init(FilterConfig config) throws ServletException {
this.config = config;
// this.encoding = config.getInitParameter("pageEncoding");
this.words = new String[] { "<", ">","+", "@", "|", "&",
";", "%", "$", "\'", "\"", "," ,"script","document"};

String file = config.getInitParameter("file");

String realPath = config.getServletContext().getRealPath(file);
try {
// 加载非法词
pp.load(new FileInputStream(realPath));
} catch (IOException e) {
e.printStackTrace();
}
}

public String filter(String param) {
if (words != null && words.length > 0) {
for (int i = 0; i < words.length; i++) {
if (param != null) {
if (-1 != param.indexOf(words[i])) {
param = param.replaceAll(words[i], "*");
}
}
}
}
return param;

}

class HSRequest extends HttpServletRequestWrapper {
public HSRequest(HttpServletRequest HSRrequest) {
super(HSRrequest);
}

@Override
public String getParameter(String name) {
return filter(super.getRequest().getParameter(name));
}

@Override
public String[] getParameterValues(String name) {
System.out.println("%%%%%%%name:" + name);
String[] values = super.getRequest().getParameterValues(name);
for (int i = 0; i < values.length; i++) {
values[i] = filter(values[i]);
}
return values;
}
}

public void doFilter(ServletRequest req, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
encoding = config.getInitParameter("pageEncoding");
System.out.println("过滤前__@@@" + encoding + "@@@" + req);
ServletRequest request = null;
if (null != encoding) {
req.setCharacterEncoding(encoding);
response.setContentType("text/html; charset = " + encoding);
HttpServletRequest hsreq = (HttpServletRequest) req;
request = new HSRequest(hsreq);
System.out.println("过滤中*********"+request + "@@@@@@@@@@@@@");

}
chain.doFilter(request, response);
System.out.println("过滤后_@@@" + encoding + "@@@" + request);
HttpCharacterResponseWrapper res = new HttpCharacterResponseWrapper(
(HttpServletResponse) response);
String output = res.getCw().toString();
for (Object obj : pp.keySet()) {
String key = (String) obj;
output = output.replace(key, pp.getProperty(key));
}
// response.getWriter().print(output);
}

public void destroy() {
// this.words = null;
// this.encoding = null;
this.config = null;
}

}

另一个类作用于response

package com.mapabc.wzt.filter;

import java.io.CharArrayWriter;
import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServletResponseWrapper;

public class HttpCharacterResponseWrapper extends HttpServletResponseWrapper {
// 定义字符数组
private CharArrayWriter cw = new CharArrayWriter();

public HttpCharacterResponseWrapper(HttpServletResponse response) {
super(response);
}

@Override
public PrintWriter getWriter(){
PrintWriter writer = new PrintWriter(cw);
return writer;
}

public CharArrayWriter getCw() {
return cw;
}

}

web.xml中这样配置

<filter>
<filter-name>XSSFilter</filter-name>
<filter-class>com.mapabc.wzt.filter.XSSFilter</filter-class>
<init-param>
<param-name>file</param-name>
<param-value>/WEB-INF/file.txt</param-value>
</init-param>
<init-param>
<param-name>pageEncoding</param-name>
<param-value>GBK</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>XSSFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>