{"id":1298,"date":"2024-07-09T13:33:13","date_gmt":"2024-07-09T05:33:13","guid":{"rendered":"https:\/\/blog.nonot.cn\/?p=1298"},"modified":"2024-07-09T13:33:13","modified_gmt":"2024-07-09T05:33:13","slug":"xss%e8%bf%87%e6%bb%a4java%e8%bf%87%e6%bb%a4%e5%99%a8filter-%e9%98%b2%e6%ad%a2%e5%b8%b8%e8%a7%81sql%e6%b3%a8%e5%85%a5","status":"publish","type":"post","link":"https:\/\/blog.nonot.cn\/index.php\/2024\/07\/09\/xss%e8%bf%87%e6%bb%a4java%e8%bf%87%e6%bb%a4%e5%99%a8filter-%e9%98%b2%e6%ad%a2%e5%b8%b8%e8%a7%81sql%e6%b3%a8%e5%85%a5\/","title":{"rendered":"XSS\u8fc7\u6ee4JAVA\u8fc7\u6ee4\u5668filter \u9632\u6b62\u5e38\u89c1SQL\u6ce8\u5165"},"content":{"rendered":"

Java\u9879\u76ee\u4e2dXSS\u8fc7\u6ee4\u5668\u7684\u4f7f\u7528\u65b9\u6cd5\u3002<\/p>\n

\u7b80\u5355\u4ecb\u7ecd\uff1a<\/p>\n

XSS : \u8de8\u7ad9\u811a\u672c\u653b\u51fb(Cross Site Scripting)\uff0c\u4e3a\u4e0d\u548c\u5c42\u53e0\u6837\u5f0f\u8868(Cascading Style Sheets, CSS)\u7684\u7f29\u5199\u6df7\u6dc6\uff0c\u6545\u5c06\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u7f29\u5199\u4e3aXSS\u3002\u6076\u610f\u653b\u51fb\u8005\u5f80Web\u9875\u9762\u91cc\u63d2\u5165\u6076\u610fhtml\u4ee3\u7801\uff0c\u5f53\u7528\u6237\u6d4f\u89c8\u8be5\u9875\u4e4b\u65f6\uff0c\u5d4c\u5165\u5176\u4e2dWeb\u91cc\u9762\u7684html\u4ee3\u7801\u4f1a\u88ab\u6267\u884c\uff0c\u4ece\u800c\u8fbe\u5230\u6076\u610f\u653b\u51fb\u7528\u6237\u7684\u7279\u6b8a\u76ee\u7684\u3002<\/p>\n

sql\u6ce8\u5165
\n\u6240\u8c13SQL\u6ce8\u5165\uff0c\u5c31\u662f\u901a\u8fc7\u628aSQL\u547d\u4ee4\u63d2\u5165\u5230Web\u8868\u5355\u63d0\u4ea4\u6216\u8f93\u5165\u57df\u540d\u6216\u9875\u9762\u8bf7\u6c42\u7684\u67e5\u8be2\u5b57\u7b26\u4e32\uff0c\u6700\u7ec8\u8fbe\u5230\u6b3a\u9a97\u670d\u52a1\u5668\u6267\u884c\u6076\u610f\u7684SQL\u547d\u4ee4\u3002\u5177\u4f53\u6765\u8bf4\uff0c\u5b83\u662f\u5229\u7528\u73b0\u6709\u5e94\u7528\u7a0b\u5e8f\uff0c\u5c06\uff08\u6076\u610f\uff09\u7684SQL\u547d\u4ee4\u6ce8\u5165\u5230\u540e\u53f0\u6570\u636e\u5e93\u5f15\u64ce\u6267\u884c\u7684\u80fd\u529b\uff0c\u5b83\u53ef\u4ee5\u901a\u8fc7\u5728Web\u8868\u5355\u4e2d\u8f93\u5165\uff08\u6076\u610f\uff09SQL\u8bed\u53e5\u5f97\u5230\u4e00\u4e2a\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u7684\u7f51\u7ad9\u4e0a\u7684\u6570\u636e\u5e93\uff0c\u800c\u4e0d\u662f\u6309\u7167\u8bbe\u8ba1\u8005\u610f\u56fe\u53bb\u6267\u884cSQL\u8bed\u53e5\u3002<\/p>\n

\u5b9e\u73b0\u65b9\u5f0f\uff0c\u5171\u4e09\u6b65\uff1a<\/p>\n

\u7b2c\u4e00\u6b65<\/strong>\uff1a\u914d\u7f6eweb.xml<\/p>\n

\n
<filter>\r\n    <filter-name>xssFilter<\/filter-name>\r\n    <filter-class>com.***.xss.XssFilter<\/filter-class>\r\n  <\/filter>\r\n  <filter-mapping>\r\n    <filter-name>xssFilter<\/filter-name>\r\n    <url-pattern>\/*<\/url-pattern>\r\n  <\/filter-mapping><\/pre>\n
<\/div>\n<\/div>\n
 <\/p>\n
\u7b2c\u4e8c\u6b65<\/strong>\uff1a\u8fc7\u6ee4\u5de5\u5177\u7c7b<\/p>\n
1.XSSFilter.java<\/p>\n
\n
package com.***.xss;<\/p>\n
import javax.servlet.*;
\nimport javax.servlet.http.HttpServletRequest;
\nimport java.io.IOException;<\/p>\n
\/**
\n* xss\u8fc7\u6ee4
\n* @author xlf
\n* @email xlfbe696@gmail.com
\n* @date 2017\u5e744\u670819\u65e5 \u4e0a\u534810:41:42
\n*\/
\npublic class XssFilter implements Filter {<\/p>\n
@Override
\npublic void init(FilterConfig config) throws ServletException {
\n}<\/p>\n
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
