XSS跨站點腳本攻擊攔截器

別的就不說了，直接上代碼： 一、web.xml文件的配置 <!-- xss跨站點腳本攻擊攔截器 --> <filter> <filter-name>xssFilter</filter-name> <filter-class>com.gzqh.common.interceptor.XSSFilter</filter-class> </filter> <filter-mapping> <filter-name>xssFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> 二、攔截器代碼 1）類1代碼： package com.gzqh.common.interceptor;

import java.io.IOException;

import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest;

public class XSSFilter implements Filter { @Override public void init(FilterConfig filterConfig) throws ServletException {
}

@Override 
public void doFilter(ServletRequest request, ServletResponse response,  
        FilterChain chain) throws IOException, ServletException {  

    XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(  
            (HttpServletRequest) request);  
    chain.doFilter(xssRequest, response);  
}  

@Override 
public void destroy() {  
}

}

2）類2代碼 package com.gzqh.common.interceptor;

import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper;

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { HttpServletRequest orgRequest = null;

public XssHttpServletRequestWrapper(HttpServletRequest request) {  
    super(request);  
    orgRequest = request;  
}  

/** 
 * 覆蓋getParameter方法，將參數名和參數值都作xss過濾。<br/> 
 * 若是須要得到原始的值，則經過super.getParameterValues(name)來獲取<br/> 
 * getParameterNames,getParameterValues和getParameterMap也可能須要覆蓋 
 */ 
@Override 
public String getParameter(String name) {  
    String value = super.getParameter(xssEncode(name));  
    if (value != null) {  
        value = xssEncode(value);  
    }  
    return value;  
}  

/** 
 * 覆蓋getHeader方法，將參數名和參數值都作xss過濾。<br/> 
 * 若是須要得到原始的值，則經過super.getHeaders(name)來獲取<br/> 
 * getHeaderNames 也可能須要覆蓋 
 */ 
@Override 
public String getHeader(String name) {  

    String value = super.getHeader(xssEncode(name));  
    if (value != null) {  
        value = xssEncode(value);  
    }  
    return value;  
}  

/** 
 * 將容易引發xss漏洞的半角字符直接替換成全角字符 
 *  
 * @param s 
 * @return 
 */ 
private static String xssEncode(String s) {  
    if (s == null || s.isEmpty()) {  
        return s;  
    }
    StringBuilder sb = new StringBuilder(s.length() + 16);  
    for (int i = 0; i < s.length(); i++) {  
        char c = s.charAt(i);  
        switch (c) {  
        case '>':  
            //sb.append("&gt;");// 轉義大於號   
            break;  
        case '<':  
            //sb.append("&lt;");// 轉義小於號   
            break;  
        case '\'':  
            //sb.append("'");// 轉義單引號   
            break;  
        case '\"':  
            //sb.append("&quot;");// 轉義雙引號   
            break;
        case '(':
            break;
        case ')':
            break;
        case ';':
            break;
        case '&':  
            sb.append("&");// 轉義&   
            break;  
        default:  
            sb.append(c);  
            break;  
        }  
    }  
    return sb.toString();  
}  

/** 
 * 獲取最原始的request 
 *  
 * @return 
 */ 
public HttpServletRequest getOrgRequest() {  
    return orgRequest;  
}  

/** 
 * 獲取最原始的request的靜態方法 
 *  
 * @return 
 */ 
public static HttpServletRequest getOrgRequest(HttpServletRequest req) {  
    if (req instanceof XssHttpServletRequestWrapper) {  
        return ((XssHttpServletRequestWrapper) req).getOrgRequest();  
    }  

    return req;  
}

}