背景
前阵子做了几个我的项目，终于开发结束，进入了测试阶段，信念满满将我的项目部署到测试环境，而后做了平安测评之后.....
(什么！你居然说我代码不平安？？？)
而后测出了Xss破绽平安的问题
解决方案
场景：能够在页面输入框输出JS脚本，攻击者能够利用此破绽执行歹意的代码！
问题演示
所以咱们要对于前端传输的参数做解决，做对立全局过滤解决
既然要过滤解决，咱们首先须要实现一个自定义过滤器
总共蕴含以下四局部
XssUtilXssFilterAutoConfig
XssHttpServletRequestWrapper
XssStringfJsonDeserializer
最初咱们须要在全局过滤器中应用咱们实现的Xss自定义过滤器
代码实现
- XssFilterAtuoConfig实现代码
import com.fasterxml.jackson.databind.ObjectMapper;import com.fasterxml.jackson.databind.module.SimpleModule;import net.greatsoft.overallbudget.filter.SimpleCORSFilter;import org.springframework.boot.context.embedded.FilterRegistrationBean;import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;import org.springframework.context.annotation.Primary;import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;/** * Created by wjy on 2020/11/5. * xss 主动配置类 */@Configurationpublic class XssFilterAtuoConfig { /** * 注册自定义过滤器 * @return */ @Bean public FilterRegistrationBean xssFiltrRegister() { FilterRegistrationBean registration = new FilterRegistrationBean(); //设置零碎过滤器 (setFilter就是你所定义的过滤器filter类) registration.setFilter(new SimpleCORSFilter()); //过滤所有门路 registration.addUrlPatterns("/*"); //过滤器名称 registration.setName("XssFilter"); //优先级 registration.setOrder(1); return registration; } /** * 过滤JSON数据 * @return */ @Bean @Primary public MappingJackson2HttpMessageConverter mappingJackson2HttpMessageConverter() { SimpleModule module = new SimpleModule(); //自定义序列化过滤配置(XssStringJsonDeserializer), 对入参进行转译 module.addDeserializer(String.class, new XssStringJsonDeserializer()); // 注册解析器 ObjectMapper objectMapper = Jackson2ObjectMapperBuilder.json().build(); objectMapper.registerModule(module); return new MappingJackson2HttpMessageConverter(objectMapper); }}
- XssHttpServletRequestWrapper实现代码
/** * Created by wjy on 2020/11/5. * xss 包装 */public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { public XssHttpServletRequestWrapper(HttpServletRequest request) { super(request); } /** * 对header解决 * @param name * @return */ @Override public String getHeader(String name) { String value = super.getHeader(name); return XssUtil.cleanXSS(value); } /** * 对参数解决 * @param name * @return */ @Override public String getParameter(String name) { String value = super.getParameter(name); return XssUtil.cleanXSS(value); } /** * 对数值进行解决 * @param name * @return */ @Override public String[] getParameterValues(String name) { String[] values = super.getParameterValues(name); if (values != null) { int length = values.length; String[] escapseValues = new String[length]; for (int i = 0; i < length; i++) { escapseValues[i] = XssUtil.cleanXSS(values[i]); } return escapseValues; } return super.getParameterValues(name); } /** * 次要是针对HandlerMapping.URI_TEMPLATE_VARIABLES_ATTRIBUTE 获取pathvalue的时候把原来的pathvalue通过xss过滤掉 */ @Override public Object getAttribute(String name) { // 获取pathvalue的值 if (HandlerMapping.URI_TEMPLATE_VARIABLES_ATTRIBUTE.equals(name)) { Map uriTemplateVars = (Map) super.getAttribute(HandlerMapping.URI_TEMPLATE_VARIABLES_ATTRIBUTE); if (Objects.isNull(uriTemplateVars)) { return uriTemplateVars; } Map newMap = new LinkedHashMap<>(); uriTemplateVars.forEach((key, value) -> { if (value instanceof String) { newMap.put(key, XssUtil.cleanXSS((String) value)); } else { newMap.put(key, value); } }); return newMap; } else { return super.getAttribute(name); } }}
- XssStringJsonDeserializer代码实现
/** * Created by wjy on 2020/11/5. * 基于xss的JsonDeserializer */public class XssStringJsonDeserializer extends JsonDeserializer<String> { @Override public Class<String> handledType() { return String.class; } @Override public String deserialize(JsonParser jsonParser, DeserializationContext deserializationContext) throws IOException { return XssUtil.cleanXSS(jsonParser.getValueAsString()); }}
- XssUtil代码实现
/** * Created by wjy on 2020/11/5. * xss工具类 */public class XssUtil { public static String cleanXSS(String value) { if (Objects.isNull(value)) { return value; } //在这里自定义须要过滤的字符 value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;"); value = value.replaceAll("(", "& #40;").replaceAll(")", "& #41;"); value = value.replaceAll("'", "& #39;"); value = value.replaceAll("eval((.*))", ""); value = value.replaceAll("["'][s]*javascript:(.*)["']", """"); value = value.replaceAll("<script>", ""); return value; }} 全局过滤器实现
@Componentpublic class SimpleCORSFilter implements Filter { @Override public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { // 在这里，应用咱们实现的XSS过滤器 XssHttpServletRequestWrapper request = new XssHttpServletRequestWrapper((HttpServletRequest) req); HttpServletResponse response = (HttpServletResponse) res; response.setHeader("Access-Control-Allow-Origin", "*"); response.setHeader("Access-Control-Allow-Methods", "POST, GET, PUT, OPTIONS, DELETE"); response.setHeader("Access-Control-Max-Age", "3600"); response.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, token"); chain.doFilter(request, response); } public void init(FilterConfig filterConfig) { } public void destroy() { }} 好了，以上就是对Xss破绽的解决
看完如果对你有帮忙，看到右下角的 “一键三连” 了吗，没错点它[哈哈]