使用Filter防止XSS攻击

最新推荐文章于 2025-04-22 14:29:39 发布

逆行者_168

最新推荐文章于 2025-04-22 14:29:39 发布

阅读量8.9k

点赞数 1

分类专栏： Web安全

本文链接：https://blog.youkuaiyun.com/lizehui_168/article/details/86485541

版权

Web安全专栏收录该内容

5 篇文章

订阅专栏

什么是XSS攻击？

XSS攻击使用Javascript脚本注入进行攻击

例如在表单中注入: <script>location.href='http://www.itmayiedu.com'</script>

注意：谷歌浏览器已经防止了XSS攻击，为了演示效果，最好使用火狐浏览器

解决方案？

使用Fileter过滤器过滤注入标签（将表单中的代码转义成HTML代码）

XSSFilter

public class XssFiterimplements Filter {

public void init(FilterConfigfilterConfig)throws ServletException {

}

public void doFilter(ServletRequestrequest, ServletResponseresponse, FilterChainchain)

throws IOException, ServletException {

HttpServletRequest req = (HttpServletRequest)request;

XssAndSqlHttpServletRequestWrapper xssRequestWrapper =new XssAndSqlHttpServletRequestWrapper(req);

chain.doFilter(xssRequestWrapper,response);

}

public void destroy() {

}

XssAndSqlHttpServletRequestWrapper

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import org.apache.commons.lang3.StringEscapeUtils;
import org.apache.commons.lang3.StringUtils;

/**
* 防止XSS攻击
*/
public class XssAndSqlHttpServletRequestWrapperextends HttpServletRequestWrapper {
HttpServletRequest request;
public XssAndSqlHttpServletRequestWrapper(HttpServletRequestrequest) {
super(request);
this.request =request;
}
@Override
public String getParameter(Stringname) {
String value =request.getParameter(name);
System.out.println("name:" +name + "," + value);
if (!StringUtils.isEmpty(value)) {
// 转换Html
value = StringEscapeUtils.escapeHtml4(value);
}
return value;
}
}

本节课用到maven坐标

<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-lang3</artifactId>
    <version>3.4</version>
</dependency>