\nthrows IOException, ServletException {<\/p>\n
XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(
\n(HttpServletRequest) request);
\nchain.doFilter(xssRequest, response);
\n}<\/p>\n
@Override
\npublic void destroy() {
\n}<\/p>\n
}<\/p>\n<\/div>\n
 <\/p>\n
2.XssHttpServletRequestWrapper<\/p>\n
\n
package com.***.xss;<\/p>\n
import org.apache.commons.lang.StringEscapeUtils;
\nimport org.apache.commons.lang.StringUtils;<\/p>\n
import javax.servlet.http.HttpServletRequest;
\nimport javax.servlet.http.HttpServletRequestWrapper;
\nimport java.util.LinkedHashMap;
\nimport java.util.Map;<\/p>\n
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {<\/p>\n
\/\/ \u6ca1\u88ab\u5305\u88c5\u8fc7\u7684HttpServletRequest\uff08\u7279\u6b8a\u573a\u666f\uff0c\u9700\u6c42\u81ea\u5df1\u8fc7\u6ee4\uff09
\nHttpServletRequest orgRequest;
\n\/\/ html\u8fc7\u6ee4
\nprivate final static HTMLFilter htmlFilter = new HTMLFilter();<\/p>\n
public XssHttpServletRequestWrapper(HttpServletRequest request) {
\nsuper(request);
\norgRequest = request;
\n}<\/p>\n
@Override
\npublic String getParameter(String name) {
\nString value = super.getParameter(xssEncode(name));
\nif (StringUtils.isNotBlank(value)) {
\nvalue =xssEncode(value);
\n}<\/p>\n
\/\/SQL\u6ce8\u5165\u68c0\u67e5
\n\/\/ value = SQLFilter.sqlInject(value);
\nvalue = SQLFilter.sqlInject(value);<\/p>\n
return StringEscapeUtils.unescapeHtml(value);
\n}<\/p>\n
@Override
\npublic String[] getParameterValues(String name) {
\nString[] parameters = super.getParameterValues(name);
\nif (parameters == null || parameters.length == 0) {
\nreturn null;
\n}<\/p>\n
for (int i = 0; i < parameters.length; i++) {
\nparameters[i] = xssEncode(parameters[i]);
\n\/\/SQL\u6ce8\u5165\u68c0\u67e5
\n\/\/ parameters[i] = SQLFilter.sqlInject(parameters[i]);
\nparameters[i] = SQLFilter.sqlInject(parameters[i]);
\nparameters[i] = StringEscapeUtils.unescapeHtml(parameters[i]);
\n}
\nreturn parameters;
\n}<\/p>\n
@Override
\npublic Map<String, String[]> getParameterMap() {
\nMap<String, String[]> map = new LinkedHashMap<>();
\nMap<String, String[]> parameters = super.getParameterMap();
\nfor (String key : parameters.keySet()) {
\nString[] values = parameters.get(key);
\nfor (int i = 0; i < values.length; i++) {
\nvalues[i] = xssEncode(values[i]);
\n\/\/SQL\u6ce8\u5165\u68c0\u67e5
\n\/\/ values[i] = SQLFilter.sqlInject(values[i]);
\nvalues[i] = SQLFilter.sqlInject(values[i]);
\nvalues[i] = StringEscapeUtils.unescapeHtml(values[i]);
\n}
\nmap.put(key, values);
\n}
\nreturn map;
\n}<\/p>\n
@Override
\npublic String getHeader(String name) {
\nString value = super.getHeader(xssEncode(name));
\nif (StringUtils.isNotBlank(value)) {
\nvalue = xssEncode(value);
\n}<\/p>\n
\/\/SQL\u6ce8\u5165\u68c0\u67e5
\n\/\/ value = SQLFilter.sqlInject(value);
\nvalue = SQLFilter.sqlInject(value);
\nreturn StringEscapeUtils.unescapeHtml(value);
\n}<\/p>\n
private String xssEncode(String input) {
\nreturn htmlFilter.filter(input);
\n}<\/p>\n
\/**
\n* \u83b7\u53d6\u6700\u539f\u59cb\u7684request
\n*\/
\npublic HttpServletRequest getOrgRequest() {
\nreturn orgRequest;
\n}<\/p>\n
\/**
\n* \u83b7\u53d6\u6700\u539f\u59cb\u7684request
\n*\/
\npublic static HttpServletRequest getOrgRequest(HttpServletRequest request) {
\nif (request instanceof XssHttpServletRequestWrapper) {
