Java protection against XSS attacks

Http://www.cnblogs.com/TankXiao/archive/2012/03/21/2337194.html#xsshappen

Here's a list of our solutions for the recent project, mainly using the ORG.APACHE.COMMONS.LANG3.STRINGESCAPEUTILS.ESCAPEHTML4 () approach to commons-lang3-3.1.jar this package.

The resolution process is mainly in the user input and display output two steps: At the input of the special word such as <> "' & Escape, in the output with Jstl fn:excapexml (" fff ") method.

Where the input filter is implemented with a filter,

Implementation process:

Add a filter to Web. xml

XML code

1. <filter>
2. <filter-name>XssEscape</filter-name>
3. <filter-class>cn.pconline.morden.filter.XssFilter</filter-class>
4. </filter>
5. <filter-mapping>
6. <filter-name>XssEscape</filter-name>
7. <url-pattern>/*</url-pattern>
8. <dispatcher>REQUEST</dispatcher>
9. </filter-mapping>

The implementation of Xssfilter is to implement the servlet's filter interface

Java code

2. Package cn.pconline.morden.filter;
6. Import java.io.IOException;
10. Import Javax.servlet.Filter;
12. Import Javax.servlet.FilterChain;
14. Import Javax.servlet.FilterConfig;
16. Import javax.servlet.ServletException;
18. Import Javax.servlet.ServletRequest;
20. Import Javax.servlet.ServletResponse;
22. Import Javax.servlet.http.HttpServletRequest;
26. public class Xssfilter implements Filter {
30. @Override
32. public void init (Filterconfig filterconfig) throws Servletexception {
34. }
38. @Override
40. public void DoFilter (ServletRequest request, servletresponse response,
42. Filterchain chain) throws IOException, Servletexception {
44. Chain.dofilter (New Xsshttpservletrequestwrapper ((httpservletrequest) request), response);
46. }
50. @Override
52. public void Destroy () {
54. }
56. }

The key is the implementation of Xsshttpservletrequestwrapper, inheriting the httpservletrequestwrapper of the servlet, and rewriting the corresponding several possible methods with XSS attacks, such as:

Java code

2. Package cn.pconline.morden.filter;
6. Import Javax.servlet.http.HttpServletRequest;
8. Import Javax.servlet.http.HttpServletRequestWrapper;
12. Import Org.apache.commons.lang3.StringEscapeUtils;
16. public class Xsshttpservletrequestwrapper extends Httpservletrequestwrapper {
20. Public Xsshttpservletrequestwrapper (HttpServletRequest request) {
22. Super (Request);
24. }
28. @Override
30. public string GetHeader (string name) {
32. Return Stringescapeutils.escapehtml4 (Super.getheader (name));
34. }
38. @Override
40. Public String getquerystring () {
42. Return Stringescapeutils.escapehtml4 (Super.getquerystring ());
44. }
48. @Override
50. public string GetParameter (string name) {
52. Return Stringescapeutils.escapehtml4 (Super.getparameter (name));
54. }
58. @Override
60. Public string[] Getparametervalues (String name) {
62. String[] values = super.getparametervalues (name);
64. if (values! = null) {
66. int length = Values.length;
68. string[] escapsevalues = new String[length];
70. for (int i = 0; i < length; i++) {
72. Escapsevalues[i] = STRINGESCAPEUTILS.ESCAPEHTML4 (Values[i]);
74. }
76. return escapsevalues;
78. }
80. return super.getparametervalues (name);
82. }
86. }

At this end, the input filter is complete.

When displaying data on a page, simply use Fn:escapexml () to escape the output in a place where an XSS vulnerability is likely to occur.

The display of complex content, specific problems, and then specific analysis.

In addition, some cases do not want to display the filtered content, you can use STRINGESCAPEUTILS.UNESCAPEHTML4 () This method, the STRINGESCAPEUTILS.ESCAPEHTML4 () escaped character after the return to the original.

Java protection against XSS attacks