SpringMVC防止XSS注入详解编程语言

package com.henu.util; 
 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletRequestWrapper; 
 
/** 
 * XSS 
 *  
 * @author duxiangyu 
 *  
 */ 
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { 
    public XssHttpServletRequestWrapper(HttpServletRequest servletRequest) { 
        super(servletRequest); 
    } 
 
    public String[] getParameterValues(String parameter) { 
        String[] values = super.getParameterValues(parameter); 
        if (values == null) 
            return null; 
        int count = values.length; 
        String[] encodedValues = new String[count]; 
        for (int i = 0; i < count; i++) { 
            encodedValues[i] = cleanXSS(values[i]); 
        } 
        return encodedValues; 
    } 
 
    public String getParameter(String parameter) { 
        String value = super.getParameter(parameter); 
        if (value == null) 
            return null; 
        return cleanXSS(value); 
    } 
 
    public String getHeader(String name) { 
        String value = super.getHeader(name); 
        if (value == null) 
            return null; 
        return cleanXSS(value); 
    } 
 
    // 这里可以自己实现转义，也可以直接用工具类进行转义，比如说org.apache.common.lang.StringEscapeUtils和org.springframework.web.util.HtmlUtils 
    private String cleanXSS(String str) { 
        StringBuffer sb = new StringBuffer(); 
        for (int i = 0; i < str.length(); i++) { 
            char c = str.charAt(i); 
 
            switch (c) { 
            case '/n': 
                sb.append(c); 
                break; 
            case '<': 
                sb.append("&lt;"); 
                break; 
            case '>': 
                sb.append("&gt;"); 
                break; 
            case '&': 
                sb.append("&amp;"); 
                break; 
            case '/'': 
                sb.append("&apos;"); 
                break; 
            case '"': 
                sb.append("&quot;"); 
                break; 
            default: 
                if ((c < ' ') || (c > '~')) { 
                    sb.append("&#x"); 
                    sb.append(Integer.toString(c, 16)); 
                    sb.append(';'); 
                } else { 
                    sb.append(c); 
                } 
                break; 
            } 
        } 
        return sb.toString(); 
    } 
}

package com.henu.util; 
 
import java.io.IOException; 
import javax.servlet.Filter; 
import javax.servlet.FilterChain; 
import javax.servlet.FilterConfig; 
import javax.servlet.ServletException; 
import javax.servlet.ServletRequest; 
import javax.servlet.ServletResponse; 
import javax.servlet.http.HttpServletRequest; 
 
/** 
 * XSS 过滤器 
 *  
 * @author duxiangyu 
 *  
 */ 
public class XssFilter implements Filter { 
    FilterConfig filterConfig = null; 
 
    public void init(FilterConfig filterConfig) throws ServletException { 
        this.filterConfig = filterConfig; 
    } 
 
    public void destroy() { 
        this.filterConfig = null; 
    } 
 
    // 对request进行包装 
    public void doFilter(ServletRequest request, ServletResponse response, 
            FilterChain chain) throws IOException, ServletException { 
        chain.doFilter(new XssHttpServletRequestWrapper( 
                (HttpServletRequest) request), response); 
    } 
}

<filter> 
    <filter-name>xssFilter</filter-name> 
    <filter-class>com.henu.util.XssFilter</filter-class> 
</filter> 
<filter-mapping> 
    <filter-name>xssFilter</filter-name> 
    <url-pattern>*.ht</url-pattern> 
    <dispatcher>REQUEST</dispatcher> 
</filter-mapping>