JAVA覆写Request过滤XSS跨站脚本攻击

注：本文非本人原著。

demo的地址：链接:http://pan.baidu.com/s/1miEmHMo 密码:k5ca

如何过滤Xss跨站脚本攻击，我想，Xss跨站脚本攻击令人为之头疼。为什么呢。

尤其是有富文本编辑器的产品。xss可能出现在http的head，不说别的，新浪多次出现。

xss可以出现在post数据的正文。图片的url。

于是各种Xss横行，如今Xss跨站脚本漏洞的流行程度甚至超过了当年的sql。

那么对于JAVA语言，如何防御呢。

笔者分享一个思路：所有的web项目，所有的参数都是request获得。

不管是json合适xml又或者post表单数据。甚至图片、文件等等都是如此。

那么，如果对request做个手脚。是不是就可以过滤xss了呢。

正是如此。

如下分享代码。网络上也有类似的过滤器，但不如笔者这份强悍。

 package com.blog.web.base.wrapper;

 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.Enumeration;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.regex.Pattern;

 import javax.servlet.ServletInputStream;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletRequestWrapper;

 /**
  * 覆写Request方法，过滤XSS恶意脚本
  *
  * @author WebSOS
  * @time 2015-06-09
  */
 public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {

 	HttpServletRequest orgRequest = null;

 	public XssHttpServletRequestWrapper(HttpServletRequest request) {
 		super(request);
 		orgRequest = request;
 	}

 	/**
 	 * 覆盖getParameter方法，将参数名和参数值都做xss过滤。
 	 */
 	@Override
 	public String getParameter(String name) {
 		String value = super.getParameter(name);
 		if (value != null) {
 			value = xssEncode(value);
 		}
 		return value;
 	}

 	/**
 	 * 覆盖getHeader方法，将参数名和参数值都做xss过滤。 避免部分head操作引发的xss
 	 */
 	@Override
 	public String getHeader(String name) {

 		String value = super.getHeader(name);
 		if (value != null) {
 			value = xssEncode(value);
 		}
 		return value;
 	}

 	/**
 	 * 覆盖getHeaderNames方法，避免穷举head参数名引发的xss
 	 */
 	@Override
 	public Enumeration<String> getHeaderNames() {

 		Enumeration<String> headNames = super.getHeaderNames();
 		String value = null;
 		List<String> values = new ArrayList<String>();
 		while (headNames.hasMoreElements()) {
 			try {
 				value = (String) headNames.nextElement();
 				if (value == null) {
 					continue;
 				}
 				value = xssEncode(value);
 				values.add(value);
 			} catch (Exception e) {
 				e.printStackTrace();
 			}
 		}
 		if (values.isEmpty()) {
 			return null;
 		}
 		headNames = new XssEnumerator(0, values.size(), values);
 		return headNames;
 	}

 	/**
 	 * 覆盖getParameterNames方法，避免穷举参数名引发的xss
 	 */
 	@Override
 	public Enumeration<String> getParameterNames() {
 		Enumeration<String> paraNames = super.getParameterNames();
 		if (paraNames == null) {
 			return null;
 		}
 		String value = null;
 		List<String> values = new ArrayList<String>();
 		while (paraNames.hasMoreElements()) {
 			try {
 				value = (String) paraNames.nextElement();
 				if (value == null) {
 					continue;
 				}
 				value = xssEncode(value);
 				values.add(value);
 			} catch (Exception e) {
 				e.printStackTrace();
 			}
 		}
 		if (values.isEmpty()) {
 			return null;
 		}
 		paraNames = new XssEnumerator(0, values.size(), values);
 		return paraNames;
 	}

 	/**
 	 * 覆盖getParameterMap方法，避免穷举参数名或值引发的xss
 	 */
 	@Override
 	public Map<String, String[]> getParameterMap() {
 		Map<String, String[]> map = super.getParameterMap();
 		Map<String, String[]> paraMap = new HashMap<String, String[]>();
 		if (map == null) {
 			return null;
 		}
 		String[] values = null;
 		for (String key : map.keySet()) {
 			try {
 				values = map.get(key);
 				if (values != null) {
 					for (int i = 0; i < values.length; i++) {
 						try {
 							values[i] = xssEncode(values[i]);
 						} catch (Exception e) {
 							e.printStackTrace();
 						}
 					}
 				}
 				paraMap.put(xssEncode(key), values);
 			} catch (Exception e) {
 				e.printStackTrace();
 			}
 		}
 		return paraMap;
 	}

 	/**
 	 * 覆盖getInputStream方法，避免上传文件出现的xss或脚本代码
 	 */
 	@Override
 	public ServletInputStream getInputStream() throws IOException {
 		XSSServletInputStream xssServletInputStream = new XSSServletInputStream();
 		ServletInputStream inputStream = orgRequest.getInputStream();

