Compare commits
9 Commits
| Author | SHA1 | Date |
|---|---|---|
chenrui
|
3531de0581 | 2 years ago |
|
chenrui
|
5b9caa3573 | 2 years ago |
|
zouyx
|
851f21072d | 2 years ago |
|
zouyx
|
e35953c1bf | 2 years ago |
|
chenrui
|
a613669ee2 | 2 years ago |
|
chenrui
|
56d696f5b8 | 2 years ago |
|
chenrui
|
3bc48f6e12 | 2 years ago |
|
chenrui
|
cd071fefe9 | 2 years ago |
|
chenrui
|
c8b77a8cc6 | 2 years ago |
36 changed files with 781 additions and 185 deletions
@ -0,0 +1,139 @@ |
|||||
|
package com.zdxt.auth.framework.config; |
||||
|
|
||||
|
import java.util.HashMap; |
||||
|
import java.util.Map; |
||||
|
import java.util.Set; |
||||
|
import java.util.regex.Pattern; |
||||
|
import javax.servlet.http.HttpServletRequest; |
||||
|
import javax.servlet.http.HttpServletRequestWrapper; |
||||
|
import org.springframework.util.StringUtils; |
||||
|
import org.springframework.web.multipart.MultipartHttpServletRequest; |
||||
|
import org.springframework.web.multipart.commons.CommonsMultipartResolver; |
||||
|
|
||||
|
/** |
||||
|
* @ClassName XssRequestWrappers |
||||
|
* @Description TODO |
||||
|
* @Author chenrui |
||||
|
* @Date 202/11/05 |
||||
|
* @Version 1.0 |
||||
|
*/ |
||||
|
public class XssRequestWrappers extends HttpServletRequestWrapper { |
||||
|
private CommonsMultipartResolver multiparResolver = new CommonsMultipartResolver(); |
||||
|
|
||||
|
public XssRequestWrappers(HttpServletRequest request) { |
||||
|
super(request); |
||||
|
|
||||
|
String type = request.getHeader("Content-Type"); |
||||
|
if (!StringUtils.isEmpty(type) && type.contains("multipart/form-data")) { |
||||
|
MultipartHttpServletRequest multipartHttpServletRequest = multiparResolver.resolveMultipart(request); |
||||
|
Map<String, String[]> stringMap = multipartHttpServletRequest.getParameterMap(); |
||||
|
if (!stringMap.isEmpty()) { |
||||
|
for (String key : stringMap.keySet()) { |
||||
|
String value = multipartHttpServletRequest.getParameter(key); |
||||
|
striptXSS(key); |
||||
|
striptXSS(value); |
||||
|
} |
||||
|
} |
||||
|
super.setRequest(multipartHttpServletRequest); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public String[] getParameterValues(String parameter) { |
||||
|
String[] values = super.getParameterValues(parameter); |
||||
|
if (values == null) { |
||||
|
return null; |
||||
|
} |
||||
|
int count = values.length; |
||||
|
String[] encodedValues = new String[count]; |
||||
|
for (int i = 0; i < count; i++) { |
||||
|
encodedValues[i] = striptXSS(values[i]); |
||||
|
} |
||||
|
return encodedValues; |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public String getParameter(String parameter) { |
||||
|
String value = super.getParameter(parameter); |
||||
|
return striptXSS(value); |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public String getHeader(String name) { |
||||
|
String value = super.getHeader(name); |
||||
|
return striptXSS(value); |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public Map<String, String[]> getParameterMap() { |
||||
|
Map<String, String[]> map1 = super.getParameterMap(); |
||||
|
Map<String, String[]> escapseMap = new HashMap<String, String[]>(); |
||||
|
Set<String> keys = map1.keySet(); |
||||
|
for (String key : keys) { |
||||
|
String[] valArr = map1.get(key); |
||||
|
if (valArr != null && valArr.length > 0) { |
||||
|
String[] escapseValArr = new String[valArr.length]; |
||||
|
for (int i = 0; i < valArr.length; i++) { |
||||
|
String escapseVal = striptXSS(valArr[i]); |
||||
|
escapseValArr[i] = escapseVal; |
||||
|
} |
||||
|
escapseMap.put(key, escapseValArr); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return escapseMap; |
||||
|
} |
||||
|
|
||||
|
//处理非法内容，如果有新的在此处增加即可
|
||||
|
public static String striptXSS(String value) { |
||||
|
if (value != null) { |
||||
|
// 替换空字符串，以便清除潜在的恶意脚本
|
||||
|
value = value.replaceAll("", ""); |
||||
|
|
||||
|
// 移除<script>标签及其内容
|
||||
|
Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE); |
||||
|
value = scriptPattern.matcher(value).replaceAll(""); |
||||
|
|
||||
|
// 移除带有src属性的标签，支持单引号和双引号包围的属性值
|
||||
|
scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\'(.*?)\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
||||
|
value = scriptPattern.matcher(value).replaceAll(""); |
||||
|
scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
||||
|
value = scriptPattern.matcher(value).replaceAll(""); |
||||
|
|
||||
|
// 移除</script>标签
|
||||
|
scriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE); |
||||
|
value = scriptPattern.matcher(value).replaceAll(""); |
||||
|
|
||||
|
// 移除以<script...>开头的标签
|
||||
|
scriptPattern = Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
||||
|
value = scriptPattern.matcher(value).replaceAll(""); |
||||
|
|
||||
|
// 移除eval()函数调用
|
||||
|
scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
||||
|
value = scriptPattern.matcher(value).replaceAll(""); |
||||
|
|
||||
|
// 移除expression()函数调用
|
||||
|
scriptPattern = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
||||
|
value = scriptPattern.matcher(value).replaceAll(""); |
||||
|
|
||||
|
// 移除以"javascript:"开头的字符串
|
||||
|
scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE); |
||||
|
value = scriptPattern.matcher(value).replaceAll(""); |
||||
|
|
||||
|
// 移除以"vbscript:"开头的字符串
|
||||
|
scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE); |
||||
|
value = scriptPattern.matcher(value).replaceAll(""); |
||||
|
|
||||
|
// 移除以"onload..."开头的字符串
|
||||
|
scriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); |
||||
|
value = scriptPattern.matcher(value).replaceAll(""); |
||||
|
|
||||
|
// 移除包含任何<和>字符的字符串
|
||||
|
scriptPattern = Pattern.compile(".*<.*", Pattern.CASE_INSENSITIVE); |
||||
|
value = scriptPattern.matcher(value).replaceAll(""); |
||||
|
} |
||||
|
|
||||
|
// 返回处理后的字符串
|
||||
|
return value; |
||||
|
} |
||||
|
} |
||||
Loading…
Reference in new issue