\nreturn ((XssHttpServletRequestWrapper) request).getOrgRequest();
\n}<\/p>\n
return request;
\n}<\/p>\n
}<\/p>\n<\/div>\n
 <\/p>\n
3.HTMLFilter<\/p>\n
\n
package com.***.xss;<\/p>\n
import java.util.ArrayList;
\nimport java.util.Collections;
\nimport java.util.HashMap;
\nimport java.util.List;
\nimport java.util.Map;
\nimport java.util.concurrent.ConcurrentHashMap;
\nimport java.util.concurrent.ConcurrentMap;
\nimport java.util.logging.Logger;
\nimport java.util.regex.Matcher;
\nimport java.util.regex.Pattern;
\n\/**
\n*
\n* HTML filtering utility for protecting against XSS (Cross Site Scripting).
\n*
\n* This code is licensed LGPLv3
\n*
\n* This code is a Java port of the original work in PHP by Cal Hendersen.
\n* http:\/\/code.iamcal.com\/php\/lib_filter\/
\n*
\n* The trickiest part of the translation was handling the differences in regex handling
\n* between PHP and Java. These resources were helpful in the process:
\n*
\n* http:\/\/java.sun.com\/j2se\/1.4.2\/docs\/api\/java\/util\/regex\/Pattern.html
\n* http:\/\/us2.php.net\/manual\/en\/reference.pcre.pattern.modifiers.php
\n* http:\/\/www.regular-expressions.info\/modifiers.html
\n*
\n* A note on naming conventions: instance variables are prefixed with a “v”; global
\n* constants are in all caps.
\n*
\n* Sample use:
\n* String input = …
\n* String clean = new HTMLFilter().filter( input );
\n*
\n* The class is not thread safe. Create a new instance if in doubt.
\n*
\n* If you find bugs or have suggestions on improvement (especially regarding
\n* performance), please contact us. The latest version of this
\n* source, and our contact details, can be found at http:\/\/xss-html-filter.sf.net
\n*
\n* @author Joseph O’Connell
\n* @author Cal Hendersen
\n* @author Michael Semb Wever
\n*\/
\npublic class HTMLFilter {<\/p>\n
\/** regex flag union representing \/si modifiers in php **\/
\nprivate static final int REGEX_FLAGS_SI = Pattern.CASE_INSENSITIVE | Pattern.DOTALL;
\nprivate static final Pattern P_COMMENTS = Pattern.compile(“<!–(.*?)–>”, Pattern.DOTALL);
\nprivate static final Pattern P_COMMENT = Pattern.compile(“^!–(.*)–$”, REGEX_FLAGS_SI);
\nprivate static final Pattern P_TAGS = Pattern.compile(“<(.*?)>”, Pattern.DOTALL);
\nprivate static final Pattern P_END_TAG = Pattern.compile(“^\/([a-z0-9]+)”, REGEX_FLAGS_SI);
\nprivate static final Pattern P_START_TAG = Pattern.compile(“^([a-z0-9]+)(.*?)(\/?)$”, REGEX_FLAGS_SI);
\nprivate static final Pattern P_QUOTED_ATTRIBUTES = Pattern.compile(“([a-z0-9]+)=([\\”‘])(.*?)\\\\2”, REGEX_FLAGS_SI);
\nprivate static final Pattern P_UNQUOTED_ATTRIBUTES = Pattern.compile(“([a-z0-9]+)(=)([^\\”\\\\s’]+)”, REGEX_FLAGS_SI);
\nprivate static final Pattern P_PROTOCOL = Pattern.compile(“^([^:]+):”, REGEX_FLAGS_SI);
\nprivate static final Pattern P_ENTITY = Pattern.compile(“&#(\\\\d+);?”);
\nprivate static final Pattern P_ENTITY_UNICODE = Pattern.compile(“&#x([0-9a-f]+);?”);
\nprivate static final Pattern P_ENCODE = Pattern.compile(“%([0-9a-f]{2});?”);
\nprivate static final Pattern P_VALID_ENTITIES = Pattern.compile(“&([^&;]*)(?=(;|&|$))”);
\nprivate static final Pattern P_VALID_QUOTES = Pattern.compile(“(>|^)([^<]+?)(<|$)”, Pattern.DOTALL);
\nprivate static final Pattern P_END_ARROW = Pattern.compile(“^>”);
\nprivate static final Pattern P_BODY_TO_END = Pattern.compile(“<([^>]*?)(?=<|$)”);
