XSS vulnerability solution: Filter

Source: Internet
Author: User

I. web. xml file

<! -- Solve the xss vulnerability --> <filter-name> xssFilter </filter-name> <filter-class> com. baidu. rigel. sandbox. core. filter. XSSFilter </filter-class> </filter> <! -- Solve xss vulnerabilities --> <filter-mapping> <filter-name> xssFilter </filter-name> <url-pattern>/* </url-pattern> </filter- mapping> <! -- Solve the xss vulnerability --> <filter-name> xssFilter </filter-name> <filter-class> com. baidu. rigel. sandbox. core. filter. XSSFilter </filter-class> </filter> <! -- Solve xss vulnerabilities --> <filter-mapping> <filter-name> xssFilter </filter-name> <url-pattern>/* </url-pattern> </filter- mapping>

 

Ii. filter: XSSFilter. java
package com.rigel.sandbox.core.filter;    import java.io.IOException;    import javax.servlet.Filter;  import javax.servlet.FilterChain;  import javax.servlet.FilterConfig;  import javax.servlet.ServletException;  import javax.servlet.ServletRequest;  import javax.servlet.ServletResponse;  import javax.servlet.http.HttpServletRequest;    import com.rigel.sandbox.core.util.XssHttpServletRequestWrapper;    public class XSSFilter implements Filter {        @Override      public void init(FilterConfig filterConfig) throws ServletException {      }        @Override      public void doFilter(ServletRequest request, ServletResponse response,              FilterChain chain) throws IOException, ServletException {            XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(                  (HttpServletRequest) request);          chain.doFilter(xssRequest, response);      }        @Override      public void destroy() {      }    }  package com.rigel.sandbox.core.filter;import java.io.IOException;import javax.servlet.Filter;import javax.servlet.FilterChain;import javax.servlet.FilterConfig;import javax.servlet.ServletException;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpServletRequest;import com.rigel.sandbox.core.util.XssHttpServletRequestWrapper;public class XSSFilter implements Filter {@Overridepublic void init(FilterConfig filterConfig) throws ServletException {}@Overridepublic void doFilter(ServletRequest request, ServletResponse response,FilterChain chain) throws IOException, ServletException {XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest) request);chain.doFilter(xssRequest, response);}@Overridepublic void destroy() {}}

 

3. Wrapper: XssHttpServletRequestWrapper. java
Package com. rigel. sandbox. core. util; import javax. servlet. http. httpServletRequest; import javax. servlet. http. httpServletRequestWrapper; public class extends HttpServletRequestWrapper {HttpServletRequest orgRequest = null; public extends (HttpServletRequest request) {super (request); orgRequest = request;}/*** overwrites the getParameter method, filter both the parameter name and value by xss. <Br/> * to obtain the original value, use super. getParameterValues (name) to obtain <br/> * getParameterNames, getParameterValues, and getParameterMap may also need to overwrite */@ Override public String getParameter (String name) {String value = super. getParameter (xssEncode (name); if (value! = Null) {value = xssEncode (value);} return value;}/*** overwrites the getHeader method and filters both the parameter name and parameter value for xss. <Br/> * to obtain the original value, use super. getHeaders (name) to obtain <br/> * getHeaderNames may also need to overwrite */@ Override public String getHeader (String name) {String value = super. getHeader (xssEncode (name); if (value! = Null) {value = xssEncode (value);} return value ;} /*** Replace the half-width characters that are prone to xss vulnerabilities with the full-width characters ** @ param s * @ return */private static String xssEncode (String s) {if (s = null | s. isEmpty () {return s;} StringBuilder sb = new StringBuilder (s. length () + 16); for (int I = 0; I <s. length (); I ++) {char c = s. charAt (I); switch (c) {case '>': sb. append (">"); // escape greater than break; case '<': sb. append ("<"); // escape less than break; case '\ '': sb. append ("'"); // escape single quotes break; case' \ "': sb. append ("); // escape double quotation mark break; case '&': sb. append ("&"); // escape & break; default: sb. append (c); break;} return sb. toString ();}/*** get the most primitive request ** @ return */public HttpServletRequest getOrgRequest () {return orgRequest ;} /*** obtain the original request's static method ** @ return */public static HttpServletRequest getOrgRequest (HttpServletRequest req) {if (req instanceof XssHttpServletRequestWrapper) {return (response) req ). getOrgRequest () ;}return req ;}}

 

 

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.