XSS注入,js脚本注入后台

曾经一度流行sql注入，由于现在技术的更新，已经看不到这问题了，但是又出来新的安全问题,XSS攻击，他的原理就是在前端提交表单的时候，在input标签当中输入js脚本，通过js脚本注入后台，请看下图.

 

 

这里用用原生servlet做说明，帮助大家理解。

以下是我项目的路径

 

 

以上是我的项目结构。首先需要配置pom.xml把jar下载，第二步新建，XSSFilete.java这是一个过滤器。然后新建XSSRequest，这是相当于HttpServlet的子类，重写getParmeter方法。DoFromServlet主要是用来测试的，通过前端传js脚本避免出现XSS攻击。

1.配置pom.xml

<project xmlns=

"http://maven.apache.org/POM/4.0.0"

xmlns:xsi=

"http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation=

"http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"

>

<modelVersion>4.0.0</modelVersion>

<groupId>com.itmayideu.xss</groupId>

<artifactId>

xssfilter

</artifactId>

<version>0.0.1-SNAPSHOT</version>

<packaging>war</packaging>

<build/>

<dependencies>

<dependency>

<groupId>org.apache.commons</groupId>

<artifactId>commons-lang3</artifactId>

<version>3.4</version>

</dependency>

<dependency>

<groupId>javax.servlet</groupId>

<artifactId>javax.servlet-

api

</artifactId>

<version>3.0.1</version>

<scope>provided</scope>

</dependency>

<dependency>

<groupId>javax.servlet.jsp</groupId>

<artifactId>

jsp

-

api

</artifactId>

<version>2.1</version>

<scope>provided</scope>

</dependency>

</dependencies>

</project>

第二步:

编写XSSFilete过滤器

package com.sunjian.xssfilter;

import java.io.IOException;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

public class XSSFilete implements Filter{

@Override

public void init(FilterConfig arg0) throws ServletException {

}

@Override

public void doFilter(ServletRequest request, ServletResponse response,

FilterChain chain) throws IOException, ServletException {

//解决XSS攻击手段思路，将表单提交的参数全部转换成html语言进行保存

HttpServletRequest req = (HttpServletRequest) request;

XSSRequest httpServletRequestWrapper = new XSSRequest(req);

chain.doFilter(httpServletRequestWrapper, response);

}

@Override

public void destroy() {

}

}

第三步:XSSRequest继承HttpServletRequestWrapper

package com.sunjian.xssfilter;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;

import org.apache.commons.lang3.StringEscapeUtils;

import org.apache.commons.lang3.StringUtils;

public class XSSRequest extends HttpServletRequestWrapper{

HttpServletRequest request;

public XSSRequest(HttpServletRequest request) {

super(request);

this.request = request;

}

/**

* 重写方法

*/

@Override

public String getParameter(String name) {

String value = request.getParameter(name);

if(!StringUtils.isEmpty(value)){

System.out.println("转换前value:"+value);

// 将value转换成html,就是会将一些脚本元素转换成html进行返回。

value = StringEscapeUtils.escapeHtml4(value);

System.out.println("转换后value:"+value);

}

return value;

}

}

第四部编写DoFromServlet接口

package com.sunjian.xssfilter;

import java.io.IOException;

import javax.servlet.ServletException;

import javax.servlet.annotation.WebServlet;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

@WebServlet("/DoFromServlet")

public class DoFromServlet extends HttpServlet{

@Override

protected void doPost(HttpServletRequest req, HttpServletResponse resp)

throws ServletException, IOException {

System.out.println("DoFromServlet");

String userName = req.getParameter("userName");

req.setAttribute("userName", userName);

//将参数转发到另一个页面进行展示。

req.getRequestDispatcher("showUserName.jsp").forward(req, resp);

}

}

第五步:配置web.xml,配置过滤器

<?xml version=

"1.0"

encoding=

"UTF-8"

?>

<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.2//EN" "http://java.sun.com/j2ee/dtds/web-app_2_2.dtd">

<web-app id=

"WebApp_ID"

>

<display-name>

xssfilter

</display-name>

<welcome-file-list>

<welcome-file>index.html</welcome-file>

<welcome-file>index.htm</welcome-file>

<welcome-file>index.jsp</welcome-file>

<welcome-file>default.html</welcome-file>

<welcome-file>default.htm</welcome-file>

<welcome-file>default.jsp</welcome-file>

</welcome-file-list>

<filter>

<filter-class>com.sunjian.xssfilter.XSSFilete</filter-class>

<filter-name>XSSFilete</filter-name>

</filter>

<filter-mapping>

<filter-name>XSSFilete</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

</web-app>

第六步:编写前端form.jsp

<%@ page language=

"java"

contentType=

"text/html; charset=UTF-8"

pageEncoding=

"UTF-8"

%>

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>

<head>

<meta http-equiv=

"Content-Type"

content=

"text/html; charset=UTF-8"

>

<title>Insert title here</title>

</head>

<body>

<form action=

"DoFromServlet"

method=

"post"

>

用户名是<input type=

"text"

name=

"userName"

>

<input type=

"submit"

value=

"提交"

>

</form>

</body>

</html>

第七部:showUserName.jsp

<%@ page language=

"java"

contentType=

"text/html; charset=UTF-8"

pageEncoding=

"UTF-8"

%>

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<%@ page isELIgnored=

"false"

%>

<html>

<head>

<meta http-equiv=

"Content-Type"

content=

"text/html; charset=UTF-8"

>

<title>Insert title here</title>

</head>

<body>

<h1>测试index.jsp</h1>

用户名是::${userName}

&gt;

</body>

</html>

最终的效果:

 

 

 

 

以上是相关代码。其实XSS攻击就是通过前端input将js脚本注入到后台，解决原理是将<script>中的>转换成&gt;  来解决XSS攻击

原文链接:

http://www.jianshu.com/p/7e259660f7ee