360[警告]跨站脚本攻击漏洞/java web利用Filter防止XSS/Spring MVC防止XSS攻击

就以这张图片作为开篇和问题引入吧

<options>问题解决办法请参考上一篇

如何获取360站长邀请码，360网站安全站长邀请码

首先360能够提供一个这样平台去检测还是不错的。但是当体检出来 看到漏洞报告，以为360会像windows上360安全卫士一样帮我们打好补丁。但是实际发现漏洞是要自己修复,并且php和asp aspx有360提供的补丁或者解决方案（想要看这些方案之前要申请为站长但是需要邀请码 这个可以在页面 页面左下角 360主机卫士感恩卡里面领取）。

进入修复方案后发现java几乎没有提供一些建议，只能自己处理。开始使用搜索引擎搜索 java防止xss攻击代码。
http://www.yihaomen.com/article/java/409.htm
查到了这个方案

. 可以采用spring 里面提供的工具类来实现.

一， 第一种方法。

public class XSSFilter implements Filter {

@Override
public void init(FilterConfig filterConfig) throws ServletException {
}

@Override
public void destroy() {
}

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
chain.doFilter(new XSSRequestWrapper((HttpServletRequest) request), response);
}

}

再实现 ServletRequest 的包装类

import java.util.regex.Pattern;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public class XSSRequestWrapper extends HttpServletRequestWrapper {

public XSSRequestWrapper(HttpServletRequest servletRequest) {
super(servletRequest);
}

@Override
public String[] getParameterValues(String parameter) {
String[] values = super.getParameterValues(parameter);

if (values == null) {
return null;
}

int count = values.length;
String[] encodedValues = new String[count];
for (int i = 0; i < count; i++) {
encodedValues[i] = stripXSS(values[i]);
}

return encodedValues;
}

@Override
public String getParameter(String parameter) {
String value = super.getParameter(parameter);

return stripXSS(value);
}

@Override
public String getHeader(String name) {
String value = super.getHeader(name);
return stripXSS(value);
}

private String stripXSS(String value) {
if (value != null) {
// NOTE: It's highly recommended to use the ESAPI library and uncomment the following line to
// avoid encoded attacks.
// value = ESAPI.encoder().canonicalize(value);

// Avoid null characters
value = value.replaceAll("", "");

// Avoid anything between script tags
Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);
value = scriptPattern.matcher(value).replaceAll("");

// Avoid anything in a src='...' type of e­xpression
scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
value = scriptPattern.matcher(value).replaceAll("");

scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
value = scriptPattern.matcher(value).replaceAll("");

// Remove any lonesome </script> tag
scriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE);
value = scriptPattern.matcher(value).replaceAll("");

// Remove any lonesome <script ...> tag
scriptPattern = Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
value = scriptPattern.matcher(value).replaceAll("");

// Avoid eval(...) e­xpressions
scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
value = scriptPattern.matcher(value).replaceAll("");

// Avoid e­xpression(...) e­xpressions
scriptPattern = Pattern.compile("e­xpression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
value = scriptPattern.matcher(value).replaceAll("");

// Avoid javascript:... e­xpressions
scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);
value = scriptPattern.matcher(value).replaceAll("");

// Avoid vbscript:... e­xpressions
scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);
value = scriptPattern.matcher(value).replaceAll("");

// Avoid onload= e­xpressions
scriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
value = scriptPattern.matcher(value).replaceAll("");
}
return value;
}
}

还需要到web.xml里面配置

<filter>
<filter-name>XSSFilter</filter-name>
<filter-class>com.shanheyongmu.XSSFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>XSSFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

放上去之后 出现了 Java.lang.UnsupportedClassVersionError还是classnotfound 项目跑起来就是首页404。 然后考虑了下linux环境是jdk 1.6而编译的都是maven3.3.0以后版本以及使用的jdk 1.7 版本问题（版本切换步骤可以参考【maven学习总结】里面的execption ,版本之前工作中遇到过所以有印象） 重新换jdk和eclipse设置jdk都是1.6之后编译。不报错了shell上，但是用360快速检测我已修复，还是存在漏洞。于是继续百度
http://www.what21.com/programming/java/javaweb-summary/xss3.html 发现了不同的XssFilter写法，尝试之后还是失败。
https://my.oschina.net/wanglu/blog/267069 Springmvc安全 ，尝试之后失败，当然有些人视图解析器不同 无加spring 的form标签 无法尝试。
http://www.cnblogs.com/Mainz/archive/2012/11/01/2749874.html 来到了本篇 本篇有3种解决方法

第二种方法

web.xml加上：

<context-param>
<param-name>defaultHtmlEscape</param-name>
<param-value>true</param-value>
</context-param>