\nprivate static final Pattern P_XML_CONTENT = Pattern.compile(“(^|>)([^<]*?)(?=>)”);
\nprivate static final Pattern P_STRAY_LEFT_ARROW = Pattern.compile(“<([^>]*?)(?=<|$)”);
\nprivate static final Pattern P_STRAY_RIGHT_ARROW = Pattern.compile(“(^|>)([^<]*?)(?=>)”);
\nprivate static final Pattern P_AMP = Pattern.compile(“&”);
\nprivate static final Pattern P_QUOTE = Pattern.compile(“\\””);
\nprivate static final Pattern P_LEFT_ARROW = Pattern.compile(“<“);
\nprivate static final Pattern P_RIGHT_ARROW = Pattern.compile(“>”);
\nprivate static final Pattern P_BOTH_ARROWS = Pattern.compile(“<>”);
\nprivate static final Pattern P_DOUBLE_QUOT = Pattern.compile(“””);<\/p>\n
\/\/ @xxx could grow large… maybe use sesat’s ReferenceMap
\nprivate static final ConcurrentMap<String,Pattern> P_REMOVE_PAIR_BLANKS = new ConcurrentHashMap<String, Pattern>();
\nprivate static final ConcurrentMap<String,Pattern> P_REMOVE_SELF_BLANKS = new ConcurrentHashMap<String, Pattern>();<\/p>\n
\/** set of allowed html elements, along with allowed attributes for each element **\/
\nprivate final Map<String, List<String>> vAllowed;
\n\/** counts of open tags for each (allowable) html element **\/
\nprivate final Map<String, Integer> vTagCounts = new HashMap<String, Integer>();<\/p>\n
\/** html elements which must always be self-closing (e.g. “<img \/>”) **\/
\nprivate final String[] vSelfClosingTags;
\n\/** html elements which must always have separate opening and closing tags (e.g. “<b><\/b>”) **\/
\nprivate final String[] vNeedClosingTags;
\n\/** set of disallowed html elements **\/
\nprivate final String[] vDisallowed;
\n\/** attributes which should be checked for valid protocols **\/
\nprivate final String[] vProtocolAtts;
\n\/** allowed protocols **\/
\nprivate final String[] vAllowedProtocols;
\n\/** tags which should be removed if they contain no content (e.g. “<b><\/b>” or “<b \/>”) **\/
\nprivate final String[] vRemoveBlanks;
\n\/** entities allowed within html markup **\/
\nprivate final String[] vAllowedEntities;
\n\/** flag determining whether comments are allowed in input String. *\/
\nprivate final boolean stripComment;
\nprivate final boolean encodeQuotes;
\nprivate boolean vDebug = false;
\n\/**
\n* flag determining whether to try to make tags when presented with “unbalanced”
\n* angle brackets (e.g. “<b text <\/b>” becomes “<b> text <\/b>”). If set to false,
\n* unbalanced angle brackets will be html escaped.
\n*\/
\nprivate final boolean alwaysMakeTags;<\/p>\n
\/** Default constructor.
\n*
\n*\/
\npublic HTMLFilter() {
\nvAllowed = new HashMap<>();<\/p>\n
final ArrayList<String> a_atts = new ArrayList<String>();
\na_atts.add(“href”);
\na_atts.add(“target”);
\nvAllowed.put(“a”, a_atts);<\/p>\n
final ArrayList<String> img_atts = new ArrayList<String>();
\nimg_atts.add(“src”);
\nimg_atts.add(“width”);
\nimg_atts.add(“height”);
\nimg_atts.add(“alt”);
\nvAllowed.put(“img”, img_atts);<\/p>\n
final ArrayList<String> no_atts = new ArrayList<String>();
\nvAllowed.put(“b”, no_atts);
\nvAllowed.put(“strong”, no_atts);
\nvAllowed.put(“i”, no_atts);
\nvAllowed.put(“em”, no_atts);<\/p>\n
vSelfClosingTags = new String[]{“img”};
\nvNeedClosingTags = new String[]{“a”, “b”, “strong”, “i”, “em”};
\nvDisallowed = new String[]{};
\nvAllowedProtocols = new String[]{“http”, “mailto”, “https”}; \/\/ no ftp.
