SpringBoot 使用Filter 解决Xss攻击 HTML标签转义

XSS攻击通常指的是通过利用网页开发时留下的漏洞，通过巧妙的方法注入恶意指令代码到网页，使用户加载并执行攻击者恶意制造的网页程序。这些恶意网页程序通常是JavaScript，但实际上也可以包括Java、 VBScript、ActiveX、 Flash 或者甚至是普通的HTML。攻击成功后，攻击者可能得到包括但不限于更高的权限（如执行一些操作）、私密网页内容、会话和cookie等各种内容。

XSSFilter

import javax.servlet.*; import javax.servlet.http.HttpServletRequest; import java.io.IOException; import java.util.ArrayList; import java.util.List; /** * 类 名: XSSFilter * 描 述: * 作 者: binglong180 * 创 建: 2020-06-24 10:28 * 邮 箱: binglong172@163.com */ public class XSSFilter implements Filter { /** * 不需要转义的url */ List<String> passList = new ArrayList<>(); @Override public void init(FilterConfig filterConfig) throws ServletException { passList.add("/image/upload"); passList.add("/adminLogin"); passList.add("/admin/annex/upload"); passList.add("/uscLogin"); } @Override public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest)servletRequest; String requestURI = request.getRequestURI(); if(!passList.contains(requestURI)){ filterChain.doFilter(new XSSRequestWrapper(request) , servletResponse); }else{ filterChain.doFilter(servletRequest,servletResponse); } } }

XSSRequestWrapper 参数重写类

import org.springframework.web.util.HtmlUtils; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; /** * 类 名: XSSRequestWrapper * 描 述: * 作 者: binglong180 * 创 建: 2020-06-24 10:39 * 邮 箱: binglong172@163.com */ public class XSSRequestWrapper extends HttpServletRequestWrapper { public XSSRequestWrapper(HttpServletRequest request) { super(request); } @Override public String[] getParameterValues(String name) { //获取所有参数值的集合 String[] results = this.getParameterMap().get(name); if (results != null && results.length > 0) { int length = results.length; for (int i = 0; i < length; i++) { //过滤参数值 results[i] = HtmlUtils.htmlEscape(results[i]); } return results; } return null; } }

结果