XSS处理方法

package cn.com.klec.sgmysql.web.action.util;


import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.Arrays;
import java.util.regex.Matcher;
import java.util.regex.Pattern;


/**
 * Created by mini on 16/3/2.
 */
public class XssStringFilter {

//默认的过滤规则
final static String regEx = "[`~!%^&*{}#\"'\\[\\]<>?]";

private XssStringFilter() {


}


public static String stringFilter(String str) {
if (str == null || "".equals(str)) {
return str;
}
// "[`~!@#$%^&*()+=|{}':;',\\[\\].<>/?~！@#￥%……&*（）——+|{}【】‘；：”“’。，、？]";
Pattern pattern = Pattern.compile(regEx);
Matcher matcher = pattern.matcher(str);
return matcher.replaceAll("").trim();
}

public static String[] stringFilter(String[] str){
if(str==null|| "".equals(str)){
return str;
}
if(str.length>1000){//该处的判断并没有很大的实际意义，只是为了防止由于过多的循环而导致的系统拒绝访问
str = Arrays.copyOfRange(str, 0, 1000);
}
for (int i = 0; i < str.length; i++) {
str[i] = stringFilter(str[i]);
}
return str;
}

//在默认的过滤基础上，允许某个特殊字符也通过筛选
public static String stringSubFilter(String str,String reg){
if("".equals(reg) || str==null || "".equals(str) || reg ==null ){
return stringFilter(str);
}
reg = regEx.replaceAll(reg, "");
Pattern pattern = Pattern.compile(reg);
Matcher matcher = pattern.matcher(str);
return matcher.replaceAll("").trim();
}


//使用特定的regEx进行过滤
public static String stringFilter(String str, String regEx) {
if ("".equals(regEx) || str == null || "".equals(str)||regEx == null)
return stringFilter(str);
Pattern pattern = Pattern.compile(regEx);
Matcher matcher = pattern.matcher(str);
return matcher.replaceAll("").trim();
}


/**
* 对整个model中的String类型参数进行安全过滤，去除特殊符号，其中regEx使用的是默认
* @param model 传入要进行过滤的model
* @return
*/
@SuppressWarnings("unchecked")
public static <T> void stringFilterOfModel(T model) { 
Class<T> clazz = (Class<T>) model.getClass();
Method getMethod = null;
Method setMethod = null;
Field[] fields = clazz.getDeclaredFields();
String strNameUpp;
String strValue;
for (Field f : fields) {
strNameUpp = f.getName().substring(0, 1).toUpperCase() + f.getName().substring(1);
try {
getMethod = clazz.getDeclaredMethod("get" + strNameUpp);
if (f.getType().isAssignableFrom(String.class)) {
strValue = (String) getMethod.invoke(model);
} else {
continue;
}
setMethod = clazz.getDeclaredMethod("set" + strNameUpp,String.class);
if (getMethod.invoke(model) == null || "".equals(strValue))
continue;
setMethod.invoke(model, stringFilter(strValue));
} catch (Exception e) {
e.printStackTrace();
}
}
}

/**
* 对stringFilterOfModel进行了重载，使regEx可以自定义
* @param model 过滤的model
* @param regEx过滤的规则
*/
public static <T> void stringFilterOfModel(T model, String regEx){
if("".equals(regEx) || regEx == null){
stringFilterOfModel(model);
}
@SuppressWarnings("unchecked")
Class<T> clazz = (Class<T>) model.getClass();
Method getMethod = null;
Method setMethod = null;
Field[] fields = clazz.getDeclaredFields();
String strNameUpp;
String strValue;
for (Field f : fields) {
strNameUpp = f.getName().substring(0, 1).toUpperCase() + f.getName().substring(1);
try {
getMethod = clazz.getDeclaredMethod("get" + strNameUpp);
if (f.getType().isAssignableFrom(String.class)) {
strValue = (String) getMethod.invoke(model);
} else {
continue;
}
setMethod = clazz.getDeclaredMethod("set" + strNameUpp,String.class);
if (getMethod.invoke(model) == null || "".equals(strValue))
continue;
setMethod.invoke(model, stringFilter(strValue,regEx));
} catch (Exception e) {
e.printStackTrace();
}
}
}
/**
* 测试使用
* @param args
*/
// @SuppressWarnings("unused")
// public static void main(String[] args) {
// String hell = "/><script>%20\"/abc";
//
// System.out.println(stringSubFilter(hell, "%"));
//
// System.out.println(stringFilter(hell));
// class Model{
// private String name;
// private String garder;
// private Date age;
// String salary;
// public Model(){
// name = "maoludong!&";
// age = new Date();
// salary = "8000{{";
// }
//
// public String getName() {
// return name;
// }
// public void setName(String name) {
// this.name = name;
// }
// public String getGarder() {
// return garder;
// }
// public void setGarder(String garder) {
// this.garder = garder;
// }
//
// public Date getAge() {
// return age;
// }
// public void setAge(Date age) {
// this.age = age;
// }
// public String getSalary() {
// return salary;
// }
// public void setSalary(String salary) {
// this.salary = salary;
// }
//
// @Override
// public String toString() {
// return "Model [name=" + name + ", garder=" + garder + ", age=" + age + ", salary=" + salary + "]";
// }
//
// }
//
// Model model = new Model();
// stringFilterOfModel(model);
// System.out.println(model);
// }


}