| commit | author | age | ||
| 9bcb19 | 1 | /* |
| I | 2 | Copyright [2020] [https://www.xiaonuo.vip] |
| 3 | ||
| 4 | Licensed under the Apache License, Version 2.0 (the "License"); | |
| 5 | you may not use this file except in compliance with the License. | |
| 6 | You may obtain a copy of the License at | |
| 7 | ||
| 8 | http://www.apache.org/licenses/LICENSE-2.0 | |
| 9 | ||
| 10 | Unless required by applicable law or agreed to in writing, software | |
| 11 | distributed under the License is distributed on an "AS IS" BASIS, | |
| 12 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| 13 | See the License for the specific language governing permissions and | |
| 14 | limitations under the License. | |
| 15 | ||
| 16 | Snowy采用APACHE LICENSE 2.0开源协议，您在使用过程中，需要注意以下几点： | |
| 17 | ||
| 18 | 1.请不要删除和修改根目录下的LICENSE文件。 | |
| 19 | 2.请不要删除和修改Snowy源码头部的版权声明。 | |
| 20 | 3.请保留源码和相关描述文件的项目出处，作者声明等。 | |
| 21 | 4.分发源码时候，请注明软件出处 https://gitee.com/xiaonuobase/snowy | |
| 22 | 5.在修改包名，模块名称，项目代码等时，请注明软件出处 https://gitee.com/xiaonuobase/snowy | |
| 23 | 6.若您的项目无法满足以上几点，可申请商业授权，获取Snowy商业授权许可，请在官网购买授权，地址为 https://www.xiaonuo.vip | |
| 24 | */ | |
| 25 | package vip.xiaonuo.sys.core.filter.xss; | |
| 26 | ||
| 27 | import javax.servlet.http.HttpServletRequest; | |
| 28 | import javax.servlet.http.HttpServletRequestWrapper; | |
| 29 | ||
| 30 | /** | |
| 31 | * xss针对http请求的包装 | |
| 32 | * | |
| 33 | * @author yubaoshan | |
| 34 | * @date 2020/6/21 10:29 | |
| 35 | */ | |
| 36 | public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { | |
| 37 | ||
| 38 | XssHttpServletRequestWrapper(HttpServletRequest servletRequest) { | |
| 39 | super(servletRequest); | |
| 40 | } | |
| 41 | ||
| 42 | @Override | |
| 43 | public String[] getParameterValues(String parameter) { | |
| 44 | String[] values = super.getParameterValues(parameter); | |
| 45 | if (values == null) { | |
| 46 | return null; | |
| 47 | } | |
| 48 | int count = values.length; | |
| 49 | String[] encodedValues = new String[count]; | |
| 50 | for (int i = 0; i < count; i++) { | |
| 51 | encodedValues[i] = cleanXss(values[i]); | |
| 52 | } | |
| 53 | return encodedValues; | |
| 54 | ||
| 55 | } | |
| 56 | ||
| 57 | @Override | |
| 58 | public String getParameter(String parameter) { | |
| 59 | String value = super.getParameter(parameter); | |
| 60 | if (value == null) { | |
| 61 | return null; | |
| 62 | } | |
| 63 | return cleanXss(value); | |
| 64 | } | |
| 65 | ||
| 66 | @Override | |
| 67 | public String getHeader(String name) { | |
| 68 | String value = super.getHeader(name); | |
| 69 | if (value == null) { | |
| 70 | return null; | |
| 71 | } | |
| 72 | return cleanXss(value); | |
| 73 | } | |
| 74 | ||
| 75 | private String cleanXss(String value) { | |
| 76 | ||
| 77 | value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;"); | |
| 78 | ||
| 79 | value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;"); | |
| 80 | ||
| 81 | value = value.replaceAll("'", "& #39;"); | |
| 82 | ||
| 83 | value = value.replaceAll("eval\\((.*)\\)", ""); | |
| 84 | ||
| 85 | value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\""); | |
| 86 | ||
| 87 | return value; | |
| 88 | ||
| 89 | } | |
| 90 | ||
| 91 | } | |
