java如何防止xss攻击

java防止xss攻击的方案：

1.配置过滤器，代码如下：

public class XSSFilter implements Filter {

@Override

public void init(FilterConfig filterConfig) throws ServletException {

}

@Override

public void destroy() {

}

@Override

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)

throws IOException, ServletException {

chain.doFilter(new XSSRequestWrapper((HttpServletRequest) request), response);

}

}

2.实现ServletRequest的包装类，代码如下：

import java.util.regex.Pattern;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;

public class XSSRequestWrapper extends HttpServletRequestWrapper {

public XSSRequestWrapper(HttpServletRequest servletRequest) {

super(servletRequest);

}

@Override

public String[] getParameterValues(String parameter) {

String[] values = super.getParameterValues(parameter);

if (values == null) {

return null;

}

int count = values.length;

String[] encodedValues = new String[count];

for (int i = 0; i < count; i++) {

encodedValues[i] = stripXSS(values[i]);

}

return encodedValues;

}

@Override

public String getParameter(String parameter) {

String value = super.getParameter(parameter);

return stripXSS(value);

}

@Override

public String getHeader(String name) {

String value = super.getHeader(name);

return stripXSS(value);

}

private String stripXSS(String value) {

if (value != null) {

// NOTE: It’s highly recommended to use the ESAPI library and uncomment the following line to

// avoid encoded attacks.

// value = ESAPI.encoder().canonicalize(value);

// Avoid null characters

value = value.replaceAll(“”, “”);

// Avoid anything between script tags

Pattern scriptPattern = Pattern.compile(“(.*?)”, Pattern.CASE_INSENSITIVE);

value = scriptPattern.matcher(value).replaceAll(“”);

// Avoid anything in a src=”http://www.yihaomen.com/article/java/…” type of e­xpression

scriptPattern = Pattern.compile(“src[\r\n]*=[\r\n]*\\\'(.*?)\\\'”, Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll(“”);

scriptPattern = Pattern.compile(“src[\r\n]*=[\r\n]*\\\”(.*?)\\\””, Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll(“”);

// Remove any lonesome tag

scriptPattern = Pattern.compile(“”, Pattern.CASE_INSENSITIVE);

value = scriptPattern.matcher(value).replaceAll(“”);

// Remove any lonesome tag

scriptPattern = Pattern.compile(“”, Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll(“”);

// Avoid eval(…) e­xpressions

scriptPattern = Pattern.compile(“eval\\((.*?)\\)”, Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll(“”);

// Avoid e­xpression(…) e­xpressions

scriptPattern = Pattern.compile(“e­xpression\\((.*?)\\)”, Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll(“”);

// Avoid javascript:… e­xpressions

scriptPattern = Pattern.compile(“javascript:”, Pattern.CASE_INSENSITIVE);

value = scriptPattern.matcher(value).replaceAll(“”);

// Avoid vbscript:… e­xpressions

scriptPattern = Pattern.compile(“vbscript:”, Pattern.CASE_INSENSITIVE);

value = scriptPattern.matcher(value).replaceAll(“”);

// Avoid onload= e­xpressions

scriptPattern = Pattern.compile(“onload(.*?)=”, Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);

value = scriptPattern.matcher(value).replaceAll(“”);

}

return value;

}

}

了解更多java如何防止xss攻击相关的解答，就上多想派（www.duoxiangpai.com）。