SpringMVC处理脚本,SQL注入问题

最新推荐文章于 2023-07-30 10:00:17 发布

weixin_30709061

最新推荐文章于 2023-07-30 10:00:17 发布

阅读量228

点赞数

CC 4.0 BY-SA版权

文章标签： java 测试 javascript ViewUI

原文链接：http://www.cnblogs.com/xxt19970908/p/5587748.html

本文介绍如何在SpringMVC应用中通过自定义过滤器和拦截器防范XSS攻击及SQL注入，包括编写XssHttpServletRequestWrapper、XSSFilter、SqlInjectInterceptor等组件，并在web.xml中进行配置。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

SpringMVC处理脚本,SQL注入问题(写的不好勿喷，互相学习)

使用 Filter 来过滤浏览器发出的请求，对每个URI参数请求过滤些关键字，替换成安全的字符。所有请求的 getParameter 会被替换，如果参数里面含有敏感词会被替换掉。

对于类似：>"<script>alert('XSS');</script>

一、过滤些敏感的脚本

1、编写XssHttpServletRequestWrapper

import javax. servlet. http. HttpServletRequest;
import javax. servlet. http. HttpServletRequestWrapper;

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
    public XssHttpServletRequestWrapper (HttpServletRequest servletRequest) {
        super(servletRequest);
    }
    public String [] getParameterValues (String parameter) {
        String [] values = super. getParameterValues(parameter);
        if (values == null) {
            return null;
        }
        int count = values. length;
        String [] encodedValues = new String[count];
        for (int i = 0; i < count; i++) {
            encodedValues[i] = cleanXSS(values[i]);
        }
       return encodedValues;
    }
    public String getParameter (String parameter) {
        String value = super. getParameter(parameter);
        if (value == null) {
            return null;
        }
        return cleanXSS(value);
    }
    public String getHeader (String name) {
        String value = super. getHeader(name);
        if (value == null)
            return null;
        return cleanXSS(value);
    }
    private String cleanXSS (String value) {
    value = value. replaceAll ("<", "& lt;"). replaceAll (">", "& gt;");
    value = value. replaceAll ("\\ (", "& #40;"). replaceAll ("\\)", "& #41;");
    value = value. replaceAll ("'", "& #39;");
    value = value. replaceAll ("eval\\ ((. *)\\)", "");
    value = value. replaceAll ("[\\\"\\\’] [\\s] *javascript:(. *)[\\\"\\\']", "\"\"");
        value = value. replaceAll ("script", "");
        return value;

2、添加一个过滤器 XssFilter

import java.io.IOException;

import javax. servlet.Filter;

import javax. servlet.FilterChain;

import javax. servlet.FilterConfig;

import javax. servlet.ServletException;

import javax. servlet.ServletRequest;

import javax. servlet.ServletResponse;

import javax. servlet. http. HttpServletRequest;

publicclass XSSFilter implements Filter {

FilterConfig filterConfig = null;

publicvoid init (FilterConfig filterConfig) throws ServletException {

this. filterConfig = filterConfig;

}

publicvoid destroys () {

this. filterConfig = null;

}

publicvoid doFilter (ServletRequest request, ServletResponse response, FilterChain chain)

throws IOException, ServletException {

chain. doFilter (new XssHttpServletRequestWrapper((HttpServletRequest) request), response);

}

3、在web中配置

<filter>

<filter-name>XssSqlFilter</filter-name>

<filter-class>com. Controller.XSSFilter</filter-class>

</filter>

<filter-mapping>

<filter-name>XssSqlFilter</filter-name>

<url-pattern>/*</url-pattern>

<dispatcher>REQUEST</dispatcher>

</filter-mapping>

4、基于springMVC的配置使用

编写SqlInjectInterceptor

import org.springframework.web. servlet.HandlerInterceptor;

import org.springframework.web. servlet.ModelAndView;

import javax. servlet. http. HttpServletRequest;

import javax. servlet. http. HttpServletResponse;

import java. util. Enumeration;

/** * 防止SQL注入的拦截器 */

publicclass SqlInjectInterceptor implements HandlerInterceptor {

publicboolean preHandle(HttpServletRequest request,HttpServletResponse response, Object o) throws Exception {

Enumeration names = request.getParameterNames ();

while (names. hasMoreElements()) {

String name = (String) names.nextElement();

String[] values = request.getParameterValues(name);

for (String value: values) {

value = clearXss(value);

}

returntrue;

}

publicvoid postHandle(HttpServletRequest request,HttpServletResponse response, Object o, ModelAndView modelAndView) throws Exception {

}

publicvoidafterCompletion(HttpServletRequest request,HttpServletResponse response, Object o, Exception e)

throws Exception {

}

/** * 处理字符转义 * * @param value * @return */

private String clearXss (String value) {

if (value == null || "".equals(value)) {

returnvalue;

}

System.err.println("=========>:处理字符转义");

value = value. replaceAll ("<", "<"). replaceAll (">", ">");

value = value.replaceAll("\\(", "(").replace("\\)", ")");

value = value. replaceAll ("'", "'");

value = value.replaceAll("eval\\((.*)\\)", "");

value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");

value = value.replace("script", "");

returnvalue;

}

二、对含有敏感的脚本,直接处理掉。

1、编写SX_Filter

import java.io.IOException;

import java. util.Enumeration;

import javax. servlet.Filter;

import javax. servlet.FilterChain;

import javax. servlet.FilterConfig;

import javax. servlet.ServletException;

import javax. servlet.ServletRequest;

import javax. servlet.ServletResponse;

import javax. servlet.http. HttpServletRequest;

import javax. servlet. http. HttpServletResponse;

publicclass SX_Filterimplements Filter {

private FilterConfig config;

privatestatic String errorPath;// 出错跳转的目的地

privatestatic String[] excludePaths;// 不进行拦截的url

privatestatic String [] safeless = { // 需要拦截的字符关键字、url编码

"<script",

"</script",

"<iframe",

"</iframe",

"<frame",

"</frame",

"set-cookie",

"%3cscript",

"%3c/script",

"%3ciframe",

"%3c/iframe",

"%3cframe",

"%3c/frame",

"src=\"javascript:",

"<body",

　　　　　　　　"</body",

"%3cbody",

"%3c/body",

"<", ">","</","/>","%3c","%3e","%3c/","/%3e"};

publicvoid doFilter(ServletRequest req, ServletResponse resp, FilterChain filterChain)

throws IOException, ServletException {

Enumeration params = req. getParameterNames ();

HttpServletRequest request = (HttpServletRequest) req;

HttpServletResponse response = (HttpServletResponse)resp;

booleanisSafe = true;

String requestUrl = request. getRequestURI ();

if (isSafe(requestUrl)) {

requestUrl = requestUrl.substring(requestUrl.indexOf("/"));

if (! excludeUrl(requestUrl)) {

while (params. hasMoreElements ()) {

String cache = req.getParameter((String) params.nextElement());

if (null != cache && cache.length() > 0) {

if (!isSafe(cache)) {

isSafe = false;

break;

}

}else{

isSafe = false;

}

if (! isSafe) {

request.setAttribute("error", "您输入的参数有非法字符！");

response. sendRedirect ("http://... ");

return;

}

filterChain.doFilter(req, resp);

}

privatestaticboolean isSafe (String str) {

if (null! = str && str. length () > 0) {

for (String s: safeless) {

if (str. toLowerCase ().contains(s)) {

returnfalse;

}

returntrue;

}

privateboolean excludeUrl (String url) {

if (excludePaths != null && excludePaths.length > 0) {

for (String path : excludePaths) {

if (url. toLowerCase (). equals(path)) {

returntrue;

}

returnfalse;

}

publicvoid destroy() {

}

publicvoid init(FilterConfig config) throws ServletException {

this.config = config;

errorPath = config. getInitParameter("errorPath");

String excludePath = config.getInitParameter("excludePaths");

if (null != excludePath && excludePath.length() > 0) {

excludePaths = excludePath.split(",");

