什么是SQL攻击、什么是XSS攻击

SQL 攻击:把SQL命令插入到Web表单并提交,欺骗服务器执行恶意的SQL命令。

XSS 攻击:向有XSS漏洞的网站中输入(传入)恶意的HTML代码，当其它用户浏览该网站时，这段HTML代码会自动执行，从而达到攻击的目的。

创建拦截器第一步：

创建XssAndSqlHttpServletRequestWrapper包装器，这是实现XSS和SQL过滤的关键，在其内重写了getParameter，getParameterValues，getHeader等方法，对http请求内的参数进行了过滤。

import java.io.BufferedReader;import java.io.ByteArrayInputStream;import java.io.IOException;import java.io.InputStreamReader;import java.util.Enumeration;import java.util.HashMap;import java.util.Map;import java.util.Set;import java.util.Vector;import java.util.regex.Pattern;import javax.servlet.ReadListener;import javax.servlet.ServletInputStream;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletRequestWrapper;import org.springframework.util.StreamUtils;public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {HttpServletRequest orgRequest = null;private Map<String, String[]> parameterMap;private final byte[] body; // 用于保存读取body中数据public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException {super(request);orgRequest = request;parameterMap = request.getParameterMap();body = StreamUtils.copyToByteArray(request.getInputStream());}// 重写几个HttpServletRequestWrapper中的方法/*** 获取所有参数名** @return 返回所有参数名*/@Overridepublic Enumeration<String> getParameterNames() {Vector<String> vector = new Vector<String>(parameterMap.keySet());return vector.elements();}/*** 覆盖getParameter方法，将参数名和参数值都做xss & sql过滤。<br/>* 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖*/@Overridepublic String getParameter(String name) {String[] results = parameterMap.get(name);if (results == null || results.length <= 0)return null;else {String value = results[0];if (value != null) {value = xssEncode(value);}return value;}}/*** 获取指定参数名的所有值的数组，如：checkbox的所有数据 接收数组变量 ，如checkobx类型*/@Overridepublic String[] getParameterValues(String name) {String[] results = parameterMap.get(name);if (results == null || results.length <= 0)return null;else {int length = results.length;for (int i = 0; i < length; i++) {results[i] = xssEncode(results[i]);}return results;}}/*** 覆盖getHeader方法，将参数名和参数值都做xss & sql过滤。<br/>* 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>* getHeaderNames 也可能需要覆盖*/@Overridepublic String getHeader(String name) {String value = super.getHeader(xssEncode(name));if (value != null) {value = xssEncode(value);}return value;}/*** 将容易引起xss & sql漏洞的半角字符直接替换成全角字符** @param s* @return*/private static String xssEncode(String s) {if (s == null || s.isEmpty()) {return s;} else {s = stripXSSAndSql(s);}StringBuilder sb = new StringBuilder(s.length() + 16);for (int i = 0; i < s.length(); i++) {char c = s.charAt(i);switch (c) {case '>':sb.append("＞");// 转义大于号break;case '<':sb.append("＜");// 转义小于号break;// case '\'':// sb.append("＇");// 转义单引号// break;// case '\"':// sb.append("＂");// 转义双引号// break;case '&':sb.append("＆");// 转义&break;case '#':sb.append("＃");// 转义#break;default:sb.append(c);break;}}return sb.toString();}/*** 获取最原始的request** @return*/public HttpServletRequest getOrgRequest() {return orgRequest;}/*** 审查参数的具体方法* @param value* @return*/public static boolean checkXSSAndSql(String value) {boolean flag = false;if (value != null) {// NOTE: It's highly recommended to use the ESAPI library and// uncomment the following line to// avoid encoded attacks.// value = ESAPI.encoder().canonicalize(value);// Avoid null characters/** value = value.replaceAll("", ""); ***/// Avoid anything between script tagsPattern scriptPattern = pile("<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid anything in a// src="/article/java/..." type of// e-xpressionscriptPattern = pile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Remove any lonesome </script> tagscriptPattern = pile("</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Remove any lonesome <script ...> tagscriptPattern = pile("<[\r\n| | ]*script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid eval(...) expressionsscriptPattern = pile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid e-xpression(...) expressionsscriptPattern = pile("e-xpression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid javascript:... expressionsscriptPattern = pile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid vbscript:... expressionsscriptPattern = pile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Avoid οnlοad= expressionsscriptPattern = pile("onload(.*?)=",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}scriptPattern = pile("\\b(and|exec|insert|select|drop|grant|alter|delete|update|count|chr|mid|master|truncate|char|declare|or)\\b|(\\*|;|\\+|'|%)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}}return flag;}/*** 检查参数方法* @return*/public final boolean checkParameter() {Map<String, String[]> submitParams = new HashMap(parameterMap);Set<String> submitNames = submitParams.keySet();for (String submitName : submitNames) {Object submitValues = submitParams.get(submitName);if ((submitValues instanceof String)) {if (checkXSSAndSql((String) submitValues)) {return true;}} else if ((submitValues instanceof String[])) {for (String submitValue : (String[])submitValues){if (checkXSSAndSql(submitValue)) {return true;}}}}return false;}/*** 获取最原始的request的静态方法** @return*/public static HttpServletRequest getOrgRequest(HttpServletRequest req) {if (req instanceof XssAndSqlHttpServletRequestWrapper) {return ((XssAndSqlHttpServletRequestWrapper) req).getOrgRequest();}return req;}/**** 防止xss跨脚本攻击（替换，根据实际情况调整）*/public static String stripXSSAndSql(String value) {if (value != null) {// NOTE: It's highly recommended to use the ESAPI library and// uncomment the following line to// avoid encoded attacks.// value = ESAPI.encoder().canonicalize(value);// Avoid null characters/** value = value.replaceAll("", ""); ***/// Avoid anything between script tagsPattern scriptPattern = pile("<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid anything in a// src="/article/java/..." type of// e-xpressionscriptPattern = pile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome </script> tagscriptPattern = pile("</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome <script ...> tagscriptPattern = pile("<[\r\n| | ]*script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid eval(...) expressionsscriptPattern = pile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid e-xpression(...) expressionsscriptPattern = pile("e-xpression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid javascript:... expressionsscriptPattern = pile("javascript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid vbscript:... expressionsscriptPattern = pile("vbscript[\r\n| | ]*:[\r\n| | ]*", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid οnlοad= expressionsscriptPattern = pile("onload(.*?)=",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");}return value;}/****application/x- www-form-urlencoded是Post请求默认的请求体内容类型，也是form表单默认的类型。* Servlet API规范中对该类型的请求内容提供了request.getParameter()方法来获取请求参数值。* 但当请求内容不是该类型时，需要调用request.getInputStream()或request.getReader()方法来获取请求内容值。*//*** 获取请求内容* @return* @throws IOException*/@Overridepublic BufferedReader getReader() throws IOException {return new BufferedReader(new InputStreamReader(getInputStream()));}/*** 返回请求内容字节流，多用于文件上传，* request.getReader()是对前者返回内容的封装，可以让调用者更方便字符内容的处理（不用自己先获取字节流再做字符流的转换操作）* @return* @throws IOException*/@Overridepublic ServletInputStream getInputStream() throws IOException {final ByteArrayInputStream bais = new ByteArrayInputStream(body);return new ServletInputStream() {@Overridepublic int read() throws IOException {return bais.read();}@Overridepublic boolean isFinished() {// TODO Auto-generated method stubreturn false;}@Overridepublic boolean isReady() {// TODO Auto-generated method stubreturn false;}@Overridepublic void setReadListener(ReadListener arg0) {// TODO Auto-generated method stub}};}}

