xxs过滤

最新推荐文章于 2024-11-08 16:35:07 发布

Hiirhan

最新推荐文章于 2024-11-08 16:35:07 发布

阅读量666

点赞数

CC 4.0 BY-SA版权

分类专栏： .net

本文链接：https://blog.youkuaiyun.com/wzx_it/article/details/17436093

.net 专栏收录该内容

32 篇文章

订阅专栏

本文介绍了一种XSS过滤器的实现方式，该过滤器通过预定义的关键字和正则表达式来检测并清除潜在的XSS攻击代码。支持多种类型的HTML标签过滤，包括但不限于script、iframe等。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

    /// <summary>
    /// Xss过滤器
    /// </summary>
    public class XssCleaner
    {
        private static List<KeyValuePair<string, Regex>> injectWords = new List<KeyValuePair<string, Regex>>();

        /// <summary>
        /// 静态构造函数
        /// </summary>
        static XssCleaner()
        {
            #region 关键字（可任意变更，不区分大小写）
            injectWords.Add(new KeyValuePair<string, Regex>(@"alert", new Regex(@"alert\(.*\)", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"javascript", new Regex(@"javascript", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"document.", new Regex(@"document\.", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"script", new Regex(@"<\s*script.*>.*<\/\s*script\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"script", new Regex(@"<\s*script.*/\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"applet", new Regex(@"<\s*applet.*>.*<\/\s*applet\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"applet", new Regex(@"<\s*applet.*/\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"frameset", new Regex(@"<\s*frameset.*>.*<\/\s*frameset\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"frameset", new Regex(@"<\s*frameset.*/\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"iframe", new Regex(@"<\s*iframe.*>.*<\/\s*iframe\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"iframe", new Regex(@"<\s*iframe.*/\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"frame", new Regex(@"<\s*frame.*>.*<\/\s*frame\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"frame", new Regex(@"<\s*frame.*/\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"img", new Regex(@"<\s*img.*>.*<\/\s*img\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"img", new Regex(@"<\s*img.*/\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"link", new Regex(@"<\s*link.*>.*<\/\s*link\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"link", new Regex(@"<\s*link.*/\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"object", new Regex(@"<\s*object.*>.*<\/\s*object\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"object", new Regex(@"<\s*object.*/\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"style", new Regex(@"<\s*style.*>.*<\/\s*style\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            injectWords.Add(new KeyValuePair<string, Regex>(@"style", new Regex(@"<\s*style.*/\s*>", RegexOptions.Compiled | RegexOptions.IgnoreCase)));
            #endregion

            #region 符号（可任意变更，不区分大小写）

            #endregion
        }

        /// <summary>
        /// 过滤
        /// </summary>
        /// <param name="input">输入</param>
        /// <returns>输出</returns>
        public static string Clean(string input)
        {
            if (string.IsNullOrWhiteSpace(input))
            {
                return input;
            }
            injectWords.ForEach(injectWord =>
            {
                var startIndex = input.IndexOf(injectWord.Key, StringComparison.CurrentCultureIgnoreCase);

                if (startIndex >= 0)
                {
                    input = injectWord.Value.Replace(input, string.Empty);
                }
            });
            return input;
        }
    }