XSS跨站漏洞修复

编程语言 2018-05-12 16:47:51 阅读次数: 0
避免XSS跨站漏洞的方法之一主要是将用户所提交的内容输入输出进行过滤，包括请求路径过滤与参数过滤。这里，我写一个过滤器专门处理XSS跨站漏洞，思路是将带有非法字符的请求转发到一个指定页面，将参数的非法字符过滤去除。

过滤器代码如下： 
package com.eshore.itmp.model.web.security;

import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.util.regex.Pattern;

import javax.servlet.FilterChain;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.web.filter.OncePerRequestFilter;

/**
 * XSS漏洞过滤器
 * 
 * @author ahomeeye
 * 
 */
public class XssFilter extends OncePerRequestFilter {
	private static Log logger = LogFactory.getLog(XssFilter.class);
	private String forwardUrl = "/login.jsp";

	@Override
	protected void doFilterInternal(HttpServletRequest req,
			HttpServletResponse res, FilterChain filterChain)
			throws ServletException, IOException {
		String uri = req.getRequestURI();
		logger.info("-------uri=" + uri);

		// 过滤请求的参数名和参数值
		XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(
				(HttpServletRequest) req);

		if (uri.contains("j_spring_security_check") && isContainSpecialChar(uri)) {// 判断uri是否合法
			logger.info("-------uri包含特殊字符 uri=" + xssRequest.getRequestURI());
			RequestDispatcher dispatcher = xssRequest
					.getRequestDispatcher(forwardUrl);
			dispatcher.forward(xssRequest, res);
		} else {
			filterChain.doFilter(xssRequest, res);// 执行其他过滤操作
		}

	}

	/**
	 * 判断字符串是否包含特殊字符
	 * 
	 * @param strVal
	 * @return
	 */
	public boolean isContainSpecialChar(String value) {
		String strVal = "";
		try {
			strVal = URLDecoder.decode(value, "UTF-8");
		} catch (UnsupportedEncodingException e) {
			logger.error("URL解码错误", e);
		}
		boolean flag = false;
		if (match(".*?<script\\b.*?>*?</script>.*?", strVal)) {// //匹配js脚本字符串
			flag = true;
		} else if (match(".*?<.*?>.*?", strVal)) {// 匹配html标签字符串
			flag = true;
		}
		return flag;
	}

	/**
	 * 匹配正则表达式，大小写不敏感
	 * 
	 * @param regex
	 * @param input
	 * @return
	 */
	public boolean match(String regex, CharSequence input) {
		Pattern p = Pattern.compile(regex, Pattern.CASE_INSENSITIVE);
		return p.matcher(input).matches();
	}

	public String getForwardUrl() {
		return forwardUrl;
	}

	public void setForwardUrl(String forwardUrl) {
		this.forwardUrl = forwardUrl;
	}

}

在xml文件中声明过滤器，配置过滤器链 
	<beans:bean id="xssFilter" class="com.eshore.itmp.model.web.security.XssFilter" p:forwardUrl="/login.jsp">
	</beans:bean>
<beans:bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy">
		<filter-chain-map path-type="ant">
			<filter-chain pattern="/kaptcha.validate" filters="none" />
			<filter-chain pattern="/services/**" filters="none" />
			<filter-chain pattern="/media/**" filters="none" />
			<filter-chain pattern="/css/**" filters="none" />
			<filter-chain pattern="/images/**" filters="none" />
			<filter-chain pattern="/js/**" filters="none" />
			<filter-chain pattern="/page/**" filters="none" />
			<filter-chain pattern="/My97DatePicker/**" filters="none" />
			<filter-chain pattern="/login.jsp" filters="none" />
			<filter-chain pattern="/phytopo/**" filters="none" />
			<filter-chain pattern="/relationView/**" filters="none" />
			<!-- add -->
			<filter-chain pattern="/oaLogin.do" filters="none" />
			<filter-chain pattern="/selection/**" filters="none" />
			<filter-chain pattern="/entity/**" filters="none" />
			<filter-chain pattern="/upload/**" filters="none" />

			<filter-chain pattern="/assessmentKpi/getExcelData.do**" filters="none" />

			<!-- add -->
			<filter-chain pattern="/logoutSuccess.jsp" filters="none" />
			<filter-chain pattern="/**" filters="
				xssFilter,
				securityContextPersistenceFilter,
				logoutFilter,
				usernamePasswordAuthenticationFilter,
				anonymousAuthenticationFilter,
				exceptionTranslationFilter,
				itmpCustomInterceptor,
				sysLogFilter" />
		</filter-chain-map>
	</beans:bean>


重写HttpServletRequest，覆盖一些方法 
package com.eshore.itmp.model.web.security;

import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.util.regex.Pattern;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

/**
 * 请求参数过滤器(修复跨站脚本漏洞)
 * 
 * @author ahomeeye
 * 
 */
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {

