devbox
weixin_40725706
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

springboot防止XSS攻击&&SQL防注入_springboot防止 sql注入

作者：weixin_40725706 | 2024-02-22 18:43:20

赞

踩

springboot防止 sql注入

一.结构：

XssAndSqlHttpServletRequestWrapper      请求过滤类

CrosXssFilterConfigUtil                               注入防护开关工具类

CrosXssFilterConfig                                    sql xss过滤器

二.代码 

1. 创建请求过滤类XssAndSqlHttpServletRequestWrapper

  1. import org.slf4j.Logger;
  2. import org.slf4j.LoggerFactory;
  3. import org.springframework.util.StreamUtils;
  4.  
  5. import javax.servlet.ReadListener;
  6. import javax.servlet.ServletInputStream;
  7. import javax.servlet.http.HttpServletRequest;
  8. import javax.servlet.http.HttpServletRequestWrapper;
  9. import java.io.BufferedReader;
  10. import java.io.ByteArrayInputStream;
  11. import java.io.IOException;
  12. import java.io.InputStreamReader;
  13. import java.util.*;
  14. import java.util.regex.Pattern;
  15.  
  16. /**
  17.  * @Description 请求过滤类
  18.  */
  19. public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {
  20.  
  21.     private final Logger logger = LoggerFactory.getLogger(XssAndSqlHttpServletRequestWrapper.class);
  22.  
  23.     private String key = "and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|;|or|-|+";
  24.     private Set<String> notAllowedKeyWords = new HashSet<String>(0);
  25.  
  26.     HttpServletRequest orgRequest = null;
  27.     private Map<String, String[]> parameterMap;
  28.     private final byte[] body; //用于保存读取body中数据
  29.  
  30.     public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException {
  31.         super(request);
  32.         orgRequest = request;
  33.         parameterMap = request.getParameterMap();
  34.         body = StreamUtils.copyToByteArray(request.getInputStream());
  35.  
  36.         String keyStr[] = key.split("\\|");
  37.         for (String str : keyStr) {
  38.             notAllowedKeyWords.add(str);
  39.         }
  40.  
  41.     }
  42.  
  43.     // 重写几个HttpServletRequestWrapper中的方法
  44.     /**
  45.      * 获取所有参数名
  46.      *
  47.      * @return 返回所有参数名
  48.      */
  49.     @Override
  50.     public Enumeration<String> getParameterNames() {
  51.         Vector<String> vector = new Vector<String>(parameterMap.keySet());
  52.         return vector.elements();
  53.     }
  54.  
  55.     /**
  56.      * 覆盖getParameter方法，将参数名和参数值都做xss &amp; sql过滤。<br>
  57.      * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br>
  58.      * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
  59.      */
  60.     @Override
  61.     public String getParameter(String name) {
  62.         String[] results = parameterMap.get(name);
  63.         if (results == null || results.length == 0)
  64.             return null;
  65.         else {
  66.             String value = results[0];
  67.             if (value != null) {
  68.                 value = xssEncode(value);
  69.             }
  70.             return value;
  71.         }
  72.     }
  73.  
  74.     @Override
  75.     public Map<String, String[]> getParameterMap() {
  76.         Map<String,String[]> values = super.getParameterMap();
  77.         if(null == values){
  78.             return null;
  79.         }
  80.         Map<String,String[]> result = new HashMap<>();
  81.         for (String key : values.keySet()) {
  82.             String encodedKey = xssEncode(key);
  83.             int count = values.get(key).length;
  84.             String[] encodedValues = new String[count];
  85.             for(int i = 0;i < count;i++){
  86.                 encodedValues[i] = xssEncode(values.get(key)[i]);
  87.             }
  88.             result.put(encodedKey,encodedValues);
  89.         }
  90.         return result;
  91.     }
  92.  
  93.     /**
  94.      * 获取指定参数名的所有值的数组，如：checkbox的所有数据 接收数组变量 ，如checkobx类型
  95.      */
  96.     @Override
  97.     public String[] getParameterValues(String name) {
  98.         String[] results = parameterMap.get(name);
  99.         if (results == null || results.length == 0)
  100.             return null;
  101.         else {
  102.             int length = results.length;
  103.             for (int i = 0; i < length; i++) {
  104.                 results[i] = xssEncode(results[i]);
  105.             }
  106.             return results;
  107.         }
  108.     }
  109.  
  110.     /**
  111.      * 覆盖getHeader方法，将参数名和参数值都做xss &amp; sql过滤。<br>
  112.      * 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br>
  113.      * getHeaderNames 也可能需要覆盖
  114.      */
  115.     @Override
  116.     public String getHeader(String name) {
  117.         String value = super.getHeader(xssEncode(name));
  118.         if (value != null) {
  119.             value = xssEncode(value);
  120.         }
  121.         return value;
  122.     }
  123.  
  124.     /**
  125.      * 将容易引起xss &amp; sql漏洞的半角字符直接替换成全角字符
  126.      *
  127.      * @param s
  128.      * @return
  129.      */
  130.     private String xssEncode(String s) {
  131.         if (s == null || s.isEmpty()) {
  132.             return s;
  133.         } else {
  134.             s = stripXSSAndSql(s);
  135.         }
  136.         StringBuilder sb = new StringBuilder(s.length() + 16);
  137.         for (int i = 0; i < s.length(); i++) {
  138.             char c = s.charAt(i);
  139.             switch (c) {
  140.                 case '>':
