XSS 攻击的防御

　　xss攻击预防，网上有很多介绍，发现很多都是只能预防GET方式请求的xss攻击，并不能预防POST方式的xss攻击。主要是由于POST方式的参数只能用流的方式读取，且只能读取一次，经过多次尝试，自己总结并经过多次尝试之后，终于成功了，废话不多说，上代码。

参考主要网址：

http://blog.csdn.net/Lan_Xuan/article/details/73826065

http://blog.csdn.net/happylee6688/article/details/40660797

http://www.cnblogs.com/digdeep/p/4695348.html

http://www.cnblogs.com/443855539-wind/p/6055816.html

http://blog.csdn.net/angevin/article/details/53992698

maven依赖：

<dependency>
           <groupId>javax.servlet</groupId>
           <artifactId>javax.servlet-api</artifactId>
           <version>3.1.0</version>
           <scope>provided</scope>
       </dependency>
        
        <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-lang3 -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>3.0</version>
        </dependency>
        <dependency>
            <groupId>org.jboss.spec.javax.servlet</groupId>
            <artifactId>jboss-servlet-api_3.1_spec</artifactId>
            <version>1.0.0.Beta1</version>
        </dependency>

web.xml

     <filter>
         <filter-name>XssEscape</filter-name>
         <filter-class>com.*.webshell.XSSFilter</filter-class>
     </filter>
     <filter-mapping>
         <filter-name>XssEscape</filter-name>
         <url-pattern>/*</url-pattern>
         <dispatcher>REQUEST</dispatcher>
     </filter-mapping>

XFFFilter.java

 import java.io.IOException;

 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
 import javax.servlet.FilterConfig;
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;

 public class XSSFilter implements Filter {

     FilterConfig filterConfig = null;

     public void init(FilterConfig filterConfig) throws ServletException {
         this.filterConfig = filterConfig;
     }

     public void destroy() {
         this.filterConfig = null;
     }

     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
             throws IOException, ServletException {
         chain.doFilter(new XssHttpServletRequestWrapper((HttpServletRequest) request), response);
     }
 }

XssHttpServletRequestWrapper.java

 import java.io.BufferedReader;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.io.UnsupportedEncodingException;
 import java.nio.charset.Charset;

 import javax.servlet.ReadListener;
 import javax.servlet.ServletInputStream;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletRequestWrapper;

 public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
     boolean isUpData = false;// 判断是否是上传 上传忽略

     public XssHttpServletRequestWrapper(HttpServletRequest servletRequest) {
         super(servletRequest);
         String contentType = servletRequest.getContentType();
         if (null != contentType)
             isUpData = contentType.startsWith("multipart");
     }

     @Override
     public String[] getParameterValues(String parameter) {
         String[] values = super.getParameterValues(parameter);
         if (values == null) {
             return null;
         }
         int count = values.length;
         String[] encodedValues = new String[count];
         for (int i = 0; i < count; i++) {
             encodedValues[i] = cleanXSS(values[i]);
         }
         return encodedValues;
     }

     @Override
     public String getParameter(String parameter) {
         String value = super.getParameter(parameter);
         if (value == null) {
             return null;
         }
         return cleanXSS(value);
     }

     /**
      * 获取request的属性时，做xss过滤
      */
     @Override
     public Object getAttribute(String name) {
         Object value = super.getAttribute(name);
         if (null != value && value instanceof String) {
             value = cleanXSS((String) value);
         }
         return value;
     }

     @Override
     public String getHeader(String name) {

         String value = super.getHeader(name);
         if (value == null)
             return null;
         return cleanXSS(value);
     }

     private static String cleanXSS(String value) {
         //几种常见的web攻击:http://jingyan.baidu.com/article/0202781178e19e1bcc9ce5c7.html
         value = value.replaceAll("<", "&lt;").replaceAll(">", "&gt;");
         //%3C是URL对<字符的编码
         value = value.replaceAll("%3C", "&lt;").replaceAll("%3E", "&gt;");
         value = value.replaceAll("\\(", "(").replaceAll("\\)", ")");
         //%28是(转义后的字符编码 , %29是)转义后的字符编码
         value = value.replaceAll("%28", "(").replaceAll("%29", ")");
         //'是单引号ASCII编码后的表现形式
         value = value.replaceAll("'", "'");
         //eval() 函数可计算某个字符串，并执行其中的的 JavaScript 代码
         value = value.replaceAll("eval\\((.*)\\)", "");
         //防止如javascript:alert(doucment.cookie)可以看到当前站点的cookie（如果有的话）的攻击
         value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
 //        value = value.replaceAll("script", "");
         return value;
     }

     @Override
     public ServletInputStream getInputStream() {
         try {
             if (isUpData) {
                 return super.getInputStream();
             } else {

                 final ByteArrayInputStream bais = new ByteArrayInputStream(
                         inputHandlers(super.getInputStream()).getBytes("utf-8"));

                 return new ServletInputStream() {

                     @Override
                     public int read() throws IOException {
                         return bais.read();
                     }

                     @Override
                     public boolean isFinished() {
                         return false;
                     }

                     @Override
                     public boolean isReady() {
                         return false;
                     }

                     @Override
                     public void setReadListener(ReadListener readListener) {
                     }
                 };
             }
         } catch (UnsupportedEncodingException e) {
             e.printStackTrace();
         } catch (IOException e) {
             e.printStackTrace();
         }
         return null;

     }

     public String inputHandlers(ServletInputStream servletInputStream) {
         StringBuilder sb = new StringBuilder();
         BufferedReader reader = null;
         try {
             reader = new BufferedReader(new InputStreamReader(servletInputStream, Charset.forName("UTF-8")));
             String line = "";
             while ((line = reader.readLine()) != null) {
                 sb.append(line);
             }
         } catch (IOException e) {
             e.printStackTrace();
         } finally {
             if (servletInputStream != null) {
                 try {
                     servletInputStream.close();
                 } catch (IOException e) {
                     e.printStackTrace();
                 }
             }
             if (reader != null) {
                 try {
                     reader.close();
                 } catch (IOException e) {
                     e.printStackTrace();
                 }
             }
         }
         return cleanXSS(sb.toString());
     }
 }

如果XssHttpServletRequestWrapper.java类中没有标红的那个代码会报如下错误，主要是因为过滤的参数中有中文：

 org.springframework.http.converter.HttpMessageNotReadableException: Could not read JSON: Invalid UTF-8 start byte 0xb1
  at [Source: com.*.XssHttpServletRequestWrapper$1@6230dd4f; line: 1, column: 128]
  (through reference chain: com.*.entity.OrderTicket["address"]);
  nested exception is com.fasterxml.jackson.databind.JsonMappingException: Invalid UTF-8 start byte 0xb1
  at [Source: com.*.XssHttpServletRequestWrapper$1@6230dd4f; line: 1, column: 128]
  (through reference chain: com.*.entity.*["address"])