使用Fileter防止XSS攻击

安全安全

创建时间:2019-02-15 22:15

阅读:

什么是XSS攻击？
XSS攻击使用Javascript脚本注入进行攻击

使用Fileter过滤器过滤器注入标签
XSSFilter
public class XssFiter implements Filter {

public void init(FilterConfig filterConfig) throws ServletException {

}

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
    HttpServletRequest req = (HttpServletRequest) request;
    XssAndSqlHttpServletRequestWrapper xssRequestWrapper = new XssAndSqlHttpServletRequestWrapper(req);
    chain.doFilter(xssRequestWrapper, response);
}

public void destroy() {

}

}

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import org.apache.commons.lang3.StringEscapeUtils;
import org.apache.commons.lang3.StringUtils;

/**

防止XSS攻击

/
public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {
HttpServletRequest request;
public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) {

super(request);
this.request = request;

}
@Override
public String getParameter(String name) {

String value = request.getParameter(name);
System.out.println("name:" + name + "," + value);
if (!StringUtils.isEmpty(value)) {
    // 转换Html
    value = StringEscapeUtils.escapeHtml4(value);
}
return value;

}
}

转载请注明来源，欢迎对文章中的引用来源进行考证，欢迎指出任何有错误或不够清晰的表达。可以在下面评论区评论，也可以邮件至 591235401@qq.com