xssFilter

xss过滤器


import XSSRexConstants;
import org.apache.commons.fileupload.servlet.ServletFileUpload;
import org.apache.commons.lang3.StringEscapeUtils;
import org.apache.commons.lang3.StringUtils;
import org.springframework.web.multipart.commons.CommonsMultipartResolver;
import org.springframework.web.multipart.support.DefaultMultipartHttpServletRequest;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.text.Normalizer;
import java.text.Normalizer.Form;
import java.util.Enumeration;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

/**
* a fine-grained xss filter based on blacklist
*
*/
// @WebFilter("/xssFilter")
public class XSSCheckFilter implements Filter {

/**
* 处理multipart请求
*/
private CommonsMultipartResolver multipartResolver = new CommonsMultipartResolver();

// 黑名单，要求全部小写
// 可疑关键字、函数、标签、事件,函数加左括号，标签加左尖括号，事件加等号。
private static final String blackList[] = new String[] {
// 可疑关键字
"`",
"javascript",
"@import",
"x:script",
"window.location",
"jscript",
"vbscript",
"http-equiv",
"![cdata[",
"with(document)",
// 可疑标签
"<iframe",
"<frameset",
"<marquee",
"<form",
"<object",
"<applet",
"<embed",
"<meta",
"<value",
"<comment>",
"<!doctype",
"<script",
// 可疑函数
"$.get(",
"$.getscript(",
"alert(",
"unescape(",
"execscript(",
"eval(",
"prompt(",
"msgbox(",
"fromcharcode(",
"encodeuri(",
"encodeuricomponent(",
"confirm(",
// 可疑事件
"autofocus=", "onabort=", "onactivate=", "onafterprint=",
"onafterupdate=", "onbeforeactivate=", "onbeforecopy=",
"onbeforecut=", "onbeforedeactivate=", "onbeforeeditfocus=",
"onbeforepaste=", "onbeforeprint=", "onbeforeunload=",
"onbeforeupdate=", "onblur=", "onbounce=", "oncellchange=",
"onchange=", "onclick=", "oncontextmenu=", "oncontrolselect=",
"oncopy=", "oncut=", "ondataavailable=", "ondatasetchanged=",
"ondatasetcomplete=", "ondblclick=", "ondeactivate=", "ondrag=",
"ondragend=", "ondragenter=", "ondragleave=", "ondragover=",
"ondragstart=", "ondrop=", "onerror=", "onerrorupdate=",
"onfilterchange=", "onfinish=", "onfocus=", "onfocusin=",
"onfocusout=", "onhelp=", "onkeydown=", "onkeypress=", "onkeyup=",
"onlayoutcomplete=", "onload=", "onlosecapture=", "onmousedown=",
"onmouseenter=", "onmouseleave=", "onmousemove=", "onmouseout=",
"onmouseover=", "onmouseup=", "onmousewheel=", "onmove=",
"onmoveend=", "onmovestart=", "onpaste=", "onpropertychange=",
"onreadystatechange=", "onreset=", "onresize=", "onresizeend=",
"onresizestart=", "onrowenter=", "onrowexit=", "onrowsdelete=",
"onrowsinserted=", "onscroll=", "onselect=", "onselectionchange=",
"onselectstart=", "onstart=", "onstop=", "onsubmit=", "onunload=",
"window.location", "<![CDATA[<svg]]>", "onlosecapture=",
"onmousedown=", "onmouseenter=", "onmouseleave=", "onmousemove=",
"onmouseout=", "onmouseover=", "onmouseup=", "onmousewheel=",
"onmove=", "onmoveend=", "onmovestart=", "onpaste=",
"onpropertychange=", "onreadystatechange=", "onreset=",
"onresize=", "onresizeend=", "onresizestart=", "onrowenter=",
"onrowexit=", "onrowsdelete=", "onrowsinserted=", "onscroll=",
"onselect=", "onselectionchange=", "onselectstart=", "onstart=",
"onstop=", "onsubmit=", "onunload=", "onhaschange=", "onmessage=",
"onoffline=", "ononline=", "onpagehide=", "onpageshow=",
"onpopstate=", "onredo=", "onstorage=", "onundo=", "onformchange=",
"onforminput=", "oninput=", "oninvalid=", "oncanplay=",
"oncanplaythrough=", "ondurationchange=", "onemptied=", "onended=",
"onloadeddata=", "onloadedmetadata=", "onloadstart=", "onpause=",
"onplay=", "onplaying=", "onprogress=", "onratechange=",
"onreadystatechange=", "onseeked=", "onseeking=", "onstalled=",
"onsuspend=", "ontimeupdate=", "onvolumechange=", "onwaiting=",
"ontoggle=", "onshow=", "onwheel=", "onsearch=", ".replace(",
".concat(", "join(", "&amp;tab;" };

