XSS vulnerability solution: Filter

I. web. xml file

<! -- Solve the xss vulnerability --> <filter-name> xssFilter </filter-name> <filter-class> com. baidu. rigel. sandbox. core. filter. XSSFilter </filter-class> </filter> <! -- Solve xss vulnerabilities --> <filter-mapping> <filter-name> xssFilter </filter-name> <url-pattern>/* </url-pattern> </filter- mapping> <! -- Solve the xss vulnerability --> <filter-name> xssFilter </filter-name> <filter-class> com. baidu. rigel. sandbox. core. filter. XSSFilter </filter-class> </filter> <! -- Solve xss vulnerabilities --> <filter-mapping> <filter-name> xssFilter </filter-name> <url-pattern>/* </url-pattern> </filter- mapping>

 

Ii. filter: XSSFilter. java

package com.rigel.sandbox.core.filter;    import java.io.IOException;    import javax.servlet.Filter;  import javax.servlet.FilterChain;  import javax.servlet.FilterConfig;  import javax.servlet.ServletException;  import javax.servlet.ServletRequest;  import javax.servlet.ServletResponse;  import javax.servlet.http.HttpServletRequest;    import com.rigel.sandbox.core.util.XssHttpServletRequestWrapper;    public class XSSFilter implements Filter {        @Override      public void init(FilterConfig filterConfig) throws ServletException {      }        @Override      public void doFilter(ServletRequest request, ServletResponse response,              FilterChain chain) throws IOException, ServletException {            XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(                  (HttpServletRequest) request);          chain.doFilter(xssRequest, response);      }        @Override      public void destroy() {      }    }  package com.rigel.sandbox.core.filter;import java.io.IOException;import javax.servlet.Filter;import javax.servlet.FilterChain;import javax.servlet.FilterConfig;import javax.servlet.ServletException;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpServletRequest;import com.rigel.sandbox.core.util.XssHttpServletRequestWrapper;public class XSSFilter implements Filter {@Overridepublic void init(FilterConfig filterConfig) throws ServletException {}@Overridepublic void doFilter(ServletRequest request, ServletResponse response,FilterChain chain) throws IOException, ServletException {XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest) request);chain.doFilter(xssRequest, response);}@Overridepublic void destroy() {}}

 

3. Wrapper: XssHttpServletRequestWrapper. java

Package com. rigel. sandbox. core. util; import javax. servlet. http. httpServletRequest; import javax. servlet. http. httpServletRequestWrapper; public class extends HttpServletRequestWrapper {HttpServletRequest orgRequest = null; public extends (HttpServletRequest request) {super (request); orgRequest = request;}/*** overwrites the getParameter method, filter both the parameter name and value by xss. <Br/> * to obtain the original value, use super. getParameterValues (name) to obtain <br/> * getParameterNames, getParameterValues, and getParameterMap may also need to overwrite */@ Override public String getParameter (String name) {String value = super. getParameter (xssEncode (name); if (value! = Null) {value = xssEncode (value);} return value;}/*** overwrites the getHeader method and filters both the parameter name and parameter value for xss. <Br/> * to obtain the original value, use super. getHeaders (name) to obtain <br/> * getHeaderNames may also need to overwrite */@ Override public String getHeader (String name) {String value = super. getHeader (xssEncode (name); if (value! = Null) {value = xssEncode (value);} return value ;} /*** Replace the half-width characters that are prone to xss vulnerabilities with the full-width characters ** @ param s * @ return */private static String xssEncode (String s) {if (s = null | s. isEmpty () {return s;} StringBuilder sb = new StringBuilder (s. length () + 16); for (int I = 0; I <s. length (); I ++) {char c = s. charAt (I); switch (c) {case '>': sb. append (">"); // escape greater than break; case '<': sb. append ("<"); // escape less than break; case '\ '': sb. append ("'"); // escape single quotes break; case' \ "': sb. append ("); // escape double quotation mark break; case '&': sb. append ("&"); // escape & break; default: sb. append (c); break;} return sb. toString ();}/*** get the most primitive request ** @ return */public HttpServletRequest getOrgRequest () {return orgRequest ;} /*** obtain the original request's static method ** @ return */public static HttpServletRequest getOrgRequest (HttpServletRequest req) {if (req instanceof XssHttpServletRequestWrapper) {return (response) req ). getOrgRequest () ;}return req ;}}