chenrui
3 years ago
11 changed files with 29 additions and 233 deletions
@ -1,196 +0,0 @@ |
|||||
package com.zdxt.auth.framework.config; |
|
||||
|
|
||||
import cn.hutool.http.HttpException; |
|
||||
import org.slf4j.Logger; |
|
||||
import org.slf4j.LoggerFactory; |
|
||||
|
|
||||
import javax.servlet.ReadListener; |
|
||||
import javax.servlet.ServletInputStream; |
|
||||
import javax.servlet.ServletOutputStream; |
|
||||
import javax.servlet.http.HttpServletRequest; |
|
||||
import javax.servlet.http.HttpServletRequestWrapper; |
|
||||
import javax.servlet.http.HttpServletResponse; |
|
||||
import java.io.BufferedReader; |
|
||||
import java.io.ByteArrayInputStream; |
|
||||
import java.io.IOException; |
|
||||
import java.io.InputStreamReader; |
|
||||
import java.nio.charset.Charset; |
|
||||
import java.util.regex.Matcher; |
|
||||
import java.util.regex.Pattern; |
|
||||
|
|
||||
public class XssHttpServletRequestWraper extends HttpServletRequestWrapper { |
|
||||
|
|
||||
Logger log = LoggerFactory.getLogger(this.getClass()); |
|
||||
|
|
||||
|
|
||||
public XssHttpServletRequestWraper() { |
|
||||
super(null); |
|
||||
} |
|
||||
|
|
||||
public XssHttpServletRequestWraper(HttpServletRequest httpservletrequest) { |
|
||||
super(httpservletrequest); |
|
||||
} |
|
||||
|
|
||||
//过滤springmvc中的 @RequestParam 注解中的参数
|
|
||||
public String[] getParameterValues(String s) { |
|
||||
|
|
||||
String str[] = super.getParameterValues(s); |
|
||||
if (str == null) { |
|
||||
return null; |
|
||||
} |
|
||||
int i = str.length; |
|
||||
String as1[] = new String[i]; |
|
||||
for (int j = 0; j < i; j++) { |
|
||||
//System.out.println("getParameterValues:"+str[j]);
|
|
||||
as1[j] = cleanXSS(cleanSQLInject(str[j])); |
|
||||
} |
|
||||
log.info("XssHttpServletRequestWraper净化后的请求为：==========" + as1); |
|
||||
return as1; |
|
||||
} |
|
||||
|
|
||||
//过滤request.getParameter的参数
|
|
||||
public String getParameter(String s) { |
|
||||
String s1 = super.getParameter(s); |
|
||||
if (s1 == null) { |
|
||||
return null; |
|
||||
} else { |
|
||||
String s2 = cleanXSS(cleanSQLInject(s1)); |
|
||||
log.info("XssHttpServletRequestWraper净化后的请求为：==========" + s2); |
|
||||
return s2; |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
//过滤请求体 json 格式的
|
|
||||
@Override |
|
||||
public ServletInputStream getInputStream() throws IOException { |
|
||||
final ByteArrayInputStream bais = new ByteArrayInputStream(inputHandlers(super.getInputStream ()).getBytes ()); |
|
||||
|
|
||||
return new ServletInputStream() { |
|
||||
|
|
||||
@Override |
|
||||
public int read() throws IOException { |
|
||||
return bais.read(); |
|
||||
} |
|
||||
|
|
||||
@Override |
|
||||
public boolean isFinished() { |
|
||||
return false; |
|
||||
} |
|
||||
|
|
||||
@Override |
|
||||
public boolean isReady() { |
|
||||
return false; |
|
||||
} |
|
||||
|
|
||||
@Override |
|
||||
public void setReadListener(ReadListener readListener) { |
|
||||
|
|
||||
} |
|
||||
}; |
|
||||
} |
|
||||
|
|
||||
|
|
||||
public String inputHandlers(ServletInputStream servletInputStream){ |
|
||||
StringBuilder sb = new StringBuilder(); |
|
||||
BufferedReader reader = null; |
|
||||
try { |
|
||||
reader = new BufferedReader(new InputStreamReader(servletInputStream, Charset.forName("UTF-8"))); |
|
||||
String line = ""; |
|
||||
while ((line = reader.readLine()) != null) { |
|
||||
sb.append(line); |
|
||||
} |
|
||||
} catch (IOException e) { |
|
||||
e.printStackTrace(); |
|
||||
} finally { |
|
||||
if (servletInputStream != null) { |