/**
* Default constructor.
*/
public XSSCheckFilter() {

}

/**
* @see Filter#destroy()
*/
public void destroy() {

}

/**
* @see Filter#doFilter(ServletRequest, ServletResponse, FilterChain)
*/
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
HttpServletResponse httpResponse = (HttpServletResponse) response;
request.setCharacterEncoding("UTF-8");

if (ServletFileUpload.isMultipartContent((HttpServletRequest) request)) {
DefaultMultipartHttpServletRequest multiReq = (DefaultMultipartHttpServletRequest) multipartResolver
.resolveMultipart((HttpServletRequest) request);

Enumeration<?> enu = multiReq.getParameterNames();
// 遍历参数
while (enu.hasMoreElements()) {
String name = (String) enu.nextElement();
String[] values = multiReq.getParameterValues(name);
if (values != null) {
for (String value : values) {
if (!isXssSafe(value)) {

System.out.println(name);
httpResponse
.sendError(HttpServletResponse.SC_BAD_REQUEST);
return;
}
}

}
}

chain.doFilter(multiReq, response);
return;
} else {
Enumeration<?> enu = request.getParameterNames();
// 遍历参数
while (enu.hasMoreElements()) {
String name = (String) enu.nextElement();
String[] values = request.getParameterValues(name);
if (values != null) {
for (String value : values) {
if (!isXssSafe(value)) {
httpResponse
.sendError(HttpServletResponse.SC_BAD_REQUEST);
return;
}
}

}
}
chain.doFilter(request, response);
}
}

/**
* @see Filter#init(FilterConfig)
*/
public void init(FilterConfig fConfig) throws ServletException {

}

/**
* 根据输入key和value判断value是否为xss payload
* 目前的实现没有用到key值，若需要根据key来特殊化规则，可以传入key值并在filter方法中添加个性化实现 isXssSafe(String
* key, String value)
*
* @param key
*            http请求参数中的key
* @param value
*            http请求参数中的value
* @return 若判断value为xss payload，则返回false，否则返回true
*
*/
/**
* @param value
* @param value
* @return
*/
public static boolean isXssSafe(String value) {
if (StringUtils.isEmpty(value)) {
return true;
}
/**** 长度限制 ****/
// 若可能，请根据key来限制value的输入长度
/**** 格式校验 ****/
// 若可能，请根据key对value做格式校验

/**** 规范化 ****/
/**
* 全角转半角
*
*/
value = Normalizer.normalize(value, Form.NFC);
// html entity解码
// 包含实体名称解码、实体编号解码(实体编号后面不带;则不会解码)
value = StringEscapeUtils.unescapeHtml4(value);
// 多行转为单行
value = toSingleLine(value);
// 转换为小写
value = value.toLowerCase();

/**** Payload特征，假设正常报文不会出现 ****/
// 注释
if (value.matches(XSSRexConstants.REX_COMMENT)) {
return false;
}

// /正则/.source
if (value.matches(XSSRexConstants.REX_REX_SOURCE)) {
return false;
}

// &{()}
if (value.matches(".*&\\{.*\\}.*")) {
return false;
}

/**** 编码特征，假设正常报文不会出现 ****/
// 十进制编码
if (getCountByRex(value, "&?#\\d{1,7};?", true) > 0) {
return false;
}

// 十六进制编码
if (getCountByRex(value, "&#[x|X][0-9a-f]{1,};?", true) > 0) {
return false;
}
if (getCountByRex(value, "\\\\[x|X][0-9a-fA-F]{1,}", true) > 0) {
return false;
}

