JSP如何写过滤器防止xss攻击

JSP写过滤器防止xss攻击的方法：

利用Servlet的过滤器机制，编写定制的XssFilter，将request请求代理，覆盖getParameter和getHeader方法将参数名和参数值里的指定半角字符，强制替换成全角字符，代码如下：

XssFilter.java

packagefilter;

importjava.io.IOException;

importjavax.servlet.Filter;

importjavax.servlet.FilterChain;

importjavax.servlet.FilterConfig;

importjavax.servlet.ServletException;

importjavax.servlet.ServletRequest;

importjavax.servlet.ServletResponse;

importjavax.servlet.http.HttpServletRequest;

publicclassXssFilterimplementsFilter{

publicvoidinit(FilterConfigconfig)throwsServletException{

}

publicvoiddoFilter(ServletRequestrequest,ServletResponseresponse,

FilterChainchain)throwsIOException,ServletException

{

XssHttpServletRequestWrapperxssRequest=newXssHttpServletRequestWrapper(

(HttpServletRequest)request);

chain.doFilter(xssRequest,response);

}

publicvoiddestroy(){

}

}

XssHttpServletRequestWrapper.java

packagefilter;

importjavax.servlet.http.HttpServletRequest;

importjavax.servlet.http.HttpServletRequestWrapper;

publicclassXssHttpServletRequestWrapperextendsHttpServletRequestWrapper{

HttpServletRequestorgRequest=null;

publicXssHttpServletRequestWrapper(HttpServletRequestrequest){

super(request);

orgRequest=request;

}

/**

*覆盖getParameter方法，将参数名和参数值都做xss过滤。<br/>

*如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>

*getParameterNames,getParameterValues和getParameterMap也可能需要覆盖

*/

@Override

publicStringgetParameter(Stringname){

Stringvalue=super.getParameter(xssEncode(name));

if(value!=null){

value=xssEncode(value);

}

returnvalue;

}

/**

*覆盖getHeader方法，将参数名和参数值都做xss过滤。<br/>

*如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>

*getHeaderNames也可能需要覆盖

*/

@Override

publicStringgetHeader(Stringname){

Stringvalue=super.getHeader(xssEncode(name));

if(value!=null){

value=xssEncode(value);

}

returnvalue;

}

/**

*将容易引起xss漏洞的半角字符直接替换成全角字符

*

*@params

*@return

*/

privatestaticStringxssEncode(Strings){

if(s==null||s.isEmpty()){

returns;

}

StringBuildersb=newStringBuilder(s.length()+16);

for(inti=0;i<s.length();i++){

charc=s.charAt(i);

switch(c){

case'>':

sb.append('＞');//全角大于号

break;

case'<':

sb.append('＜');//全角小于号

break;

case'\'':

sb.append('‘');//全角单引号

break;

case'\"':

sb.append('“');//全角双引号

break;

case'&':

sb.append('＆');//全角

break;

case'\\':

sb.append('＼');//全角斜线

break;

case'#':

sb.append('＃');//全角井号

break;

default:

sb.append(c);

break;

}

}

returnsb.toString();

}

/**

*获取最原始的request

*

*@return

*/

publicHttpServletRequestgetOrgRequest(){

returnorgRequest;

}

/**

*获取最原始的request的静态方法

*

*@return

*/

publicstaticHttpServletRequestgetOrgRequest(HttpServletRequestreq){

if(reqinstanceofXssHttpServletRequestWrapper){

return((XssHttpServletRequestWrapper)req).getOrgRequest();

}

returnreq;

}

}

</pre>

在web.xml中添加使用：

<filter>

<filter-name>xssFilter</filter-name>

<filter-class>filter.XssFilter</filter-class>

</filter>

<filter-mapping>

<filter-name>xssFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

了解更多JSP如何写过滤器防止xss攻击相关的解答，就上多想派（www.duoxiangpai.com）。