web项目配置防止跨站点请求(XSS攻击)的过滤器

一、Microsoft Windows MHTML （XSS）跨站点脚本编制漏洞描述

XSS(Cross Site Scripting)，即跨站脚本攻击，是一种常见于web项目中的计算机安全漏洞。

1、严重性：中危。

2、风险：可能会窃取或操纵客户会话和 cookie，它们可能用于模仿合法用户，从而使黑客能够以该用户身份查 看或变更用户记录以及执行事务。

3、原因：未对用户输入正确执行危险字符清理。

 

二、修复漏洞——配置XSS防止跨站点请求的过滤器

1、写一个XssHttpServletRequestWrapper实现HttpServletRequestWrapper，编写过XSS字符过滤逻辑。

package com.szgis.util;

import org.apache.commons.lang3.StringEscapeUtils;

import java.util.Enumeration;



import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;



public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {  

    public XssHttpServletRequestWrapper(HttpServletRequest servletRequest) {

        super(servletRequest);

    }

    public String[] getParameterValues(String parameter) {

      String[] values = super.getParameterValues(parameter);

      if (values==null)  {

                  return null;

          }

      int count = values.length;

      String[] encodedValues = new String[count];

      for (int i = 0; i < count; i++) {

                 encodedValues[i] = cleanXSS(values[i]);

       }

      return encodedValues;

    }

    public String getParameter(String parameter) {

          String value = super.getParameter(parameter);

          if (value == null) {

                 return null;

                  }

          return StringEscapeUtils.escapeHtml4(value);

    }

    public String getHeader(String name) {

        String value = super.getHeader(name);

        if (value == null)

            return null;

        return StringEscapeUtils.escapeHtml4(value);

    }

    private String cleanXSS(String value) {

                //You'll need to remove the spaces from the html entities below

        value = value.replaceAll("<", "&lt;").replaceAll(">", "&gt;");

        value = value.replaceAll("\\(", "&#40;").replaceAll("\\)", "&#41;");
        
        value = value.replaceAll("eval\\((.*)\\)", "");

        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");

        value = value.replaceAll("script", "");

        value = value.replaceAll("'", "&#39;");
        
        value = value.replaceAll(";", "");

        return value;

    }


}

2、自定义一个过滤器XssFilter调用XssHttpServletRequestWrapper，过滤每一个请求。

package com.szgis.util;



import java.io.IOException;  



import javax.servlet.Filter;  

import javax.servlet.FilterChain;  

import javax.servlet.FilterConfig;  

import javax.servlet.ServletException;  

import javax.servlet.ServletRequest;  

import javax.servlet.ServletResponse;  

import javax.servlet.http.HttpServletRequest;  



public class XssFilter implements Filter {

    FilterConfig filterConfig = null;



    public void init(FilterConfig filterConfig) throws ServletException {

        this.filterConfig = filterConfig;

    }



    public void destroy() {

        this.filterConfig = null;

    }



    public void doFilter(ServletRequest request, ServletResponse response,

            FilterChain chain) throws IOException, ServletException {

        chain.doFilter(new XssHttpServletRequestWrapper(

                (HttpServletRequest) request), response);

    }


}

3、在web.xml中调用自定义过滤器XssFilter

	 <!--防止跨站点请求的过滤器-->
	<filter>
		<filter-name>XssSqlFilter</filter-name>
		<filter-class>com.szgis.util.XssFilter</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>XssSqlFilter</filter-name>
		<url-pattern>/*</url-pattern>
		<dispatcher>REQUEST</dispatcher>
	</filter-mapping>