// unicode编码
if (getCountByRex(value, "\\\\u?[0-9a-fA-F]{1,}", true) > 0) {
return false;
}
if (getCountByRex(value, "%u[0-9a-fA-F]{4}", true) > 0) {
return false;
}
if (getCountByRex(value, "\\\\u\\{.*\\}", true) > 0) {
return false;
}

// url编码
if (getCountByRex(value, "%[0-9a-fA-F]{2}", true) > 0) {
return false;
}

// ascii转换
if (getCountByRex(value, "chr\\(\\d+\\)", true) > 0) {
return false;
}

// jjencode
if (getCountByRex(value, "\\[.*?\\]", false) > 5/* magic number */) {// 使用非贪心的正则匹配[]、

			return false;
		}

		/**** 净化 ****/
		// 移除特殊字符
		value = value.replaceAll("/", ""); // 移除'/'
		value = value.replaceAll("\\\\", ""); // 移除'\'
		value = value.replaceAll("\\+", ""); // 移除'+'
		value = value.replaceAll("\'", ""); // 移除'''
		value = value.replaceAll("\"", ""); // 移除'"'

		/**** 关键字过滤 ****/
		// 黑名单过滤
		for (String keyword : blackList) {
			if (value.contains(keyword)) {
				return false;
			}
		}

		// 特定场景过滤
		// data+base64
		if (value.matches(XSSRexConstants.REX_DATA_BASE64)) {
			return false;
		}
		// src
		if (value.matches(XSSRexConstants.REX_SRC)) {
			return false;
		}
		// href
		if (value.matches(XSSRexConstants.REX_HREF)) {
			return false;
		}
		// style
		if (value.matches(XSSRexConstants.REX_STYLE)) {
			return false;
		}
		// document.cookie with(document)cookie document.location
		if (value.matches(XSSRexConstants.REX_DOCUMENT)) {
			return false;
		}
		// location.hash
		if (value.matches(XSSRexConstants.REX_LOCATION_HASH)) {
			return false;
		}
		// js expression
		if (value.matches(XSSRexConstants.REX_JS_EXPRESSION)) {
			return false;
		}

		// 数组的join方法
		if (value.matches(XSSRexConstants.REX_JOIN)) {
			return false;
		}

		return true;
	}

	/**
	 * 根据正则在字符串中查找，返回正则匹配到的次数
	 *
	 * @param str
	 * @param pattern
	 * @param stopFast
	 *            若为true，则匹配到1次就返回，此时@return返回1
	 * @return
	 */
	private static int getCountByRex(String str, String pattern,
			boolean stopFast) {
		Pattern p = Pattern.compile(pattern);
		Matcher m = p.matcher(str);
		int count = 0;
		while (m.find()) {
			count++;
			if (stopFast) {
				break;
			}
		}
		return count;
	}

	private static String toSingleLine(String value) {
		Pattern pattern = Pattern.compile("\\s"); // 匹配任何空白字符，包括空格、制表符、换页符等。与 [
		// \f\n\r\t\v] 等效。
		Matcher matcher = pattern.matcher(value);
		value = matcher.replaceAll("");
		return value;
	}

}

public class XSSRexConstants {

    public static final String REX_COMMENT = "(.*<!--.*-->.*)|(.*/\\*.*\\*/.*)";
    public static final String REX_DATA_BASE64 = ".*data.*;base64.*";
    public static final String REX_REX_SOURCE = ".*\\/.*\\/\\.source.*";
    public static final String REX_JS_EXPRESSION = ".*expression.*\\(.*\\).*";
    public static final String REX_JOIN = ".*join.*\\(.*\\).*";
    public static final String REX_HREF = ".*<.*href.*=.*>.*";
    public static final String REX_LOCATION_HASH = ".*location.*hash.*";
    public static final String REX_DOCUMENT = ".*document.*(cookie|location).*";
    public static final String REX_SRC = ".*<.*src.*";
    public static final String REX_STYLE = ".*<.*style.*";
    public static final String REX_JJ = ".*\\[.*?\\].*";
}

调用：

XSSCheckFilter.isXssSafe(servletRequest.getRequestURI())
					&& XSSCheckFilter
							.isXssSafe(servletRequest.getQueryString())