|
||||
try { |
|
||||
servletInputStream.close(); |
|
||||
} catch (IOException e) { |
|
||||
e.printStackTrace(); |
|
||||
} |
|
||||
} |
|
||||
if (reader != null) { |
|
||||
try { |
|
||||
reader.close(); |
|
||||
} catch (IOException e) { |
|
||||
e.printStackTrace(); |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
return cleanXSS(sb.toString ()); |
|
||||
} |
|
||||
|
|
||||
public String cleanXSS(String src) { |
|
||||
String temp = src; |
|
||||
|
|
||||
src = src.replaceAll("<", "＜").replaceAll(">", "＞"); |
|
||||
src = src.replaceAll("\\(", "（").replaceAll("\\)", "）"); |
|
||||
src = src.replaceAll("'", "＇"); |
|
||||
src = src.replaceAll(";", "；"); |
|
||||
//bgh 2018/05/30 新增
|
|
||||
/**-----------------------start--------------------------*/ |
|
||||
src = src.replaceAll("<", "& lt;").replaceAll(">", "& gt;"); |
|
||||
src = src.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41"); |
|
||||
src = src.replaceAll("eval\\((.*)\\)", ""); |
|
||||
src = src.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\""); |
|
||||
src = src.replaceAll("script", ""); |
|
||||
src = src.replaceAll("link", ""); |
|
||||
src = src.replaceAll("frame", ""); |
|
||||
/**-----------------------end--------------------------*/ |
|
||||
Pattern pattern = Pattern.compile("(eval\\((.*)\\)|script)", |
|
||||
Pattern.CASE_INSENSITIVE); |
|
||||
Matcher matcher = pattern.matcher(src); |
|
||||
src = matcher.replaceAll(""); |
|
||||
|
|
||||
pattern = Pattern.compile("[\\\"\\'][\\s]*javascript:(.*)[\\\"\\']", |
|
||||
Pattern.CASE_INSENSITIVE); |
|
||||
matcher = pattern.matcher(src); |
|
||||
src = matcher.replaceAll("\"\""); |
|
||||
|
|
||||
// 增加脚本
|
|
||||
src = src.replaceAll("script", "").replaceAll(";", "") |
|
||||
/*.replaceAll("\"", "").replaceAll("@", "")*/ |
|
||||
.replaceAll("0x0d", "").replaceAll("0x0a", ""); |
|
||||
|
|
||||
if (!temp.equals(src)) { |
|
||||
// System.out.println("输入信息存在xss攻击！");
|
|
||||
// System.out.println("原始输入信息-->" + temp);
|
|
||||
// System.out.println("处理后信息-->" + src);
|
|
||||
|
|
||||
log.error("xss攻击检查：参数含有非法攻击字符，已禁止继续访问！！"); |
|
||||
log.error("原始输入信息-->" + temp); |
|
||||
|
|
||||
throw new HttpException("xss攻击检查：参数含有非法攻击字符，已禁止继续访问！！"); |
|
||||
} |
|
||||
return src; |
|
||||
} |
|
||||
|
|
||||
//输出
|
|
||||
public void outputMsgByOutputStream(HttpServletResponse response, String msg) throws IOException { |
|
||||
ServletOutputStream outputStream = response.getOutputStream(); //获取输出流
|
|
||||
response.setHeader("content-type", "text/html;charset=UTF-8"); //通过设置响应头控制浏览器以UTF-8的编码显示数据，如果不加这句话，那么浏览器显示的将是乱码
|
|
||||
byte[] dataByteArr = msg.getBytes("UTF-8");// 将字符转换成字节数组，指定以UTF-8编码进行转换
|
|
||||
outputStream.write(dataByteArr);// 使用OutputStream流向客户端输出字节数组
|
|
||||
} |
|
||||
|
|
||||
// 需要增加通配，过滤大小写组合
|
|
||||
public String cleanSQLInject(String src) { |
|
||||
String lowSrc = src.toLowerCase(); |
|
||||
String temp = src; |
|
||||
String lowSrcAfter = lowSrc.replaceAll("insert", "forbidI") |
|
||||
.replaceAll("select", "forbidS") |
|
||||
.replaceAll("update", "forbidU") |
|
||||
.replaceAll("delete", "forbidD").replaceAll("and", "forbidA") |
|
||||
.replaceAll("or", "forbidO"); |
|
||||
|
|
||||
if (!lowSrcAfter.equals(lowSrc)) { |
|
||||
log.error("sql注入检查：输入信息存在SQL攻击！"); |
|
||||
log.error("原始输入信息-->" + temp); |
|
||||
log.error("处理后信息-->" + lowSrc); |
|
||||
throw new HttpException("sql注入检查：参数含有非法攻击字符，已禁止继续访问！！"); |
|
||||
|
|
||||
} |
|
||||
return src; |
|
||||
} |
|
||||
|
|
||||
} |
|
||||
Loading…
Reference in new issue