  141.                     sb.append("＞");// 转义大于号
  142.                     break;
  143.                 case '<':
  144.                     sb.append("＜");// 转义小于号
  145.                     break;
  146.                 case '\'':
  147.                     sb.append("＇");// 转义单引号
  148.                     break;
  149.                 case '\"':
  150.                     sb.append("＂");// 转义双引号
  151.                     break;
  152.                 case '&':
  153.                     sb.append("＆");// 转义&
  154.                     break;
  155.                 case '#':
  156.                     sb.append("＃");// 转义#
  157.                     break;
  158.                 default:
  159.                     sb.append(c);
  160.                     break;
  161.             }
  162.         }
  163.  
  164.         return sb.toString();
  165.     }
  166.  
  167.     /**
  168.      * 获取最原始的request
  169.      *
  170.      * @return
  171.      */
  172.     public HttpServletRequest getOrgRequest() {
  173.         return orgRequest;
  174.     }
  175.  
  176.     /**
  177.      * 获取最原始的request的静态方法
  178.      *
  179.      * @return
  180.      */
  181.     @SuppressWarnings("unused")
  182.     public HttpServletRequest getOrgRequest(HttpServletRequest req) {
  183.         if (req instanceof XssAndSqlHttpServletRequestWrapper) {
  184.             return ((XssAndSqlHttpServletRequestWrapper) req).getOrgRequest();
  185.         }
  186.         return req;
  187.     }
  188.  
  189.     /**
  190.      *
  191.      * 防止xss跨脚本攻击(替换，根据实际情况调整)
  192.      */
  193.  
  194.     public String stripXSSAndSql(String value) {
  195.         if (value != null) {
  196.             // NOTE: It's highly recommended to use the ESAPI library and
  197.             // uncomment the following line to
  198.             // avoid encoded attacks.
  199.             // value = ESAPI.encoder().canonicalize(value);
  200.             // Avoid null characters
  201.             /** value = value.replaceAll("", ""); ***/
  202.             // Avoid anything between script tags
  203.             Pattern scriptPattern = Pattern.compile(
  204.                     "&lt;[\r\n| | ]*script[\r\n| | ]*&gt;(.*?)<!--[\r\n| | ]*script[\r\n| | ]*-->", Pattern.CASE_INSENSITIVE);
  205.             value = scriptPattern.matcher(value).replaceAll("");
  206.             // Avoid anything in a
  207.             // src="http://www.yihaomen.com/article/java/..." type of
  208.             // e-xpression
  209.             scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",
  210.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  211.             value = scriptPattern.matcher(value).replaceAll("");
  212.             // Remove any lonesome  tag
  213.             scriptPattern = Pattern.compile("<!--[\r\n| | ]*script[\r\n| | ]*-->", Pattern.CASE_INSENSITIVE);
  214.             value = scriptPattern.matcher(value).replaceAll("");
  215.             // Remove any lonesome <script ...> tag
  216.             scriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>",
  217.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  218.             value = scriptPattern.matcher(value).replaceAll("");
  219.             // Avoid eval(...) expressions
  220.             scriptPattern = Pattern.compile("eval\\((.*?)\\)",
  221.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  222.             value = scriptPattern.matcher(value).replaceAll("");
  223.             // Avoid e-xpression(...) expressions
  224.             scriptPattern = Pattern.compile("e-xpression\\((.*?)\\)",
  225.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  226.             value = scriptPattern.matcher(value).replaceAll("");
  227.             // Avoid javascript:... expressions
  228.             scriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);
  229.             value = scriptPattern.matcher(value).replaceAll("");
  230.             // Avoid vbscript:... expressions
  231.             scriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);
  232.             value = scriptPattern.matcher(value).replaceAll("");
  233.             // Avoid οnlοad= expressions
  234.             scriptPattern = Pattern.compile("onload(.*?)=",
  235.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  236.             value = scriptPattern.matcher(value).replaceAll("");
  237.         }
  238.         return value;
  239.     }
  240.  
  241.     public boolean checkXSSAndSql(String value) {
  242.         boolean flag = false;
  243.         if (value != null) {
  244.             // NOTE: It's highly recommended to use the ESAPI library and
  245.             // uncomment the following line to
  246.             // avoid encoded attacks.
  247.             // value = ESAPI.encoder().canonicalize(value);
  248.             // Avoid null characters
  249.             /** value = value.replaceAll("", ""); ***/
  250.             // Avoid anything between script tags
  251.             Pattern scriptPattern = Pattern.compile(
  252.                     "<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);
  253.             flag = scriptPattern.matcher(value).find();
  254.             if (flag) {
  255.                 return flag;
  256.             }
  257.             // Avoid anything in a
  258.             // src="http://www.yihaomen.com/article/java/..." type of