 		ByteArrayOutputStream byteStream = new ByteArrayOutputStream();
 		try {
 			int ch;
 			while ((ch = inputStream.read()) != -1) {
 				byteStream.write(ch);
 			}
 		} finally {
 			inputStream.close();
 		}
 		xssServletInputStream.stream = new ByteArrayInputStream(xssEncode(
 				new String(byteStream.toByteArray(), "iso-8859-1")).getBytes(
 				"iso-8859-1"));
 		return xssServletInputStream;
 	}

 	/**
 	 * 将容易引起xss漏洞的字符清理掉
 	 *
 	 * @param s
 	 * @return
 	 */
 	private static String xssEncode(String value) {
 		if (value != null) {
 			/*
 			 * value = value.replace("<", "&lt;"); value = value.replace(">",
 			 * "&gt;");
 			 */
 			// 如需开启富文本请撤销以下注释

 			Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>",
 					Pattern.CASE_INSENSITIVE);
 			value = scriptPattern.matcher(value).replaceAll("");

 			scriptPattern = Pattern.compile("</script>",
 					Pattern.CASE_INSENSITIVE);
 			value = scriptPattern.matcher(value).replaceAll("");

 			scriptPattern = Pattern.compile("<img.*?on.*?=.*?>",
 					Pattern.CASE_INSENSITIVE);
 			value = scriptPattern.matcher(value).replaceAll("");

 			scriptPattern = Pattern.compile("<script(.*?)>",
 					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
 							| Pattern.DOTALL);
 			value = scriptPattern.matcher(value).replaceAll("");

 			scriptPattern = Pattern.compile("eval\\((.*?)\\)",
 					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
 							| Pattern.DOTALL);
 			value = scriptPattern.matcher(value).replaceAll("");

 			scriptPattern = Pattern.compile("e­xpression\\((.*?)\\)",
 					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
 							| Pattern.DOTALL);
 			value = scriptPattern.matcher(value).replaceAll("");

 			scriptPattern = Pattern.compile("expression\\((.*?)\\)",
 					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
 							| Pattern.DOTALL);
 			value = scriptPattern.matcher(value).replaceAll("");

 			scriptPattern = Pattern.compile("javascript:",
 					Pattern.CASE_INSENSITIVE);
 			value = scriptPattern.matcher(value).replaceAll("");

 			scriptPattern = Pattern.compile("vbscript:",
 					Pattern.CASE_INSENSITIVE);
 			value = scriptPattern.matcher(value).replaceAll("");

 			scriptPattern = Pattern.compile("onload(.*?)=",
 					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
 							| Pattern.DOTALL);
 			value = scriptPattern.matcher(value).replaceAll("");

 			scriptPattern = Pattern.compile("<%.*?java.*?%>", Pattern.CASE_INSENSITIVE
 					| Pattern.MULTILINE | Pattern.DOTALL);
 			value = scriptPattern.matcher(value).replaceAll("");

 			scriptPattern = Pattern.compile("<jsp:.*?>.*?</jsp:.*?>",
 					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
 							| Pattern.DOTALL);
 			value = scriptPattern.matcher(value).replaceAll("");

 			scriptPattern = Pattern.compile("<meta.*?>",
 					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
 							| Pattern.DOTALL);
 			value = scriptPattern.matcher(value).replaceAll("");

 		}
 		return value;
 	}

 	/**
 	 * 获取最原始的request
 	 *
 	 * @return
 	 */
 	public HttpServletRequest getOrgRequest() {

 		return orgRequest;
 	}

 	/**
 	 * 获取最原始的request的静态方法
 	 *
 	 * @return
 	 */
 	public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
 		if (req instanceof XssHttpServletRequestWrapper) {
 			return ((XssHttpServletRequestWrapper) req).getOrgRequest();
 		}

 		return req;
 	}

 	private class XSSServletInputStream extends ServletInputStream {
 		private InputStream stream;

 		@Override
 		public int read() throws IOException {
 			return stream.read();
 		}
 	}

 	private class XssEnumerator implements Enumeration<String> {
 		int count; // 计数器
 		int length; // 存储的数组的长度
 		List<String> dataArray; // 存储数据数组的引用

 		XssEnumerator(int count, int length, List<String> dataArray) {
 			this.count = count;
 			this.length = length;
 			this.dataArray = dataArray;

 		}

 		public boolean hasMoreElements() {
 			return (count < length);
 		}

 		public String nextElement() {
 			return dataArray.get(count++);
 		}
 	}

 	public static void main(String[] args) {
 		Enumeration<String> paraNames = (Enumeration<String>) new ArrayList();
 	}
 }