springboot2.x使用Jsoup防 XSS 攻击

XssFilter过滤器

package net.lofish.xpra.xss;

import org.apache.commons.lang3.StringUtils;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;


public class XssFilter implements Filter {

    
    private List excludeUrls = new ArrayList<>();

    
    private List excludeTags = new ArrayList<>();

    
    private List includeTags = new ArrayList<>();

    
    public boolean enabled = false;

    
    private String encoding = "UTF-8";

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
 String enabledStr = filterConfig.getInitParameter("enabled");
 String excludeUrlStr = filterConfig.getInitParameter("excludeUrls");
 String excludeTagStr = filterConfig.getInitParameter("excludeTagStr");
 String includeTagStr = filterConfig.getInitParameter("excludeTagStr");
 String encodingStr = filterConfig.getInitParameter("encoding");

 if (StringUtils.isNotEmpty(excludeUrlStr)) {
     String[] url = excludeUrlStr.split(",");
     Collections.addAll(this.excludeUrls, url);
 }

 if (StringUtils.isNotEmpty(excludeTagStr)) {
     String[] url = excludeTagStr.split(",");
     Collections.addAll(this.excludeTags, url);
 }

 if (StringUtils.isNotEmpty(excludeTagStr)) {
     String[] url = excludeTagStr.split(",");
     Collections.addAll(this.includeTags, url);
 }

 if (StringUtils.isNotEmpty(enabledStr)) {
     this.enabled = Boolean.parseBoolean(enabledStr);
 }

 if (StringUtils.isNotEmpty(encodingStr)) {
     this.encoding = encodingStr;
 }

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
 HttpServletRequest req = (HttpServletRequest) request;
 HttpServletResponse resp = (HttpServletResponse) response;
 if (handleExcludeUrls(req, resp)) {
     chain.doFilter(request, response);
     return;
 }

 XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest) request, encoding, excludeTags, includeTags );
 chain.doFilter(xssRequest, response);

    }

    private boolean handleExcludeUrls(HttpServletRequest request, HttpServletResponse response) {
 if (!enabled) {
     return true;
 }
 if (excludeUrls == null || excludeUrls.isEmpty()) {
     return false;
 }
 String url = request.getServletPath();
 for (String pattern : excludeUrls) {
     Pattern p = Pattern.compile("^" + pattern);
     Matcher m = p.matcher(url);
     if (m.find()) {
  return true;
     }
 }
 return false;
    }
}

一般情况下，我们都是通过request的parameter来传递参数。
但是，如果在某些场景下面，通过requestBody体(json等)，来传递相应参数应该怎么办？
这就要需要我们对request的inputStream来进行来过滤处理了

有个地方需要注意一下的:
servlet中inputStream只能一次读取，后续不能再次读取inputStream。Xss过滤器中读取了stream之后，后续如果其他逻辑涉及到inputStream读取，会抛出异常。那我们就需要想办法把已经读取的stream，重新放回到请求中。

import org.apache.commons.io.IOUtils;
import org.apache.commons.lang3.StringUtils;

import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.util.linkedHashMap;
import java.util.List;
import java.util.Map;



public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper{

    HttpServletRequest orgRequest;

    String encoding;

    HtmlFilter htmlFilter;

    private final static String JSON_CONTENT_TYPE =  "application/json";

    private final static String CONTENT_TYPE = "Content-Type";


    
    public XssHttpServletRequestWrapper( HttpServletRequest request, String encoding, List excludeTags, List includeTags ){
 super( request );
 orgRequest = request;
 this.encoding = encoding;
 this.htmlFilter = HtmlFilter.create( excludeTags, includeTags );
    }

    
    public XssHttpServletRequestWrapper( HttpServletRequest request, String encoding ){
 this( request, encoding, null, null  );
    }

    private String xssFilter( String input ){
 return htmlFilter.clean( input );
    }

