Spring boot 添加 XssFilter过滤器(接口必须是Json入参格式)

第一步部分代码： XSS_ERROR(90006, “入参含有非法字符”)

@Component
@Slf4j
@WebFilter(filterName = "xssFilter", urlPatterns = "/*")
@Order(5)
public class XssFilter implements Filter {

    private static final String SCRIPT_LOW_REGEX = ".*((((\\%3C)|<)[^\\n]+((\\%3E)|>))|(((\\%22)|"|(\\%27)|')[(\\%20) ]*((\\%2B)|\\+|(\\%3B)|;))|(((\\%3D)|=)[(\\%20) ]*((\\%22)|"|(\\%27)|'))).*";
    private static final String SCRIPT_UPPER_REGEX = ".*((((\\％3C)|<)[^\\n]+((\\％3E)|>))|(((\\％22)|"|(\\％27)|')[(\\％20) ]*((\\％2B)|\\+|(\\％3B)|;))|(((\\％3D)|=)[(\\％20) ]*((\\％22)|"|(\\％27)|'))).*";
    private static final String SQL_REGEX = ".*((\\%27)|(\\')).*((\\-\\-)|(((\\%6F)|o|(\\%4F))((\\%72)|r|(\\%52)))|((\\%3B)|(;))).*";
    private static final String NOT_PROTECT = "/undefined$";

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }
@Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        System.out.println("*************执行过滤xssFilter******");
        HttpServletResponse res = (HttpServletResponse) servletResponse;
        res.setCharacterEncoding("UTF-8");
        res.setContentType("application/json; charset=utf-8");
        HttpServletRequest request ;
        if (servletRequest instanceof HttpServletRequest) {
            request = new XssHttpServletRequestWrapper((HttpServletRequest) servletRequest);
        } else {
            filterChain.doFilter(servletRequest, servletResponse);
            return;
        }

        //是否合法 ：true 合法，false 不合法
        boolean isLegal = checkParams(request) ;
        String url = request.getRequestURI();
        log.info("-----------XssFilter ---- 接口{}是否合法：{}",url,isLegal);
        final Pattern notProject = Pattern.compile(NOT_PROTECT);
        if (!notProject.matcher(url).find()) {
            if (!isLegal) {
                PrintWriter writer = null;
                try {
                    writer = res.getWriter();
                    String resultVal = JSON.toJSONString(ApiRes.getInstance(ResultEnum.XSS_ERROR));
                    writer.write(resultVal);
                    writer.flush();
                    writer.close();
                } catch (Exception e) {
                    log.error("AuthPathFilter Error" + e.getMessage(), e);
                } finally {
                    if (null != writer) {
                        writer.close();
                    }
                }
                return;
            }
        }
        filterChain.doFilter(request, servletResponse);
        return;
    }

    @Override
    public void destroy() {

    }

    /**
     * 校验入参是否含有特殊字符
     * @param request
     * @return
     */
    private boolean checkParams(HttpServletRequest request) {
        Pattern scriptLowRegex = Pattern.compile(SCRIPT_LOW_REGEX);
        Pattern sqlRegex = Pattern.compile(SQL_REGEX);
        Pattern scriptUpperRegex = Pattern.compile(SCRIPT_UPPER_REGEX);

        try (BufferedReader streamReader = new BufferedReader(new InputStreamReader(request.getInputStream(), "UTF-8"))){
            StringBuilder responseStrBuilder = new StringBuilder();
            String inputStr;
            while ((inputStr = streamReader.readLine()) != null) {
                responseStrBuilder.append(inputStr);
            }
            String jString = responseStrBuilder.toString();
            //组装成数组
            if (jString.indexOf("[") ==  -1) {
                jString = "["+jString+"]";
            }
            if (StringUtils.isNotBlank(jString)) {
                boolean valid = isJSONValid(jString);
                if (valid) {
                    JSONArray jsonArray = JSONArray.parseArray(jString);
                    for (int i = 0; i < jsonArray.size() ; i++) {
                        JSONObject jsonObject = jsonArray.getJSONObject(i);
                        Iterator<Map.Entry<String, Object>> iterator = jsonObject.entrySet().iterator();
                        while (iterator.hasNext()) {
                            Map.Entry<String, Object> next = iterator.next();
                            if (!Objects.isNull(next.getValue())) {
                                String value = next.getValue().toString();
                                String paraValue = value.toUpperCase();
                                paraValue = replaceStr(paraValue);
                                if (scriptLowRegex.matcher(paraValue).matches()|| sqlRegex.matcher(paraValue).matches() || scriptUpperRegex.matcher(paraValue).matches()) {
                                    return false;
                                }
                            }
                        }
                    }
                }
            }

        } catch (IOException io) {
            io.printStackTrace();
            log.error("参数解析错误", io);
        }
        return true;
    }

    /**
     * 判断字符串是否满足json格式
     * @param jsonInString
     * @return
     */
    private boolean isJSONValid(String jsonInString) {
        try {
            final ObjectMapper mapper = new ObjectMapper();
            mapper.readTree(jsonInString);
            return true;
        } catch (IOException e) {
            return false;
        }
    }

    /**
     * 转义字符
     * @param value
     * @return
     */
    private String replaceStr(String value) {
        value = value.replace("+", "％2B")
                //.replace("/", "％2F")
                .replace("?", "％3F")
                .replace("%", "％25")
                .replace("#", "％23")
                .replace("&", "％26")
                .replace("=", "％3D")
                .replace("@", "％40")
                .replace(":", "％3A")
                .replace(";", "％3B")
                .replace("<", "％3C")
                .replace(">", "％3E")
                .replace("\\", "％5C")
                .replace("|", "％7C")
                .replace("$", "％24")
                .replace("^", "％5E")
                .replace(",", "％2C")
                .replace("'", "％27")
                .replace("=", "％3D")
                .replace("[", "％5B")
                .replace("]", "％5D")
                .replace("{", "％7B")
                .replace("}", "％7D")
                .replace("\"", "％22");
        return value;
    }
}

第二部分代码：

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {

    private final byte[] bytes;

    /**
     * Constructs a request object wrapping the given request.
     *
     * @param request The request to wrap
     * @throws IllegalArgumentException if the request is null
     */
    public XssHttpServletRequestWrapper(HttpServletRequest request) throws IOException {
        super(request);
        // 读取输入流里的请求参数，并保存到bytes里
        bytes = IOUtils.toByteArray(request.getInputStream());

    }
    @Override
    public ServletInputStream getInputStream() throws IOException {
        return new BufferedServletInputStream(this.bytes);
    }

    class BufferedServletInputStream extends ServletInputStream {
        private ByteArrayInputStream inputStream;
        public BufferedServletInputStream(byte[] buffer) {
            //此处即赋能，可以详细查看ByteArrayInputStream的该构造函数；
            this.inputStream = new ByteArrayInputStream( buffer );
        }
        @Override
        public int available() throws IOException {
            return inputStream.available();
        }
        @Override
        public int read() throws IOException {
            return inputStream.read();
        }
        @Override
        public int read(byte[] b, int off, int len) throws IOException {
            return inputStream.read( b, off, len );
        }

        @Override
        public boolean isFinished() {
            return false;
        }

        @Override
        public boolean isReady() {
            return false;
        }

        @Override
        public void setReadListener(ReadListener listener) {

        }
    }
}