XSS攻擊

什麼是XSS攻擊？

XSS攻擊使用Javascript腳本注入進行攻擊

例如在表單中注入: <script>location.href='http://www.itmayiedu.com'</script>

注意:谷歌瀏覽器 已經防止了XSS攻擊，爲了演示效果，最好使用火狐瀏覽器

解決方案

使用Fileter過濾器過濾器注入標籤

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import org.apache.commons.lang3.StringEscapeUtils;
import org.apache.commons.lang3.StringUtils;

/**
 * 防止XSS攻擊
 */
public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {
	HttpServletRequest request;
	public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) {
		super(request);
		this.request = request;
	}
	@Override
	public String getParameter(String name) {
		String value = request.getParameter(name);
		System.out.println("name:" + name + "," + value);
		if (!StringUtils.isEmpty(value)) {
			// 轉換Html
			value = StringEscapeUtils.escapeHtml4(value);
		}
		return value;
	}
}

實際是經過轉義字符來解決的