  259.             // e-xpression
  260.             scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",
  261.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  262.             flag = scriptPattern.matcher(value).find();
  263.             if (flag) {
  264.                 return flag;
  265.             }
  266.             // Remove any lonesome </script> tag
  267.             scriptPattern = Pattern.compile("<!--[\r\n| | ]*script[\r\n| | ]*-->", Pattern.CASE_INSENSITIVE);
  268.             flag = scriptPattern.matcher(value).find();
  269.             if (flag) {
  270.                 return flag;
  271.             }
  272.             // Remove any lonesome <script ...> tag
  273.             scriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>",
  274.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  275.             flag = scriptPattern.matcher(value).find();
  276.             if (flag) {
  277.                 return flag;
  278.             }
  279.             // Avoid eval(...) expressions
  280.             scriptPattern = Pattern.compile("eval\\((.*?)\\)",
  281.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  282.             flag = scriptPattern.matcher(value).find();
  283.             if (flag) {
  284.                 return flag;
  285.             }
  286.             // Avoid e-xpression(...) expressions
  287.             scriptPattern = Pattern.compile("e-xpression\\((.*?)\\)",
  288.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  289.             flag = scriptPattern.matcher(value).find();
  290.             if (flag) {
  291.                 return flag;
  292.             }
  293.             // Avoid javascript:... expressions
  294.             scriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);
  295.             flag = scriptPattern.matcher(value).find();
  296.             if (flag) {
  297.                 return flag;
  298.             }
  299.             // Avoid vbscript:... expressions
  300.             scriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);
  301.             flag = scriptPattern.matcher(value).find();
  302.             if (flag) {
  303.                 return flag;
  304.             }
  305.             // Avoid οnlοad= expressions
  306.             scriptPattern = Pattern.compile("onload(.*?)=",
  307.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  308.             flag = scriptPattern.matcher(value).find();
  309.             if (flag) {
  310.                 return flag;
  311.             }
  312.  
  313.             flag = checkSqlKeyWords(value);
  314.         }
  315.         return flag;
  316.     }
  317.  
  318.     public boolean checkSqlKeyWords(String value){
  319.         String paramValue = value;
  320.         for (String keyword : notAllowedKeyWords) {
  321.             if (paramValue.length() > keyword.length() + 4
  322.                     && (paramValue.contains(" "+keyword)||paramValue.contains(keyword+" ")||paramValue.contains(" "+keyword+" "))) {
  323.  
  324.                 logger.error(this.getRequestURI()+ "参数中包含不允许sql的关键词(" + keyword
  325.                         + ")");
  326.                 return true;
  327.             }
  328.         }
  329.         return false;
  330.     }
  331.  
  332.     public final boolean checkParameter() {
  333.         @SuppressWarnings({ "unchecked", "rawtypes" })
  334.         Map<String, String[]> submitParams = new HashMap(parameterMap);
  335.  
  336.         Set<String> submitNames = submitParams.keySet();
  337.         for (String submitName : submitNames) {
  338.             Object submitValues = submitParams.get(submitName);
  339.             if ((submitValues instanceof String)) {
  340.                 if (checkXSSAndSql((String) submitValues)) {
  341.                     return true;
  342.                 }
  343.             } else if ((submitValues instanceof String[])) {
  344.                 for (String submitValue : (String[])submitValues){
  345.                     if (checkXSSAndSql(submitValue)) {
  346.                         return true;
  347.                     }
  348.                 }
  349.             }
  350.         }
  351.         return false;
  352.     }
  353.  
  354.     @Override
  355.     public BufferedReader getReader() throws IOException {
  356.         return new BufferedReader(new InputStreamReader(getInputStream()));
  357.     }
  358.  
  359.     @Override
  360.     public ServletInputStream getInputStream() throws IOException {
  361.         final ByteArrayInputStream bais = new ByteArrayInputStream(body);
  362.         return new ServletInputStream() {
  363.             @Override
  364.             public int read() throws IOException {
  365.                 return bais.read();
  366.             }
  367.  
  368.             @Override
  369.             public boolean isFinished() {
  370.                 // TODO Auto-generated method stub
  371.                 return false;
  372.             }
  373.  
  374.             @Override
  375.             public boolean isReady() {
  376.                 // TODO Auto-generated method stub
  377.                 return false;
  378.             }
  379.  
  380.             @Override
  381.             public void setReadListener(ReadListener arg0) {
  382.                 // TODO Auto-generated method stub
  383.             }
  384.         };
  385.     }
  386.  
  387. }

2. 创建防注入开关工具类

  1. import org.springframework.beans.factory.annotation.Value;
  2. import org.springframework.stereotype.Component;
  3.  
  4. /**
  5.  * @Description: 注入防护开关工具类
  6.  */
  7. @Component
  8. public class CrosXssFilterConfigUtil {
  9.  
  10.     /**
  11.      * 注入防护开关配置
  12.      */
  13.     public static Boolean openFilter;
  14.  
  15.     /**
  16.      * 注入防护开关配置，默认为开启
  17.      */
  18.     public static Boolean getOpenFilterProtect() {
  19.         return openFilter == null ? true : openFilter;
  20.     }
  21.  
  22.     @Value("${api.filter}")
  23.     public void setOpenFilter(Boolean openFilter) {
  24.         CrosXssFilterConfigUtil.openFilter = openFilter;
  25.     }
  26.  
  27. }

yml配置：

  1. api:
  2.     filter: true

3. 把请求过滤类XssAndSqlHttpServletRequestWrapper添加到Filter中，注入容器

  1. import com.example.util.CrosXssFilterConfigUtil;
  2. import com.example.wrapper.XssAndSqlHttpServletRequestWrapper;
  3. import org.apache.commons.lang3.StringUtils;
  4. import org.springframework.stereotype.Component;
  5.  
  6. import javax.servlet.*;
  7. import javax.servlet.annotation.WebFilter;
  8. import javax.servlet.http.HttpServletRequest;
  9. import javax.servlet.http.HttpServletResponse;
  10. import java.io.BufferedReader;
  11. import java.io.IOException;
  12. import java.io.PrintWriter;
  13.  
  14. /**
  15.  *  SQL && XSS过滤器
  16.  */
  17. @WebFilter
  18. @Component
  19. public class CrosXssFilterConfig implements Filter {
  20.  
  21.     @Override
  22.     public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
  23.  
  24.         HttpServletRequest request = (HttpServletRequest) servletRequest;
  25.         ServletResponse response = servletResponse;
  26.  
  27.  
  28.         // 如果防注入关闭，则不执行后续校验操作
  29.         if(!CrosXssFilterConfigUtil.getOpenFilterProtect()) {
  30.             filterChain.doFilter(request,response);
  31.         }else{
  32.             XssAndSqlHttpServletRequestWrapper xssRequest = new XssAndSqlHttpServletRequestWrapper(request);
  33.             String method = ((HttpServletRequest) request).getMethod();
  34.  
  35.             String param = "";
  36.  
  37.             if ("POST".equalsIgnoreCase(method)) {
  38.                 param = this.getBodyString(xssRequest.getReader());
  39.                 if(StringUtils.isNotBlank(param)){
  40.                     if(xssRequest.checkXSSAndSql(param)){
  41.                         servletResponse.setCharacterEncoding("UTF-8");
  42.                         servletResponse.setContentType("application/json;charset=UTF-8");
  43.                         PrintWriter out = servletResponse.getWriter();
  44.                         out.write("param is invalid");
  45.                         return;
  46.                     }
  47.                 }
  48.             }
  49.  
  50.             if (xssRequest.checkParameter()) {
  51.                 servletResponse.setCharacterEncoding("UTF-8");
  52.                 servletResponse.setContentType("application/json;charset=UTF-8");
  53.                 PrintWriter out = servletResponse.getWriter();
  54.                 out.write("param is invalid");
  55.                 return;
  56.             }
  57.  
  58.             filterChain.doFilter(xssRequest, servletResponse);
  59.         }
  60.     }
  61.  
  62.  
  63.     // 获取request请求body中参数
  64.     public String getBodyString(BufferedReader br) {
  65.         String inputLine;
  66.         String str = "";
  67.         try {
  68.             while ((inputLine = br.readLine()) != null) {
  69.                 str += inputLine;
  70.             }
  71.             br.close();
  72.         } catch (IOException e) {
  73.             e.printStackTrace();
  74.         }
  75.         return str;
  76.     }
  77.  
  78.     @Override
  79.     public void destroy() {
  80.  
  81.     }
  82.  
  83. }

 完成！

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/weixin_40725706/article/detail/131099
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号