xss和csrf 防御

 

CSRF攻击原理及防御：https://www.cnblogs.com/shytong/p/5308667.html 

 

CSRF 攻击的应对之道：https://www.ibm.com/developerworks/cn/web/1102_niugang_csrf/

 

 

 

 

拦截器可以获取IOC容器中的各个bean，而过滤器就不行，这点很重要，在拦截器里注入一个service，可以调用业务逻辑。

 

 

 

 

 

XSS

 

一个目标资源可以指定多个过滤器，过滤器的执行顺序是在web.xml文件中的部署顺序：

 

1.web.xml配置filter

 

  1.1配置要拦截的url的格式

 

  1.2配置拦截后的处理类

 

 

 

<filter>

    <filter-name>XSSFilter</filter-name>

    <filter-class>com.jd.ihotel.pc.webapp.filters.NewXssFilter</filter-class>

</filter>

<filter-mapping>

    <filter-name>XSSFilter</filter-name>

    <url-pattern>/*</url-pattern>

</filter-mapping>

一个filter可被多个mapping使用：

 

<filter>  

    <filter-name>authority</filter-name>  

    <filter-class>com.util.AuthorityFilter</filter-class>  

</filter>  

<filter-mapping>  

    <filter-name>authority</filter-name>  

       <url-pattern>/pages/genbill/*</url-pattern>  

</filter-mapping>  

<filter-mapping>  

    <filter-name>authority</filter-name>  

    <url-pattern>/pages/cmm/*</url-pattern>  

</filter-mapping>

2.配置依赖：

 

<dependency>

    <groupId>javax.servlet</groupId>

    <artifactId>javax.servlet-api</artifactId>

    <version>3.0.1</version>

    <scope>provided</scope>

</dependency>

新建：实现Filter类是初始化，过滤，销毁三个方法必须都实现(初始化和销毁可以是空方法，过滤方法中chain.doFilter的参数是装饰者模式的http请求对象和普通的http响应对象)

 

NewXssFilter类

过滤方法中新建一个request过滤对象(装饰者模式)，以便可以对request的参数进行更改(过滤)

 

import javax.servlet.*;

import javax.servlet.http.HttpServletRequest;

import java.io.IOException;

 

public class NewXssFilter implements Filter {

    @Override

    public void init(FilterConfig filterConfig) throws ServletException {

 

    }

 

    @Override

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {

        chain.doFilter(new NewXssHttpServletRequestWraper(

                (HttpServletRequest)request), response);//对request和response进行过滤

    }

 

    @Override

    public void destroy() {

 

    }

}

 

新建NewXssHttpServletRequestWraper类

 

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;

 

public class NewXssHttpServletRequestWraper extends HttpServletRequestWrapper {

 

    public NewXssHttpServletRequestWraper(HttpServletRequest request) {

        super(request);

    }

 

    @Override

    public String getParameter(String name) {

        return clearXss(super.getParameter(name));

    }

 

    @Override

    public String getHeader(String name) {

        return clearXss(super.getHeader(name));

    }

    @Override

    public String[] getParameterValues(String name) {

        String[] values = super.getParameterValues(name);

        if (values == null) {

            return null;

        }

        String[] newValues = new String[values.length];

 

        for (int i = 0; i < values.length; i++) {

            newValues[i] = clearXss(values[i]);

        }

        return newValues;

    }

    /**

     * 处理字符转义

     *

     * @param value

     * @return

     */

    private String clearXss(String value) {

        if (value == null || "".equals(value)) {

            return value;

        }

        value = value

                .replaceAll("'","")

                .replaceAll("\'","")

                .replaceAll("`","")

                //.replaceAll("\"","“")

                .replaceAll("<","")

                .replaceAll(">","")

                .replaceAll("\\(","（")

                .replaceAll("\\)","）")

                //.replaceAll("&","＆")

                .replaceAll("eval","")

                .replaceAll("java","")

                .replaceAll("script","")

                .replaceAll("alert","")

                .replaceAll("prompt","");

        value = value.replaceAll("eval\\((.*)\\)", "");

        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']",

                "\"\"");

        return value;

    }

 

 

 

}

下面的代码配置的过滤器必须有吗？作用是？

<filter>

    <filter-name>XssEscape</filter-name>

    <filter-class>com.jd.ihotel.pc.webapp.filters.XssFilter</filter-class>

</filter>

<filter-mapping>

    <filter-name>XssEscape</filter-name>

    <url-pattern>/*</url-pattern>

    <dispatcher>REQUEST</dispatcher>

</filter-mapping>

 