Forms加上：很多人对forms到底是哪里不理解你可以 加在<form>标签之前 或者body之前

<spring:htmlEscape defaultHtmlEscape="true" />
因为是线上项目所以无法采用以下标签 https://my.oschina.net/wanglu/blog/267069 也就是spring的标签

<form:input path="someFormField" htmlEscape="true" />

但是<spring:htmlEscape defaultHtmlEscape="true" />在jsp视图解析中还是可以的，并且这个添加方法 可以不改变原有项目。

全部部署完成后，遗憾的是还是体检有原有漏洞。

从这篇得到了答案 并且修复了 http://huangpengpeng.iteye.com/blog/2091798

<!--@分隔 -->
<filter>
<filter-name>xssFilter</filter-name>
<filter-class>com.yoro.core.web.XssFilter</filter-class>
<init-param>
<param-name>SplitChar</param-name>
<param-value>@</param-value>
</init-param>
<init-param>
<param-name>FilterChar</param-name>
<param-value>>@<@\'@\"@\\@#@(@)</param-value>
</init-param>
<init-param>
<param-name>ReplaceChar</param-name>
<param-value>＞'@＜@‘@“@＼@＃@（@）</param-value>
</init-param>
</filter>

<filter-mapping>

<filter-name>xssFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

package com.yoro.core.web;

/**
* @author zoro
*/
import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

public class XssFilter implements Filter {

private String filterChar;
private String replaceChar;
private String splitChar;
FilterConfig filterConfig = null;
public void init(FilterConfig filterConfig) throws ServletException {
this.filterChar=filterConfig.getInitParameter("FilterChar");
this.replaceChar=filterConfig.getInitParameter("ReplaceChar");
this.splitChar=filterConfig.getInitParameter("SplitChar");
this.filterConfig = filterConfig;
}

public void destroy() {
this.filterConfig = null;
}

public void doFilter(ServletRequest request, ServletResponse response,

FilterChain chain) throws IOException, ServletException {
chain.doFilter(new XssHttpServletRequestWrapper((HttpServletRequest) request,filterChar,replaceChar,splitChar), response);
}
}

package com.yoro.core.web;

import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

/**
* @author zoro
*/
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
private String[]filterChars;
private String[]replaceChars;
public XssHttpServletRequestWrapper(HttpServletRequest request,String filterChar,String replaceChar,String splitChar) {
super(request);
if(filterChar!=null&&filterChar.length()>0){
filterChars=filterChar.split(splitChar);
}
if(replaceChar!=null&&replaceChar.length()>0){
replaceChars=replaceChar.split(splitChar);
}
}
public String getQueryString() {
String value = super.getQueryString();
if (value != null) {
value = xssEncode(value);
}
return value;
}

/**
* 覆盖getParameter方法，将参数名和参数值都做xss过滤。<br/>
* 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>
* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
*/
public String getParameter(String name) {
String value = super.getParameter(xssEncode(name));
if (value != null) {
value = xssEncode(value);
}
return value;
}

public String[] getParameterValues(String name) {
String[]parameters=super.getParameterValues(name);
if (parameters==null||parameters.length == 0) {
return null;
}
for (int i = 0; i < parameters.length; i++) {
parameters[i] = xssEncode(parameters[i]);
}
return parameters;
}

/**
* 覆盖getHeader方法，将参数名和参数值都做xss过滤。<br/>
* 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/> getHeaderNames 也可能需要覆盖
*/
public String getHeader(String name) {

String value = super.getHeader(xssEncode(name));
if (value != null) {
value = xssEncode(value);
}
return value;
}

/**
* 将容易引起xss漏洞的半角字符直接替换成全角字符
*
* @param s
* @return
*/
private  String xssEncode(String s) {
if (s == null || s.equals("")) {
return s;
}
try {
s = URLDecoder.decode(s, "UTF-8");
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
}
for (int i = 0; i < filterChars.length; i++) {
if(s.contains(filterChars[i])){
s=s.replace(filterChars[i], replaceChars[i]);
}
}
return s;
}
}

由于尝试较多，也比较混乱，也不确定哪个适用各位的情况，只能多查多参考。

此处再补充一个 其他防止Xss攻击代码写法 http://www.what21.com/programming/java/javaweb-summary/xss3.html。
后来搜索到了 http://www.cnblogs.com/wangdaijun/p/5652864.html Antisamy项目实现防XSS攻击

遗憾的是配置文件很难找 我在csdn找到了antisamy.xml，大家可以基于搜索关键字 Antisamy项目实现防XSS攻击多查查 。

小弟技术菜，并且思维一般，求大神勿喷，给予指导和共同交流进步还是可以的。