使用装饰器防止Xss攻击

使用装饰器防止Xss攻击

1. 创建一个装饰器用来增强request的getParamter方法
2. 重写getParameter方法，让此方法 过滤hmtl代码里面的”<” 和”>”符号

/**
 * 装饰器模式防止xxs攻击
 * @author zengxin
 *
 */
public class MyHtmlRequest extends HttpServletRequestWrapper{                                                                                                                                                                                                                          
    private HttpServletRequest request;

    public MyHtmlRequest(HttpServletRequest request) {
        super(request);
        this.request = request;
    }

    @Override
    public String getParameter(String name) {


        return getHtml(name);
    }

    /**
     * 处理html字符
     * 
     */
    private String getHtml(String name){
        String value = request.getParameter(name);
        //result 用于接受转义后的字符
        StringBuffer result = new StringBuffer();

        char[] contentes = new char[value.length()];
        //start到end-1位置上的字符复制到字符数组contentes中
        value.getChars(0, value.length(), contentes, 0);

        for(int i=0;i<contentes.length;i++){
            System.out.println(contentes[i]);
            switch (contentes[i]) {
            //将“<转”义为&lt
            case '<':
                result.append("&lt");
                break;
            case '>':
                result.append("&gt");
                break;
            default:
                result.append(contentes[i]);
                break;
            }
        }
        return result.toString();
    }


}

Filter 设置

1. 将装饰器MyHtmlRequest创建的request
2.使用filter携带增强的reuqest

public class MyHtmlFilter implements Filter{

    @Override
    public void init(FilterConfig filterconfig) throws ServletException {


    }

    @Override
    public void doFilter(ServletRequest servletrequest,
            ServletResponse servletresponse, FilterChain filterchain)
            throws IOException, ServletException {
        //将ServletRequest转换为HttpServletRequest
        HttpServletRequest request = (HttpServletRequest)servletrequest;

        MyHtmlRequest req = new MyHtmlRequest(request);
        //将ServletResponse转换为HttpServletResponse
        HttpServletResponse response  = (HttpServletResponse)servletresponse;

        System.out.println("将放行");
        //filter放行后携带request和response
        filterchain.doFilter(req, response);



    }

    @Override
    public void destroy() {
        // TODO Auto-generated method stub

    }

}

filter拦截MyHtmlServlet

  <!-- HMTL filter设置 -->
  <filter>
    <filter-name>MyHtmlRequest</filter-name>
    <filter-class>com.zx.servletXXs.MyHtmlFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>MyHtmlRequest</filter-name>
    <url-pattern>/MyHtmlServlet</url-pattern>
  </filter-mapping>

  ```

## Servlet接收数据后显示数据

```java

public class MyHtmlServlet extends HttpServlet{

    @Override
    public void init() throws ServletException {
        // TODO Auto-generated method stub
        super.init();
    }

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {
        PrintWriter out = resp.getWriter();
        String value = req.getParameter("user");
        System.out.println(value);


        out.println(value);


        out.flush();
        out.close();


    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws ServletException, IOException {


    }

    @Override
    public void destroy() {
        super.destroy();
    }
}






<div class="se-preview-section-delimiter"></div>

servlet设置

  <servlet>
    <servlet-name>MyHtmlServlet</servlet-name>
    <servlet-class>com.zx.servletXXs.MyHtmlServlet</servlet-class>
  </servlet>
 <servlet-mapping>
    <servlet-name>MyHtmlServlet</servlet-name>
    <url-pattern>/MyHtmlServlet</url-pattern>
  </servlet-mapping>

当提交后显示：