	HttpServletRequest orgRequest = null;

	public XssHttpServletRequestWrapper(HttpServletRequest request) {
		super(request);
		orgRequest = request;
	}

	/**
	 * 覆盖getParameter方法，将参数名和参数值都做xss过滤。<br/>
	 * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>
	 * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
	 */
	@Override
	public String getParameter(String name) {
		String value = super.getParameter(xssEncode(name));
		if (value != null) {
			value = xssEncode(value);
		}

		return value;
	}

	@Override
	public Object getAttribute(String name) {
		Object value = super.getAttribute(xssEncode(name));
		if (value instanceof String) {
			return xssEncode(value.toString());
		}

		return value;
	}

	/**
	 * 覆盖getHeader方法，将参数名和参数值都做xss过滤。<br/>
	 * 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>
	 * getHeaderNames 也可能需要覆盖
	 */
	@Override
	public String getHeader(String name) {

		String value = super.getHeader(xssEncode(name));
		if (value != null) {
			value = xssEncode(value);
		}
		return value;
	}

	@Override
	public String getRequestURI() {

		String strVal = "";
		try {
			strVal = URLDecoder.decode(super.getRequestURI(), "UTF-8");
		} catch (UnsupportedEncodingException e) {
			e.printStackTrace();
		}

		String value = xssEncode(strVal);
		if (value != null) {
			value = xssEncode(value);
		}

		return value;
	}

	public String escape(String s) {
		StringBuilder sb = new StringBuilder(s.length() + 16);
		for (int i = 0; i < s.length(); i++) {
			char c = s.charAt(i);
			switch (c) {
			case '>':
				sb.append('＞');// 全角大于号
				break;
			case '<':
				sb.append('＜');// 全角小于号
				break;
			case '\'':
				sb.append('‘');// 全角单引号
				break;
			case '\"':
				sb.append('“');// 全角双引号
				break;
			case '\\':
				sb.append('＼');// 全角斜线
				break;
			case '%':
				sb.append('％'); // 全角冒号
				break;
			case ';':
				sb.append('；'); // 全角分号
				break;
			default:
				sb.append(c);
				break;
			}

		}
		return sb.toString();
	}

	/**
	 * 将容易引起xss漏洞的半角字符直接替换成全角字符
	 * 
	 * @param s
	 * @return
	 */
	public String xssEncode(String s) {
		if (s == null || s.isEmpty()) {
			return s;
		}

		String result = stripXSS(s);
		if (null != result) {
			result = escape(result);
		}

		return result;
	}

	private String stripXSS(String value) {
		if (value != null) {
			// NOTE: It's highly recommended to use the ESAPI library and
			// uncomment the following line to
			// avoid encoded attacks.
			// value = ESAPI.encoder().canonicalize(value);
			// Avoid null characters
			value = value.replaceAll("", "");
			// Avoid anything between script tags
			Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>",
					Pattern.CASE_INSENSITIVE);

			value = scriptPattern.matcher(value).replaceAll("");
			// Avoid anything in a src='...' type of expression
			scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'",
					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
							| Pattern.DOTALL);
			value = scriptPattern.matcher(value).replaceAll("");
			scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"",
					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
							| Pattern.DOTALL);
			value = scriptPattern.matcher(value).replaceAll("");
			// Remove any lonesome </script> tag
			scriptPattern = Pattern.compile("</script>",
					Pattern.CASE_INSENSITIVE);
			value = scriptPattern.matcher(value).replaceAll("");
			// Remove any lonesome <script ...> tag
			scriptPattern = Pattern.compile("<script(.*?)>",
					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
							| Pattern.DOTALL);
			value = scriptPattern.matcher(value).replaceAll("");
			// Avoid eval(...) expressions
			scriptPattern = Pattern.compile("eval\\((.*?)\\)",
					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
							| Pattern.DOTALL);
			value = scriptPattern.matcher(value).replaceAll("");
			// Avoid expression(...) expressions
			scriptPattern = Pattern.compile("expression\\((.*?)\\)",
					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
							| Pattern.DOTALL);
			value = scriptPattern.matcher(value).replaceAll("");
			// Avoid javascript:... expressions
			scriptPattern = Pattern.compile("javascript:",
					Pattern.CASE_INSENSITIVE);
			value = scriptPattern.matcher(value).replaceAll("");
			// Avoid vbscript:... expressions
			scriptPattern = Pattern.compile("vbscript:",
					Pattern.CASE_INSENSITIVE);
			value = scriptPattern.matcher(value).replaceAll("");
			// Avoid onload= expressions
			scriptPattern = Pattern.compile("onload(.*?)=",
					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
							| Pattern.DOTALL);
			value = scriptPattern.matcher(value).replaceAll("");

			scriptPattern = Pattern.compile("<iframe>(.*?)</iframe>",
					Pattern.CASE_INSENSITIVE);
			value = scriptPattern.matcher(value).replaceAll("");

			scriptPattern = Pattern.compile("</iframe>",
					Pattern.CASE_INSENSITIVE);
			value = scriptPattern.matcher(value).replaceAll("");