\nvProtocolAtts = new String[]{“src”, “href”};
\nvRemoveBlanks = new String[]{“a”, “b”, “strong”, “i”, “em”};
\nvAllowedEntities = new String[]{“amp”, “gt”, “lt”, “quot”};
\nstripComment = true;
\nencodeQuotes = true;
\nalwaysMakeTags = true;
\n}<\/p>\n
\/** Set debug flag to true. Otherwise use default settings. See the default constructor.
\n*
\n* @param debug turn debug on with a true argument
\n*\/
\npublic HTMLFilter(final boolean debug) {
\nthis();
\nvDebug = debug;<\/p>\n
}<\/p>\n
\/** Map-parameter configurable constructor.
\n*
\n* @param conf map containing configuration. keys match field names.
\n*\/
\npublic HTMLFilter(final Map<String,Object> conf) {<\/p>\n
assert conf.containsKey(“vAllowed”) : “configuration requires vAllowed”;
\nassert conf.containsKey(“vSelfClosingTags”) : “configuration requires vSelfClosingTags”;
\nassert conf.containsKey(“vNeedClosingTags”) : “configuration requires vNeedClosingTags”;
\nassert conf.containsKey(“vDisallowed”) : “configuration requires vDisallowed”;
\nassert conf.containsKey(“vAllowedProtocols”) : “configuration requires vAllowedProtocols”;
\nassert conf.containsKey(“vProtocolAtts”) : “configuration requires vProtocolAtts”;
\nassert conf.containsKey(“vRemoveBlanks”) : “configuration requires vRemoveBlanks”;
\nassert conf.containsKey(“vAllowedEntities”) : “configuration requires vAllowedEntities”;<\/p>\n
vAllowed = Collections.unmodifiableMap((HashMap<String, List<String>>) conf.get(“vAllowed”));
\nvSelfClosingTags = (String[]) conf.get(“vSelfClosingTags”);
\nvNeedClosingTags = (String[]) conf.get(“vNeedClosingTags”);
\nvDisallowed = (String[]) conf.get(“vDisallowed”);
\nvAllowedProtocols = (String[]) conf.get(“vAllowedProtocols”);
\nvProtocolAtts = (String[]) conf.get(“vProtocolAtts”);
\nvRemoveBlanks = (String[]) conf.get(“vRemoveBlanks”);
\nvAllowedEntities = (String[]) conf.get(“vAllowedEntities”);
\nstripComment = conf.containsKey(“stripComment”) ? (Boolean) conf.get(“stripComment”) : true;
\nencodeQuotes = conf.containsKey(“encodeQuotes”) ? (Boolean) conf.get(“encodeQuotes”) : true;
\nalwaysMakeTags = conf.containsKey(“alwaysMakeTags”) ? (Boolean) conf.get(“alwaysMakeTags”) : true;
\n}<\/p>\n
private void reset() {
\nvTagCounts.clear();
\n}<\/p>\n
private void debug(final String msg) {
\nif (vDebug) {
\nLogger.getAnonymousLogger().info(msg);
\n}
\n}<\/p>\n
\/\/—————————————————————
\n\/\/ my versions of some PHP library functions
\npublic static String chr(final int decimal) {
\nreturn String.valueOf((char) decimal);
\n}<\/p>\n
public static String htmlSpecialChars(final String s) {
\nString result = s;
\nresult = regexReplace(P_AMP, “&”, result);
\nresult = regexReplace(P_QUOTE, “””, result);
\nresult = regexReplace(P_LEFT_ARROW, “<“, result);
\nresult = regexReplace(P_RIGHT_ARROW, “>”, result);
\nreturn result;
\n}<\/p>\n
\/\/—————————————————————
\n\/**
\n* given a user submitted input String, filter out any invalid or restricted
\n* html.
\n*
\n* @param input text (i.e. submitted by a user) than may contain html
\n* @return “clean” version of input, with only valid, whitelisted html elements allowed
\n*\/
\npublic String filter(final String input) {
\nreset();
\nString s = input;<\/p>\n
debug(“************************************************”);
\ndebug(” INPUT: ” + input);<\/p>\n
s = escapeComments(s);
\ndebug(” escapeComments: ” + s);<\/p>\n
s = balanceHTML(s);
\ndebug(” balanceHTML: ” + s);<\/p>\n
s = checkTags(s);
\ndebug(” checkTags: ” + s);<\/p>\n
s = processRemoveBlanks(s);
\ndebug(“processRemoveBlanks: ” + s);<\/p>\n
s = validateEntities(s);
\ndebug(” validateEntites: ” + s);<\/p>\n
debug(“************************************************\\n\\n”);
\nreturn s;
\n}<\/p>\n
public boolean isAlwaysMakeTags(){
\nreturn alwaysMakeTags;
\n}<\/p>\n
public boolean isStripComments(){
\nreturn stripComment;
\n}<\/p>\n
private String escapeComments(final String s) {
\nfinal Matcher m = P_COMMENTS.matcher(s);
\nfinal StringBuffer buf = new StringBuffer();
\nif (m.find()) {
\nfinal String match = m.group(1); \/\/(.*?)