创建拦截器第二步：

编写过滤器

import java.io.BufferedReader;import java.io.IOException;import java.io.PrintWriter;import javax.servlet.Filter;import javax.servlet.FilterChain;import javax.servlet.ServletException;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpServletRequest;import mons.lang3.StringUtils;import com.alibaba.fastjson.JSONObject;import mon.entity.Result;import com.digipower.http.servlet.request.wrapper.XssAndSqlHttpServletRequestWrapper;/*** 防止XSS 攻击和SQL注入攻击的Filter* @ClassName: XssAndSqlFilter * @Description:TODO(这里用一句话描述这个类的作用) * @author:* @date: 3月22日 下午2:29:12 ** @Copyright: * 注意：*/public class XssAndSqlFilter implements Filter {@Overridepublic void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)throws IOException, ServletException {String method = "GET";//设置初始值String param = "";XssAndSqlHttpServletRequestWrapper xssRequest = null;if (request instanceof HttpServletRequest) {//判断左边的对象是否是它右边对象的实例method = ((HttpServletRequest) request).getMethod();//得到请求URL地址时使用的方法xssRequest = new XssAndSqlHttpServletRequestWrapper((HttpServletRequest) request);//创建对象}if ("POST".equalsIgnoreCase(method)) {//判断是否为postparam = this.getBodyString(xssRequest.getReader());//获取参数if(StringUtils.isNotBlank(param)){//等价于 str != null && str.length > 0 && str.trim().length > 0if(xssRequest.checkXSSAndSql(param)){//进行参数审查response.setCharacterEncoding("UTF-8");response.setContentType("application/json;charset=UTF-8");PrintWriter out = response.getWriter();out.write(JSONObject.toJSONString(Result.error("401", "您所访问的页面请求中有违反安全规则元素存在，拒绝访问!")));return;}}}/*** 检查参数的时候 同时检查请求的方法* 只检查get请求方法和post请求方法的的参数的数据是否合法* 并不是所有参数都要检查，首先必须是一个get或者post，再去校验参数* 因为PUT方法在进行参数审查的时候没办法通过所以直接过滤掉*/if (xssRequest.checkParameter()&&(method.equals("POST") || method.equals("GET"))){response.setCharacterEncoding("UTF-8");response.setContentType("application/json;charset=UTF-8");PrintWriter out = response.getWriter();out.write(JSONObject.toJSONString(Result.error("401", "您所访问的页面请求中有违反安全规则元素存在，拒绝访问!")));return;}chain.doFilter(xssRequest, response);}// 获取request请求body中参数public static String getBodyString(BufferedReader br) {String inputLine;String str = "";try {while ((inputLine = br.readLine()) != null) {str += inputLine;}br.close();} catch (IOException e) {System.out.println("IOException: " + e);}return str;}}

创建拦截器第三步

在webconfig中注册过滤器XssAndSqlFilter

@Configuration@EnableWebMvcpublic class SpringMVCConfig extends WebMvcConfigurerAdapter {@Beanpublic FilterRegistrationBean xssFilterRegistrationBean() {// 创建一个自定义的 FilterFilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();filterRegistrationBean.setFilter(new XssAndSqlFilter());filterRegistrationBean.setOrder(1);filterRegistrationBean.setEnabled(true);filterRegistrationBean.addUrlPatterns("/*");// 过滤指定请求地址Map<String, String> initParameters = new HashMap<String, String>();initParameters.put("excludes", "/auth/login,/auth/code,/auth/phone,/swagger-ui.html/**,/swagger-resources/**,/webjars/**,/v2/api-docs/**,/upload_file/**");initParameters.put("isIncludeRichText", "true");filterRegistrationBean.setInitParameters(initParameters);return filterRegistrationBean;}}

备注

excludes用于配置不需要参数过滤的请求url。

isIncludeRichText默认为true，主要用于设置富文本内容是否需要过滤。