Question

我正在使用过滤器过滤掉可能对应用程序进行的XSS攻击。下面的过滤器对于发送到控制器的大多数表单数据都适用。但是对于包含文件的表单，即MultipartHttpServletRequest请求，此过滤器似乎不起作用。

public class XSSFilter implements Filter{


    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }

    @Override
    public void destroy() {
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {

        chain.doFilter(new XSSRequestWrapper((HttpServletRequest) request), response);

    }

在使用包装纸之后。

public class XSSRequestWrapper extends HttpServletRequestWrapper {

private static final Logger LOG = Logger.getLogger(SessionTimeoutCookieFilter.class);



private static Pattern[] patterns = new Pattern[]{
    // Script fragments
    Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE),
    // src='...'
    Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    // lonely script tags
    Pattern.compile("</script>", Pattern.CASE_INSENSITIVE),
    Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    // eval(...)
    Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    // expression(...)
    Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    // javascript:...
    Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE),
    // vbscript:...
    Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE),
    // onload(...)=...
    Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    //cmd for xls injection...
    Pattern.compile("=cmd(.*?)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    // img tag element
    Pattern.compile("<img(.*?)>", Pattern.CASE_INSENSITIVE)
};

public XSSRequestWrapper(HttpServletRequest servletRequest) {
    super(servletRequest);
    LOG.info("= Inside XSSRequestWrapper  = ");
}

@Override
public String[] getParameterValues(String parameter) {
    String[] values = super.getParameterValues(parameter);

    if (values == null) {
        return null;
    }

    int count = values.length;
    String[] encodedValues = new String[count];
    for (int i = 0; i < count; i++) {
        encodedValues[i] = stripXSS(values[i]);
    }

    return encodedValues;
}

@Override
public String getParameter(String parameter) {
    String value = super.getParameter(parameter);

            return stripXSS(value);
}

@Override
public String getHeader(String name) {
    String value = super.getHeader(name);

    return stripXSS(value);
}

private String stripXSS(String value) {
    if (value != null) {
        // NOTE: It's highly recommended to use the ESAPI library and uncomment the following line to
        // avoid encoded attacks.
        //value = ESAPI.encoder().canonicalize(value);


        // Avoid null characters
        value = value.replaceAll("\0", "");

        // Remove all sections that match a pattern
        for (Pattern scriptPattern : patterns){
            value = scriptPattern.matcher(value).replaceAll("");
        }


    }
    return value;
}

也进行了正确的配置。

public class WebAppInitilizer extends  AbstractAnnotationConfigDispatcherServletInitializer {

@Override
public void onStartup(ServletContext servletContext) throws ServletException {
    super.onStartup(servletContext);
    servletContext.addFilter("name", XSSFilter.class)
                  .addMappingForUrlPatterns(null, false, "/*");
}

}

现在，在大多数情况下，这可以正常工作。但是，当请求类型为org.springframework.web.multipart.MultipartHttpServletRequest时，此过滤器似乎不起作用。我是这一切的新手。任何帮助将不胜感激。

谢谢。

Answer 1

一个快速的解决方案是转义文件名以避免xss攻击，另一种选择是添加自定义XSSFilter来处理常见的多部分以下文章可能会有所帮助。 http://ravisoni3545.blogspot.com/2015/07/xssfilter-for-common-multipart-and-non.html

用于MultipartHttpServletRequest的XSS过滤器

1 个答案: