devbox
小惠珠哦
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

SpringBoot 防止XSS攻击和SQL攻击拦截器(Filter)_xssandsqlfilter

作者：小惠珠哦 | 2024-08-03 05:15:55

赞

踩

xssandsqlfilter

什么是SQL攻击、什么是XSS攻击

SQL 攻击:把SQL命令插入到Web表单并提交,欺骗服务器执行恶意的SQL命令。

XSS 攻击:向有XSS漏洞的网站中输入(传入)恶意的HTML代码，当其它用户浏览该网站时，这段HTML代码会自动执行，从而达到攻击的目的。

创建拦截器第一步：

创建XssAndSqlHttpServletRequestWrapper包装器，这是实现XSS和SQL过滤的关键，在其内重写了getParameter，getParameterValues，getHeader等方法，对http请求内的参数进行了过滤。

  1. import java.io.BufferedReader;
  2. import java.io.ByteArrayInputStream;
  3. import java.io.IOException;
  4. import java.io.InputStreamReader;
  5. import java.util.Enumeration;
  6. import java.util.HashMap;
  7. import java.util.Map;
  8. import java.util.Set;
  9. import java.util.Vector;
  10. import java.util.regex.Pattern;
  11.  
  12. import javax.servlet.ReadListener;
  13. import javax.servlet.ServletInputStream;
  14. import javax.servlet.http.HttpServletRequest;
  15. import javax.servlet.http.HttpServletRequestWrapper;
  16.  
  17. import org.springframework.util.StreamUtils;
  18.  
  19. public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {
  20.  
  21. 	HttpServletRequest orgRequest = null;
  22. 	private Map<String, String[]> parameterMap;
  23. 	private final byte[] body; // 用于保存读取body中数据
  24.  
  25. 	public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException {
  26. 		super(request);
  27. 		orgRequest = request;
  28. 		parameterMap = request.getParameterMap();
  29. 		body = StreamUtils.copyToByteArray(request.getInputStream());
  30. 	}
  31. 	
  32. 	// 重写几个HttpServletRequestWrapper中的方法
  33.     /**
  34.      * 获取所有参数名
  35.      *
  36.      * @return 返回所有参数名
  37.      */
  38.     @Override
  39.     public Enumeration<String> getParameterNames() {
  40.         Vector<String> vector = new Vector<String>(parameterMap.keySet());
  41.         return vector.elements();
  42.     }
  43.  
  44.     /**
  45.      * 覆盖getParameter方法，将参数名和参数值都做xss & sql过滤。<br/>
  46.      * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>
  47.      * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
  48.      */
  49.     @Override
  50.     public String getParameter(String name) {
  51.         String[] results = parameterMap.get(name);
  52.         if (results == null || results.length <= 0)
  53.             return null;
  54.         else {
  55.             String value = results[0];
  56.             if (value != null) {
  57.                 value = xssEncode(value);
  58.             }
  59.             return value;
  60.         }
  61.     }
  62.  
  63.     /**
  64.      * 获取指定参数名的所有值的数组，如：checkbox的所有数据 接收数组变量 ，如checkobx类型
  65.      */
  66.     @Override
  67.     public String[] getParameterValues(String name) {
  68.         String[] results = parameterMap.get(name);
  69.         if (results == null || results.length <= 0)
  70.             return null;
  71.         else {
  72.             int length = results.length;
  73.             for (int i = 0; i < length; i++) {
  74.                 results[i] = xssEncode(results[i]);
  75.             }
  76.             return results;
  77.         }
  78.     }
  79.  
  80.     /**
  81.      * 覆盖getHeader方法，将参数名和参数值都做xss & sql过滤。<br/>
  82.      * 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>
  83.      * getHeaderNames 也可能需要覆盖
  84.      */
  85.     @Override
  86.     public String getHeader(String name) {
  87.  
  88.         String value = super.getHeader(xssEncode(name));
  89.         if (value != null) {
  90.             value = xssEncode(value);
  91.         }
  92.         return value;
  93.     }
  94.     
  95.     /**
  96.      * 将容易引起xss & sql漏洞的半角字符直接替换成全角字符
  97.      *
  98.      * @param s
  99.      * @return
  100.      */
  101.     private static String xssEncode(String s) {
  102.         if (s == null || s.isEmpty()) {
  103.             return s;
  104.         } else {
  105.             s = stripXSSAndSql(s);
  106.         }
  107.         StringBuilder sb = new StringBuilder(s.length() + 16);
  108.         for (int i = 0; i < s.length(); i++) {
  109.             char c = s.charAt(i);
  110.             switch (c) {
  111.                 case '>':
  112.                     sb.append("＞");// 转义大于号
  113.                     break;
  114.                 case '<':
  115.                     sb.append("＜");// 转义小于号
  116.                     break;
  117.                 // case '\'':
  118.                 // sb.append("＇");// 转义单引号
  119.                 // break;
  120.                 // case '\"':
  121.                 // sb.append("＂");// 转义双引号
  122.                 // break;
  123.                 case '&':
  124.                     sb.append("＆");// 转义&
  125.                     break;
  126.                 case '#':
  127.                     sb.append("＃");// 转义#
  128.                     break;
  129.                 default:
  130.                     sb.append(c);
  131.                     break;
  132.             }
  133.         }
  134.         return sb.toString();
  135.     }
  136.     
  137.     /**
  138.      * 获取最原始的request
  139.      *
  140.      * @return
  141.      */
  142.     public HttpServletRequest getOrgRequest() {
  143.         return orgRequest;
  144.     }
  145.     
  146.     /**
  147.      * 审查参数的具体方法
  148.      * @param value
  149.      * @return
  150.      */
  151.     public static boolean checkXSSAndSql(String value) {
  152.         boolean flag = false;
  153.         if (value != null) {
  154.             // NOTE: It's highly recommended to use the ESAPI library and
  155.             // uncomment the following line to
  156.             // avoid encoded attacks.
  157.             // value = ESAPI.encoder().canonicalize(value);
  158.             // Avoid null characters
  159.             /** value = value.replaceAll("", ""); ***/
  160.             // Avoid anything between script tags
  161.             Pattern scriptPattern = Pattern.compile(
  162.                     "<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);
  163.             flag = scriptPattern.matcher(value).find();
  164.             if (flag) {
  165.                 return flag;
  166.             }
  167.             // Avoid anything in a
  168.             // src="http://www.yihaomen.com/article/java/..." type of
  169.             // e-xpression
  170.             scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",
  171.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  172.             flag = scriptPattern.matcher(value).find();
  173.             if (flag) {
  174.                 return flag;
  175.             }
  176.             // Remove any lonesome </script> tag
  177.             scriptPattern = Pattern.compile("</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);
  178.             flag = scriptPattern.matcher(value).find();
  179.             if (flag) {
  180.                 return flag;
  181.             }
  182.             // Remove any lonesome <script ...> tag
  183.             scriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>",
  184.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  185.             flag = scriptPattern.matcher(value).find();
  186.             if (flag) {
  187.                 return flag;
  188.             }
  189.             // Avoid eval(...) expressions
  190.             scriptPattern = Pattern.compile("eval\\((.*?)\\)",
  191.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  192.             flag = scriptPattern.matcher(value).find();
  193.             if (flag) {
  194.                 return flag;
  195.             }
  196.             // Avoid e-xpression(...) expressions