\nm.appendReplacement(buf, Matcher.quoteReplacement(“<!–” + htmlSpecialChars(match) + “–>”));
\n}
\nm.appendTail(buf);<\/p>\n
return buf.toString();
\n}<\/p>\n
private String balanceHTML(String s) {
\nif (alwaysMakeTags) {
\n\/\/
\n\/\/ try and form html
\n\/\/
\ns = regexReplace(P_END_ARROW, “”, s);
\ns = regexReplace(P_BODY_TO_END, “<$1>”, s);
\ns = regexReplace(P_XML_CONTENT, “$1<$2”, s);<\/p>\n
} else {
\n\/\/
\n\/\/ escape stray brackets
\n\/\/
\ns = regexReplace(P_STRAY_LEFT_ARROW, “<$1”, s);
\ns = regexReplace(P_STRAY_RIGHT_ARROW, “$1$2><“, s);<\/p>\n
\/\/
\n\/\/ the last regexp causes ‘<>’ entities to appear
\n\/\/ (we need to do a lookahead assertion so that the last bracket can
\n\/\/ be used in the next pass of the regexp)
\n\/\/
\ns = regexReplace(P_BOTH_ARROWS, “”, s);
\n}<\/p>\n
return s;
\n}<\/p>\n
private String checkTags(String s) {
\nMatcher m = P_TAGS.matcher(s);<\/p>\n
final StringBuffer buf = new StringBuffer();
\nwhile (m.find()) {
\nString replaceStr = m.group(1);
\nreplaceStr = processTag(replaceStr);
\nm.appendReplacement(buf, Matcher.quoteReplacement(replaceStr));
\n}
\nm.appendTail(buf);<\/p>\n
s = buf.toString();<\/p>\n
\/\/ these get tallied in processTag
\n\/\/ (remember to reset before subsequent calls to filter method)
\nfor (String key : vTagCounts.keySet()) {
\nfor (int ii = 0; ii < vTagCounts.get(key); ii++) {
\ns += “<\/” + key + “>”;
\n}
\n}<\/p>\n
return s;
\n}<\/p>\n
private String processRemoveBlanks(final String s) {
\nString result = s;
\nfor (String tag : vRemoveBlanks) {
\nif(!P_REMOVE_PAIR_BLANKS.containsKey(tag)){
\nP_REMOVE_PAIR_BLANKS.putIfAbsent(tag, Pattern.compile(“<” + tag + “(\\\\s[^>]*)?><\/” + tag + “>”));
\n}
\nresult = regexReplace(P_REMOVE_PAIR_BLANKS.get(tag), “”, result);
\nif(!P_REMOVE_SELF_BLANKS.containsKey(tag)){
\nP_REMOVE_SELF_BLANKS.putIfAbsent(tag, Pattern.compile(“<” + tag + “(\\\\s[^>]*)?\/>”));
\n}
\nresult = regexReplace(P_REMOVE_SELF_BLANKS.get(tag), “”, result);
\n}<\/p>\n
return result;
\n}<\/p>\n
private static String regexReplace(final Pattern regex_pattern, final String replacement, final String s) {
\nMatcher m = regex_pattern.matcher(s);
\nreturn m.replaceAll(replacement);
\n}<\/p>\n
private String processTag(final String s) {
\n\/\/ ending tags
\nMatcher m = P_END_TAG.matcher(s);
\nif (m.find()) {
\nfinal String name = m.group(1).toLowerCase();
\nif (allowed(name)) {
\nif (!inArray(name, vSelfClosingTags)) {
\nif (vTagCounts.containsKey(name)) {
\nvTagCounts.put(name, vTagCounts.get(name) – 1);
\nreturn “<\/” + name + “>”;
\n}
\n}
\n}
\n}<\/p>\n
\/\/ starting tags
\nm = P_START_TAG.matcher(s);
\nif (m.find()) {
\nfinal String name = m.group(1).toLowerCase();
\nfinal String body = m.group(2);
\nString ending = m.group(3);<\/p>\n
\/\/debug( “in a starting tag, name='” + name + “‘; body='” + body + “‘; ending='” + ending + “‘” );
\nif (allowed(name)) {
\nString params = “”;<\/p>\n
final Matcher m2 = P_QUOTED_ATTRIBUTES.matcher(body);
\nfinal Matcher m3 = P_UNQUOTED_ATTRIBUTES.matcher(body);
\nfinal List<String> paramNames = new ArrayList<String>();
\nfinal List<String> paramValues = new ArrayList<String>();
\nwhile (m2.find()) {
\nparamNames.add(m2.group(1)); \/\/([a-z0-9]+)
\nparamValues.add(m2.group(3)); \/\/(.*?)
