XSS防御_Java

XSS防御

自定义json反序列化器

package cc.fedtech.filter;

import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.DeserializationContext;
import com.fasterxml.jackson.databind.JsonDeserializer;
import org.springframework.web.util.HtmlUtils;

import java.io.IOException;

public class XssJsonDeserializer extends JsonDeserializer {
 @Override
 public String deserialize(JsonParser jsonParser, DeserializationContext ctxt)
  throws IOException, JsonProcessingException {
     String value = jsonParser.getValueAsString();
     if (value != null) {
  //对于值进行HTML转义
  return HtmlUtils.htmlEscape(value);
     }
     return value;
 }

 @Override
 public Class handledType() {
     return String.class;
 }
    }


自定义json序列化器
package cc.fedtech.filter;

import com.fasterxml.jackson.core.JsonGenerator;
import com.fasterxml.jackson.databind.JsonSerializer;
import com.fasterxml.jackson.databind.SerializerProvider;
import org.springframework.web.util.HtmlUtils;

import java.io.IOException;

public class XssJsonSerializer extends JsonSerializer {
    @Override
    public Class handledType() { return String.class; }

    @Override
    public void serialize(String value, JsonGenerator jsonGenerator, SerializerProvider serializerProvider)
     throws IOException {
 if (value != null) {
     //对字符串进行HTML转义
     jsonGenerator.writeString(HtmlUtils.htmlEscape(value));
 }
    }
}

自定义拦截器
package com.fedtech.common.filter.xss;

import org.apache.commons.lang3.StringUtils;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;


@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class XssFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
     throws IOException, ServletException {
 String path = ((HttpServletRequest) request).getServletPath();
 if (path.equals("/")) {
     chain.doFilter(request, response);
 }
 if (StringUtils.containsAny(path, "/assets", "/templates", "/mapper","/oauth")) {
     chain.doFilter(request, response);
 }

 chain.doFilter(new XssRequestWrapper((HttpServletRequest) request), response);
    }

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void destroy() {

    }
}



请求参数处理
package cc.fedtech.filter;

import org.apache.commons.lang3.StringUtils;
import org.springframework.web.util.HtmlUtils;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.util.Arrays;

public class XssRequestWrapper extends HttpServletRequestWrapper {

    public XssRequestWrapper(HttpServletRequest request) {
 super(request);
    }

    @Override
    public String[] getParameterValues(String parameter) {
 //获取多个参数值的时候对所有参数值应用clean方法逐一清洁
 return Arrays.stream(super.getParameterValues(parameter)).map(this::clean).toArray(String[]::new);
    }

    @Override
    public String getHeader(String name) {
 //同样清洁请求头
 return clean(super.getHeader(name));
    }

    @Override
    public String getParameter(String parameter) {
 //获取参数单一值也要处理
 return clean(super.getParameter(parameter));
    }
    //clean方法就是对值进行HTML转义
    private String clean(String value) {
      return StringUtils.isEmpty(value)? "" : HtmlUtils.htmlEscape(value);
    }
}    

注册反序列化器
    //注册自定义的Jackson反序列器
    @Bean
    public Module xssModule() {
 SimpleModule module = new SimpleModule();
 module.addDeserializer(String.class, new XssJsonDeserializer());
 module.addSerializer(String.class, new XssJsonSerializer());
 return module;
    }

XSS防御

Java相关栏目本月热门文章