From 6d553ac3385d2aebee2e98c249dcf2f123da4fba Mon Sep 17 00:00:00 2001 From: wangkang Date: Wed, 24 May 2017 15:59:04 +0800 Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 1.md | 239 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ README.md | 15 ++++ 2 files changed, 254 insertions(+) create mode 100644 1.md diff --git a/1.md b/1.md new file mode 100644 index 0000000..a6a07e6 --- /dev/null +++ b/1.md @@ -0,0 +1,239 @@ +# spring boot / cloud (一) 使用filter防止XSS + +##前言 + +###XSS(跨站脚本攻击) +>跨站脚本攻击(Cross Site Scripting)，为不和层叠样式表(Cascading Style Sheets, CSS)的缩写混淆，故将跨站脚本攻击缩写为XSS。恶意攻击者往Web页面里插入恶意Script代码，当用户浏览该页之时，嵌入其中Web里面的Script代码会被执行，从而达到恶意攻击用户的目的。 + +##思路 + +###基于filter拦截,将特殊字符替换为**html转意字符** (如: `"<" 转意为 "<"`) , 需要拦截的点如下: + +- 请求头 `requestHeader` + + +- 请求体 `requestBody` + + +- 请求参数 `requestParameter` + +##实现 + +###1.创建XssHttpServletRequestWrapper类 + +在获取请求头,请求参数的这些地方,将目标值使用`HtmlUtils.htmlEscape`方法转意为html字符,而避免恶意代码参与到后续的流程中 + +``` java + +/** + * XssHttpServletRequestWrapper.java + * Created at 2016-09-19 + * Created by wangkang + * Copyright (C) 2016 egridcloud.com, All rights reserved. + */ +package com.egridcloud.udf.core.xss; + +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletRequestWrapper; + +import org.springframework.web.util.HtmlUtils; + +/** + * 描述 : 跨站请求防范 + * + * @author wangkang + * + */ +public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { + + /** + * 描述 : 构造函数 + * + * @param request 请求对象 + */ + public XssHttpServletRequestWrapper(HttpServletRequest request) { + super(request); + } + + @Override + public String getHeader(String name) { + String value = super.getHeader(name); + return HtmlUtils.htmlEscape(value); + } + + @Override + public String getParameter(String name) { + String value = super.getParameter(name); + return HtmlUtils.htmlEscape(value); + } + + @Override + public String[] getParameterValues(String name) { + String[] values = super.getParameterValues(name); + if (values != null) { + int length = values.length; + String[] escapseValues = new String[length]; + for (int i = 0; i < length; i++) { + escapseValues[i] = HtmlUtils.htmlEscape(values[i]); + } + return escapseValues; + } + return super.getParameterValues(name); + } + +} + +``` + +###2.创建XssStringJsonSerializer类 + +其次是涉及到json转换的地方,也一样需要进行转意,比如,rerquestBody,responseBody + +``` java + +/** + * XssStringJsonSerializer.java + * Created at 2016-09-19 + * Created by wangkang + * Copyright (C) 2016 egridcloud.com, All rights reserved. + */ +package com.egridcloud.udf.core.xss; + +import java.io.IOException; + +import org.springframework.web.util.HtmlUtils; + +import com.fasterxml.jackson.core.JsonGenerator; +import com.fasterxml.jackson.databind.JsonSerializer; +import com.fasterxml.jackson.databind.SerializerProvider; + +/** + * 描述 : 基于xss的JsonSerializer + * + * @author wangkang + * + */ +public class XssStringJsonSerializer extends JsonSerializer { + + @Override + public Class handledType() { + return String.class; + } + + @Override + public void serialize(String value, JsonGenerator jsonGenerator, + SerializerProvider serializerProvider) throws IOException { + if (value != null) { + String encodedValue = HtmlUtils.htmlEscape(value); + jsonGenerator.writeString(encodedValue); + } + } + +} + +``` + +###3.创建Bean + +在启动类中,创建XssObjectMapper的bean,替换spring boot原有的实例,用于整个系统的json转换. + +``` java + + /** + * 描述 : xssObjectMapper + * + * @param builder builder + * @return xssObjectMapper + */ + @Bean + @Primary + public ObjectMapper xssObjectMapper(Jackson2ObjectMapperBuilder builder) { + //解析器 + ObjectMapper objectMapper = builder.createXmlMapper(false).build(); + //注册xss解析器 + SimpleModule xssModule = new SimpleModule("XssStringJsonSerializer"); + xssModule.addSerializer(new XssStringJsonSerializer()); + objectMapper.registerModule(xssModule); + //返回 + return objectMapper; + } + +``` + +###4.创建XssFilter + +首先是拦截所有的请求,然后在doFilter方法中,将HttpServletRequest强制类型转换成XssHttpServletRequestWrapper + +然后传递下去. + +``` java + +/** + * XssFilter.java + * Created at 2016-09-19 + * Created by wangkang + * Copyright (C) 2016 egridcloud.com, All rights reserved. + */ +package com.egridcloud.udf.core.xss; + +import java.io.IOException; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.FilterConfig; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.annotation.WebFilter; +import javax.servlet.http.HttpServletRequest; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +/** + * 描述 : 跨站请求防范 + * + * @author wangkang + * + */ +@WebFilter(filterName = "xssFilter", urlPatterns = "/*", asyncSupported = true) +public class XssFilter implements Filter { + + /** + * 描述 : 日志 + */ + private static final Logger LOGGER = LoggerFactory.getLogger(XssFilter.class); + + @Override + public void init(FilterConfig filterConfig) throws ServletException { + LOGGER.debug("(XssFilter) initialize"); + } + + @Override + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) + throws IOException, ServletException { + XssHttpServletRequestWrapper xssRequest = + new XssHttpServletRequestWrapper((HttpServletRequest) request); + chain.doFilter(xssRequest, response); + } + + @Override + public void destroy() { + LOGGER.debug("(XssFilter) destroy"); + } + +} + +``` + +##结束 + +本文虽基于spring boot实现主题,但是思路是一致的,不限于任何框架. + + +--------- + +想获得最快更新,请关注公众号 + +![想获得最快更新,请关注公众号](https://mmbiz.qlogo.cn/mmbiz_jpg/gjOvoY7GOt5a4dicfGbqze591YAEiaRONE0nOsiaur4nlsmKtUpRuONue28wJ9JfOXfBl99OoVmYncohMnEY4LMdg/0?wx_fmt=jpeg "想获得最快更新,请关注公众号") + diff --git a/README.md b/README.md index 78d79a0..7e08622 100644 --- a/README.md +++ b/README.md @@ -1 +1,16 @@ #udf + + +公众号二维码地址 + +weixin : + +https://mmbiz.qlogo.cn/mmbiz_jpg/gjOvoY7GOt5a4dicfGbqze591YAEiaRONE0nOsiaur4nlsmKtUpRuONue28wJ9JfOXfBl99OoVmYncohMnEY4LMdg/0?wx_fmt=jpeg + +osc : + +https://static.oschina.net/uploads/img/201705/24155414_Pukg.jpg + +csdn : + +http://img.blog.csdn.net/20170524155716971?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvd2FuZ2thbmc4MA==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast \ No newline at end of file