\n}
\nwhile (m3.find()) {
\nparamNames.add(m3.group(1)); \/\/([a-z0-9]+)
\nparamValues.add(m3.group(3)); \/\/([^\\”\\\\s’]+)
\n}<\/p>\n
String paramName, paramValue;
\nfor (int ii = 0; ii < paramNames.size(); ii++) {
\nparamName = paramNames.get(ii).toLowerCase();
\nparamValue = paramValues.get(ii);<\/p>\n
\/\/ debug( “paramName='” + paramName + “‘” );
\n\/\/ debug( “paramValue='” + paramValue + “‘” );
\n\/\/ debug( “allowed? ” + vAllowed.get( name ).contains( paramName ) );<\/p>\n
if (allowedAttribute(name, paramName)) {
\nif (inArray(paramName, vProtocolAtts)) {
\nparamValue = processParamProtocol(paramValue);
\n}
\nparams += ” ” + paramName + “=\\”” + paramValue + “\\””;
\n}
\n}<\/p>\n
if (inArray(name, vSelfClosingTags)) {
\nending = ” \/”;
\n}<\/p>\n
if (inArray(name, vNeedClosingTags)) {
\nending = “”;
\n}<\/p>\n
if (ending == null || ending.length() < 1) {
\nif (vTagCounts.containsKey(name)) {
\nvTagCounts.put(name, vTagCounts.get(name) + 1);
\n} else {
\nvTagCounts.put(name, 1);
\n}
\n} else {
\nending = ” \/”;
\n}
\nreturn “<” + name + params + ending + “>”;
\n} else {
\nreturn “”;
\n}
\n}<\/p>\n
\/\/ comments
\nm = P_COMMENT.matcher(s);
\nif (!stripComment && m.find()) {
\nreturn “<” + m.group() + “>”;
\n}<\/p>\n
return “”;
\n}<\/p>\n
private String processParamProtocol(String s) {
\ns = decodeEntities(s);
\nfinal Matcher m = P_PROTOCOL.matcher(s);
\nif (m.find()) {
\nfinal String protocol = m.group(1);
\nif (!inArray(protocol, vAllowedProtocols)) {
\n\/\/ bad protocol, turn into local anchor link instead
\ns = “#” + s.substring(protocol.length() + 1, s.length());
\nif (s.startsWith(“#\/\/”)) {
\ns = “#” + s.substring(3, s.length());
\n}
\n}
\n}<\/p>\n
return s;
\n}<\/p>\n
private String decodeEntities(String s) {
\nStringBuffer buf = new StringBuffer();<\/p>\n
Matcher m = P_ENTITY.matcher(s);
\nwhile (m.find()) {
\nfinal String match = m.group(1);
\nfinal int decimal = Integer.decode(match).intValue();
\nm.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal)));
\n}
\nm.appendTail(buf);
\ns = buf.toString();<\/p>\n
buf = new StringBuffer();
\nm = P_ENTITY_UNICODE.matcher(s);
\nwhile (m.find()) {
\nfinal String match = m.group(1);
\nfinal int decimal = Integer.valueOf(match, 16).intValue();
\nm.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal)));
\n}
\nm.appendTail(buf);
\ns = buf.toString();<\/p>\n
buf = new StringBuffer();
\nm = P_ENCODE.matcher(s);
\nwhile (m.find()) {
\nfinal String match = m.group(1);
\nfinal int decimal = Integer.valueOf(match, 16).intValue();
\nm.appendReplacement(buf, Matcher.quoteReplacement(chr(decimal)));
\n}
\nm.appendTail(buf);
\ns = buf.toString();<\/p>\n
s = validateEntities(s);
\nreturn s;
\n}<\/p>\n
private String validateEntities(final String s) {
\nStringBuffer buf = new StringBuffer();<\/p>\n
\/\/ validate entities throughout the string
\nMatcher m = P_VALID_ENTITIES.matcher(s);
\nwhile (m.find()) {
\nfinal String one = m.group(1); \/\/([^&;]*)
\nfinal String two = m.group(2); \/\/(?=(;|&|$))
\nm.appendReplacement(buf, Matcher.quoteReplacement(checkEntity(one, two)));
\n}
\nm.appendTail(buf);<\/p>\n
return encodeQuotes(buf.toString());
\n}<\/p>\n
private String encodeQuotes(final String s){
\nif(encodeQuotes){
\nStringBuffer buf = new StringBuffer();
\nMatcher m = P_VALID_QUOTES.matcher(s);
\nwhile (m.find()) {
\nfinal String one = m.group(1); \/\/(>|^)
\nfinal String two = m.group(2); \/\/([^<]+?)