			// Remove any lonesome <script ...> tag
			scriptPattern = Pattern.compile("<iframe(.*?)>",
					Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
							| Pattern.DOTALL);
			value = scriptPattern.matcher(value).replaceAll("");
			value = value.replace(";", "");
			value = value.replace("<", "");
			value = value.replace(">", "");
		}
		return value;
	}

	/**
	 * 获取最原始的request
	 * 
	 * @return
	 */
	public HttpServletRequest getOrgRequest() {
		return orgRequest;
	}

	@Override
	public HttpServletRequest getRequest() {
		return orgRequest;
	}

	/**
	 * 获取最原始的request的静态方法
	 * 
	 * @return
	 */
	public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
		if (req instanceof XssHttpServletRequestWrapper) {
			return ((XssHttpServletRequestWrapper) req).getOrgRequest();
		}

		return req;
	}

}


最后，给个页面表单例子： 
<script type="text/javascript">
		function setPass(originId,decId){
			var orginName = window.parent.document.getElementById('orginName').value;
			var newName = strEnc(orginName,'itmp','des','encrypt');
			window.parent.document.getElementById('userId').value = newName;
			
			var orginPass = window.parent.document.getElementById(originId).value;
			var newPass = strEnc(orginPass,'itmp','des','encrypt');
			//alert('newPass=' + newPass + ' pass='+strDec(newPass,'itmp','des','encrypt'));
			window.parent.document.getElementById(decId).value = newPass;
		}
	</script>

<form id="form" name="form" action="${ctx}/j_spring_security_check" method="post">
	<table width="100%" border="0" cellspacing="0" cellpadding="0">
 	 <tr>
     	<td width="20%" height="10" class="black14" align="center" valign="middle"></td>
     	<td colspan="2" align="left">
        	<div class="error${param.error==true?'':'hide'}" style="color:red;">
		${sessionScope['SPRING_SECURITY_LAST_EXCEPTION'].message}
		</div>
    	</td>
    </tr>
   <tr>
     <td width="20%" height="35" class="black14">用户名</td>
     <td colspan="2" align="left"><label >
       <input type="text" id="orginName" value="${sessionScope['SPRING_SECURITY_LAST_USERNAME']}" class="input" />
       <input type="hidden" id="userId" name="j_username" value="" class="input"/>
     </label></td>
   </tr>
   <tr>
     <td height="35" class="black14">密&nbsp;&nbsp;&nbsp;码</td>
     <td colspan="2" align="left"><label >
       <input type="password" id="orginPass" class="input" onblur="setPass('orginPass','password');"/>
       <input type="hidden" name="j_password" id="password" class="input"/>
     </label></td>
   </tr>
   <tr>
     <td height="35" class="black14">验证码</td>
     <td width="37%" align="left"><label>
       <input type="text" name="validateCode" class="input2"/>
     </label></td>
     <td width="43%" align="left">
     	<img onclick="this.src='kaptcha.validate'" src="kaptcha.validate" width="77" height="28" />
     </td>
   </tr>
   <tr>
     <td height="93" colspan="3" align="center">
     	<a href="#">
     		<input type="image" src="${ctx}/css/remake/images/button_login.gif" width="111" height="36" border="0" />
     	</a>
     </td>
   </tr>
 </table>
</form>


参考网址：
http://yunjiechao-163-com.iteye.com/blog/1973803
http://www.cnblogs.com/wuhuacong/archive/2013/04/15/3022011.html

猜你喜欢

转载自ahomeeye.iteye.com/blog/2310012
今日推荐
《美国对全球网络空间安全与发展的威胁和破坏》报告发布
火速冲上 GitHub 热榜 —— 开源编程语言、框架哪有这么可爱？
北京人形机器人创新中心发布全球首个纯电驱拟人奔跑的全尺寸人形机器人“天工”
LFOSSA 源来如此公开课 | 掌握云原生未来：CNCF 认证全面攻略与备考秘籍
周排行
让自己的头脑极度开放
CentOS 6.5(x64) 和Redhat6.5操作系误删libc
高可用注册中心
【日记】12.28/【题解】AtCoder AGC041
XML（5）_XML 约束_DTD
Java集合Map（四）
树梅派安装桌面环境教程
pipenv 的 使用和安装
小程序白屏问题和内存研究
C语言简单选择排序
每日归档
更多
2024-05-02(0)
2024-05-01(4)
2024-04-30(1)
2024-04-29(40)
2024-04-28(0)
2024-04-27(56)
2024-04-26(39)
2024-04-25(22)
2024-04-24(36)
2024-04-23(26)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022