解决XSS攻击

最新推荐文章于 2026-03-30 13:51:51 发布

原创最新推荐文章于 2026-03-30 13:51:51 发布 · 1.4k 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

实例专栏收录该内容

16 篇文章

订阅专栏

本文介绍了一种通过自定义过滤器XSSFilter和包装请求对象XssAndSqlHttpServletRequestWrapper来防止XSS攻击的方法。该机制在Java Web应用中对用户输入进行HTML转义，有效阻止恶意脚本注入。

1、XSSFilter.java

public class XssFiter implements Filter {

    public void init(FilterConfig filterConfig) throws ServletException {

    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        XssAndSqlHttpServletRequestWrapper xssRequestWrapper = new XssAndSqlHttpServletRequestWrapper(req);
        chain.doFilter(xssRequestWrapper, response);
    }

    public void destroy() {

    }

}

2、XssAndSqlHttpServletRequestWrapper.java

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import org.apache.commons.lang3.StringEscapeUtils;
import org.apache.commons.lang3.StringUtils;

/**
 * 防止XSS攻击
 */
public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {
    HttpServletRequest request;
    public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
        this.request = request;
    }
    @Override
    public String getParameter(String name) {
        String value = request.getParameter(name);
        System.out.println("name:" + name + "," + value);
        if (!StringUtils.isEmpty(value)) {
            // 转换Html
            value = StringEscapeUtils.escapeHtml4(value);
        }
        return value;
    }
}