Spring过滤参数中的xss

web.xml中配置

<filter>

<filter-name>XssFilter</filter-name>
<filter-class>com.meadin.funding.filter.XssFilter</filter-class>
<async-supported>true</async-supported>
<!-- 字符编码过滤 -->
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>XssFilter</filter-name>
<url-pattern>/*</url-pattern>

</filter-mapping>

package com.meadin.funding.filter;


import javax.servlet.http.HttpServletRequest;


import org.jsoup.Jsoup;
import org.jsoup.safety.Whitelist;
import org.springframework.web.multipart.MultipartException;
import org.springframework.web.multipart.MultipartHttpServletRequest;
import org.springframework.web.multipart.commons.CommonsMultipartResolver;
import org.springframework.web.multipart.support.DefaultMultipartHttpServletRequest;
import org.springframework.web.util.HtmlUtils;


/**
 * 具有xss功能的multipart解析器 转义上传文件的XSS
 * 
 * @author zhou
 * 
 */
public class XssCommonsMultipartResolver extends CommonsMultipartResolver {


public XssCommonsMultipartResolver() {
}


@Override
public MultipartHttpServletRequest resolveMultipart(
HttpServletRequest request) throws MultipartException {
MultipartParsingResult parsingResult = parseRequest(request);
return new DefaultMultipartHttpServletRequest(request,
parsingResult.getMultipartFiles(),
parsingResult.getMultipartParameters(),
parsingResult.getMultipartParameterContentTypes()) {


@Override
public String getParameter(String name) {
String value = super.getParameter(name);
return value == null ? null : cleanXSS(value);
}


@Override
public String[] getParameterValues(String name) {
String[] values = super.getParameterValues(name);
if (values == null)
return null;


String[] result = new String[values.length];
for (int i = 0; i < result.length; i++) {
result[i] = cleanXSS(values[i]);
}


return result;
}


@Override
public String getHeader(String name) {
String value = super.getHeader(name);
return value == null ? null : cleanXSS(value);
}


};
}


private String cleanXSS(String value) {
return Jsoup.clean(value.toString(), Whitelist.relaxed());
}


}

package com.meadin.funding.filter;


import java.io.IOException;


import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;


import org.springframework.web.filter.OncePerRequestFilter;
import org.springframework.web.multipart.MultipartHttpServletRequest;
import org.springframework.web.multipart.MultipartResolver;
import org.springframework.web.util.WebUtils;


import com.meadin.funding.util.StringUtils;


/**
 * Xss过滤器,可处理multipart请求
 * 
 * @author zhou
 * 
 */
public class XssFilter extends OncePerRequestFilter {
private MultipartResolver multipartResolver;
private String encoding;


public XssFilter() {
}


@Override
protected void initFilterBean() throws ServletException {
XssCommonsMultipartResolver resolver = new XssCommonsMultipartResolver();
resolver.setDefaultEncoding("UTF-8");
resolver.setMaxUploadSize(4096000);
resolver.setServletContext(getServletContext());
multipartResolver = resolver;
}


public void setEncoding(String encoding) {
this.encoding = encoding;
}


@Override
protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response, FilterChain filterChain)
throws ServletException, IOException {
if (!StringUtils.isBlank(encoding)) {
request.setCharacterEncoding(encoding);
response.setCharacterEncoding(encoding);
}


boolean multipartRequestParsed = false;
HttpServletRequest req = new XssHttpServletRequestWrapper(request);
if (multipartResolver.isMultipart(req)) {
req = multipartResolver.resolveMultipart(req);
multipartRequestParsed = true;
}


try {
filterChain.doFilter(req, response);
} finally {
if (multipartRequestParsed) {
multipartResolver.cleanupMultipart(WebUtils.getNativeRequest(
request, MultipartHttpServletRequest.class));
}
}
}


}

package com.meadin.funding.filter;


import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;


import org.jsoup.Jsoup;
import org.jsoup.safety.Whitelist;
import org.springframework.web.util.HtmlUtils;


/**
 * xss过滤包装器 转义参数中的XSS
 * 
 * @author zhou
 * 
 */
class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {


public XssHttpServletRequestWrapper(HttpServletRequest request) {
super(request);
}


@Override
public String getHeader(String name) {
String value = super.getHeader(name);
return value == null ? null : cleanXSS(value);
}


@Override
public String getParameter(String name) {
String value = super.getParameter(name);
return value == null ? null : cleanXSS(value);
}


@Override
public String[] getParameterValues(String name) {
String[] values = super.getParameterValues(name);
if (values == null)
return null;


String[] result = new String[values.length];
for (int i = 0; i < result.length; i++) {
result[i] = cleanXSS(values[i]);
}


return result;
}


private String cleanXSS(String value) {
return Jsoup.clean(value.toString(), Whitelist.relaxed());
}


}

参考https://github.com/dongfangshangren/Zblog

更新：文件上传有BUG--2016-07-27 18:29:43