  197.             scriptPattern = Pattern.compile("e-xpression\\((.*?)\\)",
  198.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  199.             flag = scriptPattern.matcher(value).find();
  200.             if (flag) {
  201.                 return flag;
  202.             }
  203.             // Avoid javascript:... expressions
  204.             scriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);
  205.             flag = scriptPattern.matcher(value).find();
  206.             if (flag) {
  207.                 return flag;
  208.             }
  209.             // Avoid vbscript:... expressions
  210.             scriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);
  211.             flag = scriptPattern.matcher(value).find();
  212.             if (flag) {
  213.                 return flag;
  214.             }
  215.             // Avoid οnlοad= expressions
  216.             scriptPattern = Pattern.compile("onload(.*?)=",
  217.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  218.             flag = scriptPattern.matcher(value).find();
  219.             if (flag) {
  220.                 return flag;
  221.             }
  222.             scriptPattern = Pattern.compile("\\b(and|exec|insert|select|drop|grant|alter|delete|update|count|chr|mid|master|truncate|char|declare|or)\\b|(\\*|;|\\+|'|%)",
  223.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  224.             flag = scriptPattern.matcher(value).find();
  225.             if (flag) {
  226.                 return flag;
  227.             }
  228.         }
  229.         return flag;
  230.     }
  231.  
  232.     /**
  233.      * 检查参数方法
  234.      * @return
  235.      */
  236.     public final boolean checkParameter() {
  237.         Map<String, String[]> submitParams = new HashMap(parameterMap);
  238.         Set<String> submitNames = submitParams.keySet();
  239.         for (String submitName : submitNames) {
  240.             Object submitValues = submitParams.get(submitName);
  241.             if ((submitValues instanceof String)) {
  242.                 if (checkXSSAndSql((String) submitValues)) {
  243.                     return true;
  244.                 }
  245.             } else if ((submitValues instanceof String[])) {
  246.                 for (String submitValue : (String[])submitValues){
  247.                     if (checkXSSAndSql(submitValue)) {
  248.                         return true;
  249.                     }
  250.                 }
  251.             }
  252.         }
  253.         return false;
  254.     }
  255.  
  256.     /**
  257.      * 获取最原始的request的静态方法
  258.      *
  259.      * @return
  260.      */
  261.     public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
  262.         if (req instanceof XssAndSqlHttpServletRequestWrapper) {
  263.             return ((XssAndSqlHttpServletRequestWrapper) req).getOrgRequest();
  264.         }
  265.         return req;
  266.     }
  267.  
  268.     /**
  269.      *
  270.      * 防止xss跨脚本攻击（替换，根据实际情况调整）
  271.      */
  272.  
  273.     public static String stripXSSAndSql(String value) {
  274.         if (value != null) {
  275.             // NOTE: It's highly recommended to use the ESAPI library and
  276.             // uncomment the following line to
  277.             // avoid encoded attacks.
  278.             // value = ESAPI.encoder().canonicalize(value);
  279.             // Avoid null characters
  280.             /** value = value.replaceAll("", ""); ***/
  281.             // Avoid anything between script tags
  282.             Pattern scriptPattern = Pattern.compile(
  283.                     "<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);
  284.             value = scriptPattern.matcher(value).replaceAll("");
  285.             // Avoid anything in a
  286.             // src="http://www.yihaomen.com/article/java/..." type of
