java 防止 XSS 攻击的常用方法总结.

来源：互联网发布：sql多行合并相同条件编辑：程序博客网时间：2024/05/16 19:05

在前面的一篇文章中，讲到了java web应用程序防止 csrf 攻击的方法，参考这里 java网页程序采用 spring 防止 csrf 攻击. ,但这只是攻击的一种方式，还有其他方式，比如今天要记录的 XSS 攻击， XSS 攻击的专业解释，可以在网上搜索一下，参考百度百科的解释http://baike.baidu.com/view/2161269.htm, 但在实际的应用中如何去防止这种攻击呢，下面给出几种办法.
1. 自己写 filter 拦截来实现，但要注意的时，在WEB.XML 中配置 filter 的时候，请将这个 filter 放在第一位.
2. 采用开源的实现 ESAPI library ，参考网址: https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API

3. 可以采用spring 里面提供的工具类来实现.

一，第一种方法。

配置过滤器

public class XSSFilter implements Filter {    @Override    public void init(FilterConfig filterConfig) throws ServletException {    }    @Override    public void destroy() {    }    @Override    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)        throws IOException, ServletException {        chain.doFilter(new XSSRequestWrapper((HttpServletRequest) request), response);    }}

再实现 ServletRequest 的包装类

import java.util.regex.Pattern;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletRequestWrapper;public class XSSRequestWrapper extends HttpServletRequestWrapper {    public XSSRequestWrapper(HttpServletRequest servletRequest) {        super(servletRequest);    }    @Override    public String[] getParameterValues(String parameter) {        String[] values = super.getParameterValues(parameter);        if (values == null) {            return null;        }        int count = values.length;        String[] encodedValues = new String[count];        for (int i = 0; i < count; i++) {            encodedValues[i] = stripXSS(values[i]);        }        return encodedValues;    }    @Override    public String getParameter(String parameter) {        String value = super.getParameter(parameter);        return stripXSS(value);    }    @Override    public String getHeader(String name) {        String value = super.getHeader(name);        return stripXSS(value);    }    private String stripXSS(String value) {        if (value != null) {            // NOTE: It's highly recommended to use the ESAPI library and uncomment the following line to            // avoid encoded attacks.            // value = ESAPI.encoder().canonicalize(value);            // Avoid null characters            value = value.replaceAll("", "");            // Avoid anything between script tags            Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);            value = scriptPattern.matcher(value).replaceAll("");            // Avoid anything in a src="http://www.yihaomen.com/article/java/..." type of expression            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);            value = scriptPattern.matcher(value).replaceAll("");            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);            value = scriptPattern.matcher(value).replaceAll("");            // Remove any lonesome </script> tag            scriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE);            value = scriptPattern.matcher(value).replaceAll("");            // Remove any lonesome <script ...> tag            scriptPattern = Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);            value = scriptPattern.matcher(value).replaceAll("");            // Avoid eval(...) expressions            scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);            value = scriptPattern.matcher(value).replaceAll("");            // Avoid expression(...) expressions            scriptPattern = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);            value = scriptPattern.matcher(value).replaceAll("");            // Avoid javascript:... expressions            scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);            value = scriptPattern.matcher(value).replaceAll("");            // Avoid vbscript:... expressions            scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);            value = scriptPattern.matcher(value).replaceAll("");            // Avoid onload= expressions            scriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);            value = scriptPattern.matcher(value).replaceAll("");        }        return value;    }}

例子中注释的部分，就是采用 ESAPI library 来防止XSS攻击的，推荐使用.

当然，我还看到这样一种办法，将所有的编程全角字符的解决方式，但个人觉得并没有上面这种用正则表达式替换的好

private static String xssEncode(String s) {        if (s == null || s.equals("")) {            return s;        }        StringBuilder sb = new StringBuilder(s.length() + 16);        for (int i = 0; i < s.length(); i++) {            char c = s.charAt(i);            switch (c) {            case '>':                sb.append('＞');// 全角大于号                break;            case '<':                sb.append('＜');// 全角小于号                break;            case '\'':                sb.append('\\');                sb.append('\'');                sb.append('\\');                sb.append('\'');                break;            case '\"':                sb.append('\\');                sb.append('\"');// 全角双引号                break;            case '&':                sb.append('＆');// 全角                break;            case '\\':                sb.append('＼');// 全角斜线                break;            case '#':                sb.append('＃');// 全角井号                break;            case ':':                sb.append('：');// 全角冒号                break;            case '%':                sb.append("\\\\%");                break;            default:                sb.append(c);                break;            }        }        return sb.toString();    }

在后台或者用spring 如何实现呢:
首先添加一个jar包：commons-lang-2.5.jar ，然后在后台调用这些函数：

StringEscapeUtils.escapeHtml(string); StringEscapeUtils.escapeJavaScript(string); StringEscapeUtils.escapeSql(string);

当然，我记得在spring 里面好像有一个 HtmlUtils.htmlEscape , 同样可以做到过滤 XSS 攻击。从上面的介绍可以看出，防止 XSS 攻击并不难，就是要小心。

0 0