对富文本进行XSS过滤

最新推荐文章于 2025-07-01 11:24:00 发布

weixin_33755649

最新推荐文章于 2025-07-01 11:24:00 发布

阅读量760

点赞数

CC 4.0 BY-SA版权

文章标签：前端 javascript c# ViewUI

原文链接：https://my.oschina.net/u/937713/blog/146714

本文深入探讨了如何通过一系列技术手段有效防御网页中的XSS攻击，包括使用正则表达式匹配并移除恶意脚本标签、事件属性、ASCII和十六进制编码等内容，确保网页内容的安全性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

2019独角兽企业重金招聘Python工程师标准>>>

public class AntiXSS {

	static final Pattern SCRIPT_TAG_PATTERN = Pattern.compile( 
			"<script[^>]*>.*</script[^>]*>", Pattern.CASE_INSENSITIVE); 

			static final PatternCompiler pc = new Perl5Compiler(); 
			static final Perl5Matcher matcher = new Perl5Matcher(); 

			
			public static String antiXSS(String content) { 
			if(content == null || "".equals(content)) {
				return "";
			}
			String old = content; 
			String ret = _antiXSS(content); 
			while (!ret.equals(old)) { 
			old = ret; 
			ret = _antiXSS(ret); 
			} 
			return ret; 
			} 

			private static String _antiXSS(String content) { 
			try { 
			return stripAllowScriptAccess(stripProtocol(stripCssExpression(stripAsciiAndHex(stripEvent(stripScriptTag(content)))))); 
			} catch (Exception e) { 
			e.printStackTrace(); 
			return null; 
			} 
			} 

			private static String stripScriptTag(String content) { 
			Matcher m = SCRIPT_TAG_PATTERN.matcher(content); 
			content = m.replaceAll(""); 
			return content; 
			} 

			private static String stripEvent(String content) throws Exception { 
			String[] events = { "onmouseover", "onmouseout", "onmousedown", 
			"onmouseup", "onmousemove", "onclick", "ondblclick", 
			"onkeypress", "onkeydown", "onkeyup", "ondragstart", 
			"onerrorupdate", "onhelp", "onreadystatechange", "onrowenter", 
			"onrowexit", "onselectstart", "onload", "onunload", 
			"onbeforeunload", "onblur", "onerror", "onfocus", "onresize", 
			"onscroll", "oncontextmenu" }; 
			for (String event : events) { 
			org.apache.oro.text.regex.Pattern p = pc.compile("(<[^>]*)(" 
			+ event + ")([^>]*>)", Perl5Compiler.CASE_INSENSITIVE_MASK); 
			if (null != p) 
			content = Util.substitute(matcher, p, new Perl5Substitution( 
			"$1" + event.substring(2) + "$3"), content, 
			Util.SUBSTITUTE_ALL); 

			} 
			return content; 
			} 

			private static String stripAsciiAndHex(String content) throws Exception { 
			// filter &# \00xx 
			org.apache.oro.text.regex.Pattern p = pc.compile( 
			"(<[^>]*)(&#|\\\\00)([^>]*>)", 
			Perl5Compiler.CASE_INSENSITIVE_MASK); 
			if (null != p) 
			content = Util 
			.substitute(matcher, p, new Perl5Substitution("$1$3"), 
			content, Util.SUBSTITUTE_ALL); 
			return content; 
			} 

			private static String stripCssExpression(String content) throws Exception { 
			org.apache.oro.text.regex.Pattern p = pc.compile( 
			"(<[^>]*style=.*)/\\*.*\\*/([^>]*>)", 
			Perl5Compiler.CASE_INSENSITIVE_MASK); 
			if (null != p) 
			content = Util 
			.substitute(matcher, p, new Perl5Substitution("$1$2"), 
			content, Util.SUBSTITUTE_ALL); 

			p = pc 
			.compile( 
			"(<[^>]*style=[^>]+)(expression|javascript|vbscript|-moz-binding)([^>]*>)", 
			Perl5Compiler.CASE_INSENSITIVE_MASK); 
			if (null != p) 
			content = Util 
			.substitute(matcher, p, new Perl5Substitution("$1$3"), 
			content, Util.SUBSTITUTE_ALL); 

			p = pc.compile("(<style[^>]*>.*)/\\*.*\\*/(.*</style[^>]*>)", 
			Perl5Compiler.CASE_INSENSITIVE_MASK); 
			if (null != p) 
			content = Util 
			.substitute(matcher, p, new Perl5Substitution("$1$2"), 
			content, Util.SUBSTITUTE_ALL); 

			p = pc 
			.compile( 
			"(<style[^>]*>[^>]+)(expression|javascript|vbscript|-moz-binding)(.*</style[^>]*>)", 
			Perl5Compiler.CASE_INSENSITIVE_MASK); 
			if (null != p) 
			content = Util 
			.substitute(matcher, p, new Perl5Substitution("$1$3"), 
			content, Util.SUBSTITUTE_ALL); 
			return content; 
			} 

			private static String stripProtocol(String content) throws Exception { 
			String[] protocols = { "javascript","alert", "vbscript", "livescript", 
			"ms-its", "mhtml", "data", "firefoxurl", "mocha" }; 
			for (String protocol : protocols) { 
			org.apache.oro.text.regex.Pattern p = pc.compile("(<[^>]*)" 
			+ protocol + ":([^>]*>)", 
			Perl5Compiler.CASE_INSENSITIVE_MASK); 
			if (null != p) 
			content = Util.substitute(matcher, p, new Perl5Substitution( 
			"$1/$2"), content, Util.SUBSTITUTE_ALL); 
			} 
			return content; 
			} 

			private static String stripAllowScriptAccess(String content) 
			throws Exception { 
			org.apache.oro.text.regex.Pattern p = pc.compile( 
			"(<[^>]*)AllowScriptAccess([^>]*>)", 
			Perl5Compiler.CASE_INSENSITIVE_MASK); 
			if (null != p) 
			content = Util.substitute(matcher, p, new Perl5Substitution( 
			"$1Allow_Script_Access$2"), content, Util.SUBSTITUTE_ALL); 
			return content; 
			}

转载于:https://my.oschina.net/u/937713/blog/146714