    @Override
    public ServletInputStream getInputStream() throws IOException{
 // 非json处理
 if( !JSON_CONTENT_TYPE.equalsIgnoreCase( super.getHeader( CONTENT_TYPE ) ) ){
     return super.getInputStream();
 }
 InputStream in = super.getInputStream();
 String body = IOUtils.toString( in, encoding );
 IOUtils.closeQuietly( in );

 //空串处理直接返回
 if( StringUtils.isBlank( body ) ){
     return super.getInputStream();
 }

 // xss过滤
 body = xssFilter( body );
 return new RequestCachingInputStream( body.getBytes( encoding ) );

    }

    @Override
    public String getParameter( String name ){
 String value = super.getParameter( xssFilter( name ) );
 if( StringUtils.isNotBlank( value ) ){
     value = xssFilter( value );
 }
 return value;
    }

    @Override
    public String[] getParameterValues( String name ){
 String[] parameters = super.getParameterValues( name );
 if( parameters == null || parameters.length == 0 ){
     return null;
 }

 for( int i = 0; i < parameters.length; i++ ){
     parameters[i] = xssFilter( parameters[i] );
 }
 return parameters;
    }

    @Override
    public Map getParameterMap(){
 Map map = new linkedHashMap<>();
 Map parameters = super.getParameterMap();
 for( String key : parameters.keySet() ){
     String[] values = parameters.get( key );
     for( int i = 0; i < values.length; i++ ){
  values[i] = xssFilter( values[i] );
     }
     map.put( key, values );
 }
 return map;
    }

    @Override
    public String getHeader( String name ){
 String value = super.getHeader( xssFilter( name ) );
 if( StringUtils.isNotBlank( value ) ){
     value = xssFilter( value );
 }
 return value;
    }

    
    public HttpServletRequest getOrgRequest(){
 return orgRequest;
    }

    
    public static HttpServletRequest getOrgRequest( HttpServletRequest request ){
 if( request instanceof XssHttpServletRequestWrapper ){
     return ((XssHttpServletRequestWrapper) request).getOrgRequest();
 }
 return request;
    }

    
    private static class RequestCachingInputStream extends ServletInputStream {
 private final ByteArrayInputStream inputStream;
 public RequestCachingInputStream(byte[] bytes) {
     inputStream = new ByteArrayInputStream(bytes);
 }

 @Override
 public int read() throws IOException {
     return inputStream.read();
 }

 @Override
 public boolean isFinished() {
     return inputStream.available() == 0;
 }

 @Override
 public boolean isReady() {
     return true;
 }

 @Override
 public void setReadListener( ReadListener readListener ){
 }

    }

}

springboot2.2.4.RELEASE中注册Filter

@Configuration
public class XssFilterConfig {

    @Value("${xss.enabled:true}")
    private String enabled;

    @Value("${xss.excludes:}")
    private String excludes;

    @Value("${xss.includes$:}")
    private String includes;

    @Value("${xss.urlPatterns:/*}")
    private String urlPatterns;

    @Bean
    public FilterRegistrationBean xssFilterRegistrationBean() {
 FilterRegistrationBean registration = new FilterRegistrationBean<>();
 registration.setDispatcherTypes(DispatcherType.REQUEST);
 registration.setFilter(new XssFilter());
 registration.addUrlPatterns(urlPatterns.split(","));
 registration.setName("XssFilter");
 registration.setOrder(Integer.MAX_VALUE);
 Map initParameters = new HashMap();
 initParameters.put("excludes", excludes);
 initParameters.put("includes", excludes);
 initParameters.put("enabled", enabled);
 registration.setInitParameters(initParameters);
 return registration;
    }
}

测试

http://localhost:8080/demo/th/xss?abc=%3Ca%20href=%22http://www.baidu.com/a%22%20onclick=%22alert(1);%22%3Eabc%3C/a%3E%3Cscript%3Ealert(0);%3C/script%3E&abc=%3Cb%20style=%22xxx%22%20onclick=%22%3Cscript%3Ealert(0);%3C/script%3E%22%3Eabc%3C/%3E