防止XSS攻击的方式

主要有三种请求方式，进行过滤替换非法符号

1.普通的GET请求数据：

2.FORM表单提交数据：

3.Json格式数据提交：

把下面5个文件放入项目中即可

 package com.joppay.admin.security.xss;

 import org.springframework.util.StringUtils;
 import org.springframework.web.util.HtmlUtils;

 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletRequestWrapper;

 /**
  * XSS转义
  *
  * @author leroy
  * @date 2019/3/6 18:08
  */
 public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {

     /**
      * Constructs a request object wrapping the given request.
      *
      * @param request The request to wrap
      * @throws IllegalArgumentException if the request is null
      */
     public XssHttpServletRequestWrapper(HttpServletRequest request) {
         super(request);
     }

     @Override
     public String getParameter(String name) {
         String value = super.getParameter(name);
         if (!StringUtils.isEmpty(value)) {
             value = HtmlUtils.htmlEscape(value);
         }
         return value;

     }

     @Override
     public String[] getParameterValues(String name) {
         String[] parameterValues = super.getParameterValues(name);
         if (parameterValues == null) {
             return null;
         }
         for (int i = 0; i < parameterValues.length; i++) {
             String value = parameterValues[i];
             parameterValues[i] = HtmlUtils.htmlEscape(value);
         }
         return parameterValues;

     }

 }

package com.joppay.admin.security.xss;

import com.fasterxml.jackson.databind.JavaType;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.http.HttpInputMessage;
import org.springframework.http.converter.HttpMessageNotReadableException;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;

import java.io.IOException;
import java.lang.reflect.Type;

public class XSSMappingJackson2HttpMessageConverter extends
        MappingJackson2HttpMessageConverter {

    private ObjectMapper mapper = new ObjectMapper();

    public XSSMappingJackson2HttpMessageConverter() {
        super();
        mapper.getFactory().setCharacterEscapes(new HTMLCharacterEscapes());
    }

    @Override
    public Object read(Type type, Class<?> contextClass,
                       HttpInputMessage inputMessage) throws IOException,
            HttpMessageNotReadableException {
        JavaType javaType = getJavaType(type, contextClass);
        // 下面的程式碼 將 @RequestBody 中的資料 做 XSS過濾
        try {
            // json字串转实体
            Object object = mapper.readValue(inputMessage.getBody(), javaType);

            // 实体转字串
            String jsonString = mapper.writeValueAsString(object);

            // json字串转实体
            object = mapper.readValue(jsonString, javaType);
            return object;
        } catch (IOException ex) {
            throw new HttpMessageNotReadableException("Could not read JSON: " + ex.getMessage(), ex);
        }

    }
}

 package com.joppay.admin.security.xss;

 import com.fasterxml.jackson.core.JsonGenerator;
 import com.fasterxml.jackson.databind.JsonSerializer;
 import com.fasterxml.jackson.databind.SerializerProvider;
 import org.springframework.web.util.HtmlUtils;

 import java.io.IOException;

 /**
  * json XSS过滤（Form表单对象）
  * @author leroy
  * @date 2019/3/6 18:15
  */
 public class XssStringJsonSerializer extends JsonSerializer<String> {
     @Override
     public Class<String> handledType() {
         return String.class;
     }

     @Override
     public void serialize(String value, JsonGenerator jsonGenerator,
                           SerializerProvider serializerProvider) throws IOException {
         if (value != null) {
             String encodedValue = HtmlUtils.htmlEscape(value);
             jsonGenerator.writeString(encodedValue);
         }
     }

 }

package com.joppay.admin.security.xss;

import com.fasterxml.jackson.core.SerializableString;
import com.fasterxml.jackson.core.io.CharacterEscapes;
import com.fasterxml.jackson.core.io.SerializedString;
import org.apache.commons.lang3.StringEscapeUtils;

public class HTMLCharacterEscapes  extends CharacterEscapes {

    private final int[] asciiEscapes;

    public HTMLCharacterEscapes() {
        // start with set of characters known to require escaping (double-quote, backslash etc)
        asciiEscapes = CharacterEscapes.standardAsciiEscapesForJSON();
        // and force escaping of a few others:
        asciiEscapes['<'] = CharacterEscapes.ESCAPE_CUSTOM;
        asciiEscapes['>'] = CharacterEscapes.ESCAPE_CUSTOM;
        asciiEscapes['&'] = CharacterEscapes.ESCAPE_CUSTOM;
        asciiEscapes['"'] = CharacterEscapes.ESCAPE_CUSTOM;
        asciiEscapes['\''] = CharacterEscapes.ESCAPE_CUSTOM;
    }

    @Override
    public int[] getEscapeCodesForAscii() {
        return asciiEscapes;
    }

    // and this for others; we don't need anything special here
    @Override
    public SerializableString getEscapeSequence(int ch) {
        return new SerializedString(StringEscapeUtils.escapeHtml4(Character.toString((char) ch)));
    }
}

package com.joppay.admin.security.xss;

import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.module.SimpleModule;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Primary;
import org.springframework.core.annotation.Order;
import org.springframework.http.MediaType;
import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
import java.util.ArrayList;
import java.util.List;

/**
 * XSS过滤
 *
 * @author leroy
 * @date 2019/3/6 18:13
 */
@WebFilter
@Component
public class XssFilter implements Filter {
    FilterConfig filterConfig = null;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        this.filterConfig = filterConfig;
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        XssHttpServletRequestWrapper xssRequestWrapper = new XssHttpServletRequestWrapper(req);
        chain.doFilter(xssRequestWrapper, response);
    }

    @Override
    public void destroy() {
        this.filterConfig = null;
    }

    @Bean
    public MappingJackson2HttpMessageConverter mappingJackson2HttpMessageConverter() {
        return new XSSMappingJackson2HttpMessageConverter();
    }
    @Bean
    public XssStringJsonSerializer xssStringJsonSerializer(){
        return new XssStringJsonSerializer();
    }
}