}

2、在web中配置

<filter>

<filter-name>XssSqlFilter</filter-name>

<filter-class>com. Controller. SX_Filter </filter-class>

</filter>

<filter-mapping>

<filter-name>XssSqlFilter</filter-name>

<url-pattern>/*</url-pattern>

<dispatcher>REQUEST</dispatcher>

</filter-mapping>

Spring MVC处理脚本和SQL注入

对于类似：>"<script>alert('XSS');</script>

一、过滤些敏感的脚本

1、编写XssHttpServletRequestWrapper

import javax. servlet. http. HttpServletRequest;

import javax. servlet. http. HttpServletRequestWrapper;

publicclassXssHttpServletRequestWrapper extendsHttpServletRequestWrapper{

public XssHttpServletRequestWrapper (HttpServletRequest servletRequest) {

super(servletRequest);

}

public String [] getParameterValues (String parameter) {

String [] values = super. getParameterValues(parameter);

if (values == null) {

returnnull;

}

intcount = values. length;

String [] encodedValues = new String[count];

for (inti = 0; i < count; i++) {

encodedValues[i] = cleanXSS(values[i]);

}

returnencodedValues;

}

public String getParameter (String parameter) {

String value = super. getParameter(parameter);

if (value == null) {

returnnull;

}

return cleanXSS(value);

}

public String getHeader (String name) {

String value = super. getHeader(name);

if (value == null)

returnnull;

return cleanXSS(value);

}

private String cleanXSS (String value) {

value = value. replaceAll ("<", "& lt;"). replaceAll (">", "& gt;");

value = value. replaceAll ("\\ (", "& #40;"). replaceAll ("\\)", "& #41;");

value = value. replaceAll ("'", "& #39;");

value = value. replaceAll ("eval\\ ((. *)\\)", "");

value = value. replaceAll ("[\\\"\\\’] [\\s] *javascript:(. *)[\\\"\\\']", "\"\"");

value = value. replaceAll ("script", "");

returnvalue;

}

2、添加一个过滤器 XssFilter

import java.io. IOException;

import javax. servlet. Filter;

import javax. servlet. FilterChain;

import javax. servlet. FilterConfig;

import javax. servlet. ServletException;

import javax. servlet. ServletRequest;

import javax. servlet. ServletResponse;

import javax. servlet. http. HttpServletRequest;

publicclass XSSFilter implements Filter {

FilterConfig filterConfig = null;

publicvoid init (FilterConfig filterConfig) throws ServletException {

this. filterConfig = filterConfig;

}

publicvoid destroys () {

this. filterConfig = null;

}

publicvoid doFilter (ServletRequest request, ServletResponse response, FilterChain chain)

throws IOException, ServletException {

chain. doFilter (new XssHttpServletRequestWrapper((HttpServletRequest) request), response);

}

3、在web中配置

<filter>

<filter-name>XssSqlFilter</filter-name>

<filter-class>com. Controller.XSSFilter</filter-class>

</filter>

<filter-mapping>

<filter-name>XssSqlFilter</filter-name>

<url-pattern>/*</url-pattern>

<dispatcher>REQUEST</dispatcher>

</filter-mapping>

4、基于springMVC的配置使用

编写SqlInjectInterceptor

import org.springframework.web. servlet. HandlerInterceptor;

import org.springframework.web. servlet. ModelAndView;

import javax. servlet. http. HttpServletRequest;

import javax. servlet. http. HttpServletResponse;

import java. util. Enumeration;

/** * 防止SQL注入的拦截器 */

publicclass SqlInjectInterceptor implements HandlerInterceptor {

publicboolean preHandle(HttpServletRequest request, HttpServletResponse response, Object o) throws Exception {

Enumeration names = request. getParameterNames ();

while (names. hasMoreElements ()) {

String name = (String) names.nextElement();

String[] values = request.getParameterValues(name);

for (String value: values) {

value = clearXss(value);

}

returntrue;

}

publicvoid postHandle(HttpServletRequest request, HttpServletResponse response, Object o,

ModelAndView modelAndView) throws Exception {

}

publicvoid afterCompletion(HttpServletRequest request, HttpServletResponse response, Object o, Exception e)

throws Exception {

}

/** * 处理字符转义 * * @param value * @return */

private String clearXss (String value) {

if (value == null || "".equals(value)) {

returnvalue;

