• 跨站脚本攻击（XSS），是目前最普遍的Web应用安全漏洞。这类漏洞能够使得攻击者嵌入恶意脚本代码到正常用户会访问到的页面中，当正常用户访问该页面时，则可导致嵌入的恶意脚本代码的执行，从而达到恶意攻击用户的目的。

处理方法

将参数中的特殊字符进行转换

• 例如 input参数值，用户输入为：

<script>alert(1);</script>

• 处理后为：

<script>alert(1);</script>

后台处理

pom.xml依赖

使用 commons-text包中的StringEscapeUtils.escapeHtml4();方法

<dependency><groupId>org.apache.commons</groupId><artifactId>commons-text</artifactId><version>1.8</version>
</dependency>

XssHttpServletRequestWrapper

对HttpServletRequest 对象的请求参数进行处理

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {public XssHttpServletRequestWrapper(HttpServletRequest request) {super(request);}@Overridepublic String getQueryString() {return StringEscapeUtils.escapeHtml4(super.getQueryString());}@Overridepublic String getParameter(String name) {return StringEscapeUtils.escapeHtml4(super.getParameter(name));}@Overridepublic String[] getParameterValues(String name) {String[] values = super.getParameterValues(name);if (ArrayUtils.isEmpty(values)) {return values;}int length = values.length;String[] escapeValues = new String[length];for (int i = 0; i < length; i++) {escapeValues[i] = StringEscapeUtils.escapeHtml4(values[i]);}return escapeValues;}}

XssFilter

使用WebFilter注解，拦截所有请求，过滤请求参数

@Slf4j
@WebFilter(filterName = "xssFilter", urlPatterns = "/*", asyncSupported = true)
public class XssFilter implements Filter {@Overridepublic void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {HttpServletRequest request = (HttpServletRequest) servletRequest;XssHttpServletRequestWrapper xssHttpServletRequestWrapper = new XssHttpServletRequestWrapper(request);filterChain.doFilter(xssHttpServletRequestWrapper, servletResponse);}
}

启动类添加@ServletComponentScan注解

扫描使用servlet注解的类，启用 XssFilter

@ServletComponentScan

JSON字符串请求参数处理

实现Jackson反序列化方法，将参数值转义处理

public class XssJacksonDeserializer extends JsonDeserializer<String> {@Overridepublic String deserialize(JsonParser jsonParser, DeserializationContext deserializationContext) throws IOException, JsonProcessingException {return StringEscapeUtils.escapeHtml4(jsonParser.getText());}}

JSON字符串响应结果处理

实现Jackson序列化方法，将参数值转义处理

@Slf4j
public class XssJacksonSerializer extends JsonSerializer<String> {@Overridepublic void serialize(String s, JsonGenerator jsonGenerator, SerializerProvider serializerProvider) throws IOException {jsonGenerator.writeString(StringEscapeUtils.escapeHtml4(s));}}

重点，Jackson配置Xss (没使用Jackson 不用配置)

@Configuration
public class JacksonConfig implements WebMvcConfigurer {@Overridepublic void extendMessageConverters(List<HttpMessageConverter<?>> converters) {// code...// XSS序列化simpleModule.addSerializer(String.class, new XssJacksonSerializer());simpleModule.addDeserializer(String.class, new XssJacksonDeserializer());// code...}
}

总结

实现字符串转义的核心方法：

• org.apache.commons.text.StringEscapeUtils

StringEscapeUtils.escapeHtml4();