web项目XSS漏洞处理
publicvoiddoFilter(ServletRequestreq0,ServletResponseres0,
FilterChainchain)
{
HttpServletResponseresponse=(HttpServletResponse)res0;
HttpServletRequestrequest=(HttpServletRequest)req0;
response.setHeader("P3P","CP=CAOPSAOUR");
try
{
//ActionContextctx=ServletActionContext.getActionContext(request);
Enumeration<String>paramNames=request.getParameterNames();
StringspecialCharactersStr=SystemConfig.interceptSpecial;
if(null!=specialCharactersStr&&specialCharactersStr.length()!=0)
{
while(paramNames.hasMoreElements())
{
StringparamName=(String)paramNames.nextElement();
Stringvalue=request.getParameter(paramName);
if(matchRegPattern(paramName))
{
StringerrorMsg="跨站漏洞检查：请求参数名【"+paramName+"】含有特殊字符【"
+specialCharactersStr+"】中的一个或多个！";
//ctx.getValueStack().set("operMsg",errorMsg);
response.setContentType("text/html;charset=utf-8");
PrintWriterout=response.getWriter();
out.println("<!DOCTYPEHTMLPUBLIC\"-//W3C//DTDHTML4.01Transitional//EN\">");
out.println("<HTML>");
out.println("<HEAD><TITLE>恶意攻击提醒</TITLE></HEAD>");
out.println("<BODY>");
out.print("");
out.print(errorMsg);
out.println(",");
out.println("</BODY>");
out.println("</HTML>");
out.flush();
out.close();
}
if(matchRegPattern(value))
{
StringerrorMsg="跨站漏洞检查：请求参数值【"+value+"】含有特殊字符【"
+specialCharactersStr+"】中的一个或多个！";
response.setContentType("text/html;charset=utf-8");
PrintWriterout=response.getWriter();
out.println("<!DOCTYPEHTMLPUBLIC\"-//W3C//DTDHTML4.01Transitional//EN\">");
out.println("<HTML>");
out.println("<HEAD><TITLE>恶意攻击提醒</TITLE></HEAD>");
out.println("<BODY>");
out.print("");
out.print(errorMsg);
out.println(",");
out.println("</BODY>");
out.println("</HTML>");
out.flush();
out.close();
}
}
}
chain.doFilter(req0,res0);
}
catch(Exceptione)
{
e.printStackTrace();
}
}
web.xml配置
<filter>
<filter-name>loginfilter</filter-name>
<filter-class>com.ipi.wlan.base.common.FiterHandle</filter-class>
</filter>
<filter-mapping>
<filter-name>loginfilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
过滤字符：<itemname="interceptSpecial"value="{,},>,<,',;,alert(,alert（,"comment="个性化字段过滤"/>
privatestaticbooleanmatchRegPattern(StringstrTarget)
{
String[]specialCharactersArray=SystemConfig.interceptSpecial
.split(",");
if(null!=strTarget)
{
for(inti=0;i<specialCharactersArray.length;i++)
{
if(strTarget.indexOf(specialCharactersArray[i])>=0)//该字符串存在特殊字符
{
returntrue;
}
}
}
returnfalse;
}