}

System.err.println("=========>:处理字符转义");

value = value. replaceAll ("<", "<"). replaceAll (">", ">");

value = value.replaceAll("\\(", "(").replace("\\)", ")");

value = value. replaceAll ("'", "'");

value = value.replaceAll("eval\\((.*)\\)", "");

value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");

value = value.replace("script", "");

returnvalue;

}

在springMVC.xml文件中配置SqlInjectInterceptor

<! -- 拦截器：SQL注入拦截 -->

<mvc: interceptors>

<mvc: interceptor>

<mvc: mapping path="/**" />

<bean class="com. Controller.SqlInjectInterceptor"></bean>

</mvc: interceptor>

</mvc: interceptors>

二、对含有敏感的脚本,直接处理掉。

1、编写SX_Filter

import java.io. IOException;

import java. util. Enumeration;

import javax. servlet. Filter;

import javax. servlet. FilterChain;

import javax. servlet. FilterConfig;

import javax. servlet. ServletException;

import javax. servlet. ServletRequest;

import javax. servlet. ServletResponse;

import javax. servlet. http. HttpServletRequest;

import javax. servlet. http. HttpServletResponse;

publicclass SX_Filter implements Filter {

private FilterConfig config;

privatestatic String errorPath;// 出错跳转的目的地

privatestatic String[] excludePaths;// 不进行拦截的url

privatestatic String [] safeless = { // 需要拦截的字符关键字、url编码

"<script",

"</script",

"<iframe",

"</iframe",

"<frame",

"</frame",

"set-cookie",

"%3cscript",

"%3c/script",

"%3ciframe",

"%3c/iframe",

"%3cframe",

"%3c/frame",

"src=\"javascript:",

"<body", "</body",

"%3cbody",

"%3c/body",

"<", ">","</","/>","%3c","%3e","%3c/","/%3e"};

publicvoid doFilter(ServletRequest req, ServletResponse resp, FilterChain filterChain)

throws IOException, ServletException {

Enumeration params = req. getParameterNames ();

HttpServletRequest request = (HttpServletRequest) req;

HttpServletResponse response = (HttpServletResponse) resp;

booleanisSafe = true;

String requestUrl = request. getRequestURI ();

if (isSafe(requestUrl)) {

requestUrl = requestUrl.substring(requestUrl.indexOf("/"));

if (! excludeUrl(requestUrl)) {

while (params. hasMoreElements ()) {

String cache = req.getParameter((String) params.nextElement());

if (null != cache && cache.length() > 0) {

if (!isSafe(cache)) {

isSafe = false;

break;

}

} else {

isSafe = false;

}

if (! isSafe) {

request.setAttribute("error", "您输入的参数有非法字符！");

response. sendRedirect ("http://... ");

return;

}

filterChain.doFilter(req, resp);

}

privatestaticboolean isSafe (String str) {

if (null! = str && str. length () > 0) {

for (String s: safeless) {

if (str. toLowerCase (). contains(s)) {

returnfalse;

}

returntrue;

}

privateboolean excludeUrl (String url) {

if (excludePaths != null && excludePaths.length > 0) {

for (String path : excludePaths) {

if (url. toLowerCase (). equals(path)) {

returntrue;

}

returnfalse;

}

publicvoid destroy() {

}

publicvoid init(FilterConfig config) throws ServletException {

this.config = config;

errorPath = config. getInitParameter("errorPath");

String excludePath = config.getInitParameter("excludePaths");

if (null != excludePath && excludePath.length() > 0) {

excludePaths = excludePath.split(",");

}

2、在web中配置

<filter>

<filter-name>XssSqlFilter</filter-name>

<filter-class>com. Controller. SX_Filter </filter-class>

</filter>

<filter-mapping>

<filter-name>XssSqlFilter</filter-name>

<url-pattern>/*</url-pattern>

<dispatcher>REQUEST</dispatcher>

</filter-mapping>

转载于:https://www.cnblogs.com/xxt19970908/p/5587748.html