  287.             // e-xpression
  288.             scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",
  289.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  290.             value = scriptPattern.matcher(value).replaceAll("");
  291.             // Remove any lonesome </script> tag
  292.             scriptPattern = Pattern.compile("</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);
  293.             value = scriptPattern.matcher(value).replaceAll("");
  294.             // Remove any lonesome <script ...> tag
  295.             scriptPattern = Pattern.compile("<[\r\n| | ]*script(.*?)>",
  296.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  297.             value = scriptPattern.matcher(value).replaceAll("");
  298.             // Avoid eval(...) expressions
  299.             scriptPattern = Pattern.compile("eval\\((.*?)\\)",
  300.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  301.             value = scriptPattern.matcher(value).replaceAll("");
  302.             // Avoid e-xpression(...) expressions
  303.             scriptPattern = Pattern.compile("e-xpression\\((.*?)\\)",
  304.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  305.             value = scriptPattern.matcher(value).replaceAll("");
  306.             // Avoid javascript:... expressions
  307.             scriptPattern = Pattern.compile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);
  308.             value = scriptPattern.matcher(value).replaceAll("");
  309.             // Avoid vbscript:... expressions
  310.             scriptPattern = Pattern.compile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);
  311.             value = scriptPattern.matcher(value).replaceAll("");
  312.             // Avoid οnlοad= expressions
  313.             scriptPattern = Pattern.compile("onload(.*?)=",
  314.                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
  315.             value = scriptPattern.matcher(value).replaceAll("");
  316.         }
  317.         return value;
  318.     }
  319.     
  320.     /**
  321.      **application/x- www-form-urlencoded是Post请求默认的请求体内容类型，也是form表单默认的类型。
  322.      * Servlet API规范中对该类型的请求内容提供了request.getParameter()方法来获取请求参数值。
  323.      * 但当请求内容不是该类型时，需要调用request.getInputStream()或request.getReader()方法来获取请求内容值。
  324.      */
  325.     /**
  326.      * 获取请求内容
  327.      * @return
  328.      * @throws IOException
  329.      */
  330.     @Override
  331.     public BufferedReader getReader() throws IOException {
  332.         return new BufferedReader(new InputStreamReader(getInputStream()));
  333.     }
  334.  
  335.     /**
  336.      * 返回请求内容字节流，多用于文件上传，
  337.      * request.getReader()是对前者返回内容的封装，可以让调用者更方便字符内容的处理（不用自己先获取字节流再做字符流的转换操作）
  338.      * @return
  339.      * @throws IOException
  340.      */
  341.     @Override
  342.     public ServletInputStream getInputStream() throws IOException {
  343.         final ByteArrayInputStream bais = new ByteArrayInputStream(body);
  344.         return new ServletInputStream() {
  345.  
  346.             @Override
  347.             public int read() throws IOException {
  348.                 return bais.read();
  349.             }
  350.  
  351.             @Override
  352.             public boolean isFinished() {
  353.                 // TODO Auto-generated method stub
  354.                 return false;
  355.             }
  356.  
  357.             @Override
  358.             public boolean isReady() {
  359.                 // TODO Auto-generated method stub
  360.                 return false;
  361.             }
  362.  
  363.             @Override
  364.             public void setReadListener(ReadListener arg0) {
  365.                 // TODO Auto-generated method stub
  366.  
  367.             }
  368.         };
  369.     }
  370.  
  371. }

