Web 安全头号大敌 XSS 漏洞解决最佳实践

<script>alert('hello world')</script>
<script src='http://www.smart4j.cn/xxx.js'></script>
<input type="button" value="评论"></input>

replaceAll("<script", "");
...

{ "<", ">", "\""}
转义：
{ "&lt;", "&gt;", "&quot;"})
全角：
{ "＜", "＞", "\＂"}

<span th:utext="${ result }"></span>---><span th:text="${ result }"></span>
<!-- utext 与 text 区别 -->

<c:out value=" ${ content }"  escapeXml="false" />---><c:out value=" ${ content }"/> <!-- escapeXml默认true -->

<!--防止XSS攻击的antiSamy-->
<dependency>
      <groupId>org.owasp.antisamy</groupId>
      <artifactId>antisamy</artifactId>
      <version>1.5.7</version>
</dependency>

<!--fastjson依赖-->
<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>fastjson</artifactId>
    <version>1.2.62</version>
</dependency>

/**
 * @program: xss-demo
 * @author: Mr.Zhang
 * @create: 2021-02-21 15:45
 **/
public class XssFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        HttpServletRequest req = (HttpServletRequest) request;
        String path = req.getServletPath();
        //注解配置的是urlPatterns="/*"(过滤所有请求),所以这里对不需要过滤的静态资源url,作忽略处理(大家可以依照具体需求配置)
        String[] exclusionsUrls = {".js", ".gif", ".jpg", ".png", ".css", ".ico"};
        for (String str : exclusionsUrls) {
            if (path.contains(str)) {
                chain.doFilter(request, response);
                return;
            }
        }
        chain.doFilter(new XssRequestWrapper(httpServletRequest), response);
    }
}

/**
 * @program: xss-demo
 * @author: Mr.Zhang
 * @create: 2021-02-21 15:46
 **/
@Slf4j
public class XssRequestWrapper extends HttpServletRequestWrapper {
    public XssRequestWrapper(HttpServletRequest request) {
        super(request);
    }

    /**
     * 获取策略文件，直接使用jar中自带的ebay策略文件
     */
    private static InputStream inputStream = XssRequestWrapper.class.getClassLoader()
            .getResourceAsStream("antisamy-ebay.xml");
    private static Policy policy = null;

    static {
        try {
            // 使用静态代码块处理策略对象的创建
            policy = Policy.getInstance(inputStream);
        } catch (PolicyException e) {
            e.printStackTrace();
        }
    }

    /**
     * 使用AntiSamy进行过滤数据
     * @param html
     * @return
     */
    private String xssClean(String html) {
        String cleanHTML = "";
        try {
            AntiSamy antiSamy = new AntiSamy();
            CleanResults scan = antiSamy.scan(html, policy);
            cleanHTML = scan.getCleanHTML();
        } catch (ScanException e) {
            e.printStackTrace();
        } catch (PolicyException e) {
            e.printStackTrace();
        }
        return cleanHTML;
    }

    /**
     * 重写处理请求参数的方法
     * @param name
     * @return
     */
    @Override
    public String[] getParameterValues(String name) {
        String[] values = super.getParameterValues(name);

        // 判断参数有值，如果没有值，直接返回
        if (values == null) {
            return null;
        }

        // 遍历参数数组，使用AntiSamy进行过滤
        int len = values.length;
        String[] newValues = new String[len];
        for (int i = 0; i < len; i++) {
            // 过滤前的数据
            log.info("使用AntiSamy进行过滤清理，过滤清理之前的数据：{}", values[i]);
            // 进行过滤
            newValues[i] = xssClean(values[i]);
            // 过滤后的数据
            log.info("使用AntiSamy进行过滤清理，过滤清理之后的数据：{}", newValues[i]);
        }

        //返回过滤后的结果
        return newValues;
    }

    /**
     * 重写处理json数据的方法
     * @return
     * @throws IOException
     */
    @Override
    public ServletInputStream getInputStream() throws IOException {
        // 读取流
        BufferedReader reader = new BufferedReader(
                new InputStreamReader(super.getInputStream(), "UTF-8"));

        // 获取json格式的数据
        StringBuilder sb = new StringBuilder();
        String inputStr;
        while ((inputStr = reader.readLine()) != null) {
            sb.append(inputStr);
        }

        // 把json转为map
        Map map = JSON.parseObject(sb.toString(), Map.class);

        // 过滤前
        log.info("json过滤前:{}", sb.toString());
        // 对map中的value值进行AntiSamy的过滤
        map.keySet().forEach(k -> {
            map.put(k, xssClean(map.get(k).toString()));
        });
        // 过滤后
        String json = JSON.toJSONString(map);
        log.info("json过滤后:{}", json);

        // 把json数据转为流的格式进行返回
        ByteArrayInputStream bais = new ByteArrayInputStream(json.getBytes());

        return new ServletInputStream() {
            @Override
            public boolean isFinished() {
                return false;
            }

            @Override
            public boolean isReady() {
                return false;
            }

            @Override
            public void setReadListener(ReadListener listener) { }

            @Override
            public int read() throws IOException {
                return bais.read();
            }
        };

    }
}

/**
 * @program: xss-demo
 * @author: Mr.Zhang
 * @create: 2021-02-21 15:58
 **/
@Configuration
public class AntiSamyConfig {

    /**
     * 配置xss过滤器
     * @return
     */
    @Bean
    public FilterRegistrationBean create() {
        FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean(new XssFilter());
        filterRegistrationBean.addUrlPatterns("/*");
        filterRegistrationBean.setOrder(1);
        return filterRegistrationBean;
    }
}

/**
 * @program: xss-demo
 * @author: Mr.Zhang
 * @create: 2021-02-21 15:42
**/
@Data
public class User {
    private int id;
    private String name;
    private int age;
}

/**
 * @program: xss-demo
 * @author: Mr.Zhang
 * @create: 2021-02-21 15:43
 **/
@Slf4j
@RestController
@RequestMapping("user")
public class UserController {
    /**
     * 表单
     * @param user
     * @return
     */
    @PostMapping("save")
    public String save(User user) {
        log.info("name={}, age={}", user.getName(), user.getAge());
        return JSON.toJSONString(user);
    }

    /**
     * json数据格式请求体
     * @param user
     * @return
     */
    @PostMapping("json")
    public String saveJson(@RequestBody User user) {
        log.info("user={}", user.toString());
        return JSON.toJSONString(user);
    }
}

resp.setHeader("Content-Security-Policy","default-src http: https:");

<meta http-equiv="Content-Security-Policy" content="form-action 'self';">