\nfinal String three = m.group(3); \/\/(<|$)
\nm.appendReplacement(buf, Matcher.quoteReplacement(one + regexReplace(P_QUOTE, “””, two) + three));
\n}
\nm.appendTail(buf);
\nreturn buf.toString();
\n}else{
\nreturn s;
\n}
\n}<\/p>\n
private String checkEntity(final String preamble, final String term) {<\/p>\n
return “;”.equals(term) && isValidEntity(preamble)
\n? ‘&’ + preamble
\n: “&” + preamble;
\n}<\/p>\n
private boolean isValidEntity(final String entity) {
\nreturn inArray(entity, vAllowedEntities);
\n}<\/p>\n
private static boolean inArray(final String s, final String[] array) {
\nfor (String item : array) {
\nif (item != null && item.equals(s)) {
\nreturn true;
\n}
\n}
\nreturn false;
\n}<\/p>\n
private boolean allowed(final String name) {
\nreturn (vAllowed.isEmpty() || vAllowed.containsKey(name)) && !inArray(name, vDisallowed);
\n}<\/p>\n
private boolean allowedAttribute(final String name, final String paramName) {
\nreturn allowed(name) && (vAllowed.isEmpty() || vAllowed.get(name).contains(paramName));
\n}
\n}<\/p>\n<\/div>\n
 <\/p>\n
4.SQLFilter<\/p>\n
\n
\n
package com.***.xss;\r\n\r\nimport org.apache.commons.lang.StringUtils;\r\n\r\nimport com.wfcm.utils.RRException;\r\n\r\n\/**\r\n * sql\u8fc7\u6ee4\r\n * \r\n * @author xlf\r\n * @email xlfbe696@gmail.com\r\n * @date 2017\u5e744\u670819\u65e5 \u4e0a\u534810:41:25\r\n *\/\r\npublic class SQLFilter {\r\n\r\n    \/**\r\n     * SQL\u6ce8\u5165\u8fc7\u6ee4\r\n     * \r\n     * @param str\r\n     *            \u5f85\u9a8c\u8bc1\u7684\u5b57\u7b26\u4e32\r\n     *\/\r\n    public static String sqlInject(String str) {\r\n        if (StringUtils.isBlank(str)) {\r\n            return null;\r\n        }\r\n        \/\/ \u53bb\u6389'|\"|;|\\\u5b57\u7b26\r\n        str = StringUtils.replace(str, \"'\", \"\");\r\n        str = StringUtils.replace(str, \"\\\"\", \"\");\r\n        str = StringUtils.replace(str, \";\", \"\");\r\n        str = StringUtils.replace(str, \"\\\\\", \"\");\r\n\r\n        \/\/ \u8f6c\u6362\u6210\u5c0f\u5199\r\n        str = str.toLowerCase();\r\n\r\n        \/\/ \u975e\u6cd5\u5b57\u7b26\r\n        String[] keywords = { \"master\", \"truncate\", \"insert\", \"select\", \"delete\", \"update\", \"declare\", \"alert\",\r\n                \"create\", \"drop\" };\r\n        \/\/ \u5224\u65ad\u662f\u5426\u5305\u542b\u975e\u6cd5\u5b57\u7b26\r\n        for (String keyword : keywords) {\r\n            if (str.equals(keyword)) {\r\n                throw new RRException(\"\u5305\u542b\u975e\u6cd5\u5b57\u7b26\", 1);\r\n            }\r\n        }\r\n\r\n        return str;\r\n    }\r\n}<\/pre>\n<\/div>\n<\/div>\n
 <\/p>\n
THE END\uff01<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"
Java\u9879\u76ee\u4e2dXSS\u8fc7\u6ee4\u5668\u7684\u4f7f\u7528\u65b9\u6cd5\u3002 \u7b80\u5355\u4ecb\u7ecd\uff1a XSS …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-1298","post","type-post","status-publish","format-standard","hentry","category-java"],"_links":{"self":[{"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/posts\/1298","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/comments?post=1298"}],"version-history":[{"count":1,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/posts\/1298\/revisions"}],"predecessor-version":[{"id":1317,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/posts\/1298\/revisions\/1317"}],"wp:attachment":[{"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/media?parent=1298"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/categories?post=1298"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/tags?post=1298"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}