 

也可以简答粗暴不用过滤器这么写：

 

 

 

private String stripXSS(String value) {

    if (value != null) {

        value = value.replaceAll("<", "&lt;").replaceAll(">", ">");

        value = value.replaceAll("\\(", "(").replaceAll("\\)", ")");

        value = value.replaceAll("'", "'");

        value = value.replaceAll("eval\\((.*)\\)", "");

        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");

        value = value.replaceAll("script", "");

        value = value.replaceAll("%", "");

        value = value.replaceAll(";", "");

    }

    return value;

}

 

 

 

 

 

 

如果项目中使用了Spring框架，那么，很多过滤器都不用自己来写了，Spring为我们写好了一些常用的过滤器。下面我们就以字符编码的

过滤器CharacterEncodingFilter为例，来看一下Spring框架下，如果配置过滤器。

 

 

 

<filter>

 

<filter-name>encodingFilter</filter-name>

 

<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>

 

<init-param>

 

<param-name>encoding</param-name>

 

<param-value>UTF-8</param-value>

 

</init-param>

 

<init-param>

 

<param-name>forceEncoding</param-name>

 

<param-value>true</param-value>

 

</init-param>

 

</filter>

 

 

<filter-mapping>

 

<filter-name>encodingFilter</filter-name>

 

<url-pattern>/*</url-pattern>

 

</filter-mapping>

 

 

 

 

 

 

 

CSRF:访问受信网站A并在本地产生cookie，不登出A的情况访问不受信网站B(即使浏览器关闭，A的cookie不一定立即过期或会话结束)

 

http://www.cnblogs.com/shanyou/p/5038794.html

 

1.web.xml中配置springMVC：

 

<servlet>

   <servlet-name>mvc</servlet-name>

   <servlet-class>

      org.springframework.web.servlet.DispatcherServlet

   </servlet-class>

   <init-param>

      <param-name>contextConfigLocation</param-name>

      <param-value>classpath:spring-web-config.xml</param-value>

   </init-param>

   <load-on-startup>1</load-on-startup>

</servlet>

2.springMVC配置中配置拦截器

 

 <mvc:interceptors>

        <mvc:interceptor>

            <mvc:mapping path="/submitOrder.html" />

            <mvc:mapping path="/ihtrade/unpaidCancel.html"/>

            <mvc:mapping path="/ihtrade/cancel.html"/>

            <bean class="com.jd.ihtrade.core.intercepter.CheckRefferIntercepter" />

        </mvc:interceptor>

    </mvc:interceptors>

 

</beans>

 

3.新建拦截器里配置的类：

 

 

 

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.web.servlet.HandlerInterceptor;

import org.springframework.web.servlet.ModelAndView;

 

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.net.URI;

 

public class CheckRefferIntercepter implements HandlerInterceptor{

    private Logger logger = LoggerFactory.getLogger(CheckRefferIntercepter.class);

    @Override

    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws

            Exception {

        String referer = request.getHeader("referer");

        StringBuffer requestURL = request.getRequestURL();

        if(referer == null || referer.isEmpty()) {

            return false ;

        }

        try{

            if (referer.contains("?")){

                referer = referer.substring(0, referer.indexOf("?"));

            }

            URI referUri = new URI(referer);

            String domain = referUri.getHost();

            logger.info("请求目的地URL:{}来源URL:{}验证:{}",requestURL,referer,domain);

            if(domain != null){

                if(

                        domain.endsWith("360buy.com")

                        || domain.endsWith("jd.com")

                        || domain.endsWith("jd.net")

                        || domain.endsWith("jd.hk")

                        ) {

                    return true;

                }

            }

        } catch (Exception e){

            logger.error("--invalid uri--" + referer, e);

            return false ;

        }

        return false ;

    }

 

    @Override

    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {

 

    }

 

    @Override

    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {

 

    }

}

可使用拦截器验证token来避免攻击：

 

http://www.360doc.com/content/18/0223/11/31784658_731672172.shtml

 

token 是在服务端产生的。如果前端使用用户名/密码向服务端请求认证，服务端认证成功，那么在服务端会返回 token 给前端。前端可以在每次请求的时候带上 token 证明自己的合法地位。

 

zz：https://blog.csdn.net/u010287873/article/details/80769762