创建拦截器第二步：

编写过滤器

  1.  
  2.  
  3. import java.io.BufferedReader;
  4. import java.io.IOException;
  5. import java.io.PrintWriter;
  6.  
  7. import javax.servlet.Filter;
  8. import javax.servlet.FilterChain;
  9. import javax.servlet.ServletException;
  10. import javax.servlet.ServletRequest;
  11. import javax.servlet.ServletResponse;
  12. import javax.servlet.http.HttpServletRequest;
  13.  
  14. import org.apache.commons.lang3.StringUtils;
  15.  
  16. import com.alibaba.fastjson.JSONObject;
  17. import com.digipower.common.entity.Result;
  18. import com.digipower.http.servlet.request.wrapper.XssAndSqlHttpServletRequestWrapper;
  19.  
  20. /**
  21.  * 防止XSS 攻击和SQL注入攻击的Filter
  22.  * @ClassName:  XssAndSqlFilter   
  23.  * @Description:TODO(这里用一句话描述这个类的作用)   
  24.  * @author:
  25.  * @date:   2021年3月22日 下午2:29:12   
  26.  *     
  27.  * @Copyright: 2021 www.digipower.cn 
  28.  * 注意：
  29.  */
  30. public class XssAndSqlFilter implements Filter {
  31.  
  32. 	@Override
  33. 	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
  34. 			throws IOException, ServletException {
  35. 		 String method = "GET";//设置初始值
  36. 	        String param = "";
  37. 	        XssAndSqlHttpServletRequestWrapper xssRequest = null;
  38. 	        if (request instanceof HttpServletRequest) {//判断左边的对象是否是它右边对象的实例
  39. 	            method = ((HttpServletRequest) request).getMethod();//得到请求URL地址时使用的方法
  40. 	            xssRequest = new XssAndSqlHttpServletRequestWrapper((HttpServletRequest) request);//创建对象
  41. 	        }
  42. 	        if ("POST".equalsIgnoreCase(method)) {//判断是否为post
  43. 	            param = this.getBodyString(xssRequest.getReader());//获取参数
  44. 	            if(StringUtils.isNotBlank(param)){//等价于 str != null && str.length > 0 && str.trim().length > 0
  45. 	                if(xssRequest.checkXSSAndSql(param)){//进行参数审查
  46. 	                    response.setCharacterEncoding("UTF-8");
  47. 	                    response.setContentType("application/json;charset=UTF-8");
  48. 	                    PrintWriter out = response.getWriter();
  49. 	                    out.write(JSONObject.toJSONString(Result.error("401", "您所访问的页面请求中有违反安全规则元素存在，拒绝访问!")));
  50. 	                    return;
  51. 	                }
  52. 	            }
  53. 	        }
  54.  
  55. 	        /**
  56. 	         * 检查参数的时候 同时检查请求的方法
  57. 	         * 只检查get请求方法和post请求方法的的参数的数据是否合法
  58. 	         * 并不是所有参数都要检查，首先必须是一个get或者post，再去校验参数
  59. 	         * 因为PUT方法在进行参数审查的时候没办法通过所以直接过滤掉
  60. 	         */
  61. 	        if (xssRequest.checkParameter()&&(method.equals("POST") || method.equals("GET"))){
  62. 	            response.setCharacterEncoding("UTF-8");
  63. 	            response.setContentType("application/json;charset=UTF-8");
  64. 	            PrintWriter out = response.getWriter();
  65. 	            out.write(JSONObject.toJSONString(Result.error("401", "您所访问的页面请求中有违反安全规则元素存在，拒绝访问!")));
  66. 	            return;
  67. 	        }
  68. 	        chain.doFilter(xssRequest, response);
  69. 		
  70. 	}
  71. 	
  72. 	// 获取request请求body中参数
  73.     public static String getBodyString(BufferedReader br) {
  74.         String inputLine;
  75.         String str = "";
  76.         try {
  77.             while ((inputLine = br.readLine()) != null) {
  78.                 str += inputLine;
  79.             }
  80.             br.close();
  81.         } catch (IOException e) {
  82.             System.out.println("IOException: " + e);
  83.         }
  84.         return str;
  85.     }
  86.  
  87. }

创建拦截器第三步

在webconfig中注册过滤器XssAndSqlFilter

  1. @Configuration
  2. @EnableWebMvc
  3. public class SpringMVCConfig extends WebMvcConfigurerAdapter {
  4.     @Bean
  5. 	public FilterRegistrationBean xssFilterRegistrationBean() {
  6. 		// 创建一个自定义的 Filter
  7. 		FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();
  8. 		filterRegistrationBean.setFilter(new XssAndSqlFilter());
  9. 		filterRegistrationBean.setOrder(1);
  10. 		filterRegistrationBean.setEnabled(true);
  11. 		filterRegistrationBean.addUrlPatterns("/*");
  12. 		// 过滤指定请求地址
  13. 		Map<String, String> initParameters = new HashMap<String, String>();
  14. 		initParameters.put("excludes", "/auth/login,/auth/code,/auth/phone,/swagger-ui.html/**,/swagger-resources/**,/webjars/**,/v2/api-docs/**,/upload_file/**");
  15. 		initParameters.put("isIncludeRichText", "true");
  16. 		filterRegistrationBean.setInitParameters(initParameters);
  17. 		return filterRegistrationBean;
  18. 	}
  19.  
  20.  
  21. }

 

备注

  • excludes用于配置不需要参数过滤的请求url。

  • isIncludeRichText默认为true，主要用于设置富文本内容是否需要过滤。

 

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/小惠珠哦/article/detail/921548
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号