Xss vulnerability and csrf vulnerability defense

Xss defense:

1. Set the domain name as the root of the domain name to minimize the impact of xss vulnerabilities on the main site;

2. Filter and check the input data:

Public static String htmlSpecialChars (final String s ){
String result = s;
Result = regexReplace ("&", "&", result );
Result = regexReplace ("\" "," ", result );
Result = regexReplace ("<", "<", result );
Result = regexReplace (">", ">", result );
Return result;
}

Note: JavaScript execution is also performed for CSS behavior:

<Style type = "text/css">
# Content {height: expression (alert ('test xss '));}
</Style>

If you want to support html, you can use this filter (attachment, open-source)

Example
{
Final ArrayList <Attribute> span_atts = new ArrayList <Attribute> ();
Map <String, Pattern> allowedAttrValues = new HashMap <String, Pattern> ();
AllowedAttrValues. put ("color", Pattern. compile ("(# ([0-9a-fA-F] {6} | [0-9a-fA-F] {3 }))"));
AllowedAttrValues. put ("font-weight", Pattern. compile ("bold "));
AllowedAttrValues. put ("text-align", Pattern. compile ("(center | right | justify )"));
AllowedAttrValues. put ("font-style", Pattern. compile ("italic "));
AllowedAttrValues. put ("text-decoration", Pattern. compile ("underline "));
AllowedAttrValues. put ("margin-left", Pattern. compile ("[0-9] + px "));
AllowedAttrValues. put ("text-align", Pattern. compile ("center "));
Span_atts.add (new Attribute ("style", allowedAttrValues ));
VAllowed. put ("span", span_atts );
}
{
Final ArrayList <Attribute> div_atts = new ArrayList <Attribute> ();
Div_atts.add (new Attribute ("class "));
Div_atts.add (new Attribute ("align "));
VAllowed. put ("div", div_atts );
}

* 2. Call a function such as String outHtml = HetaoBlogXssHTMLFilter. filter (sourceHtmlString );

3. for image uploading, check whether the image format is correct or not. The image server should not enable the program (java, php,. net) function or do not parse the image format by using a program;

Defense CSRF:

WAF defends against CSRF vulnerabilities on the Web application side. Generally, referer is used to determine the url source of the input end, or token is used, or a verification code invisible to JavaScript is used;