快捷導(dǎo)航

java 過(guò)濾器filter防sql注入的實(shí)現(xiàn)代碼

更新時(shí)間：2016年08月25日 09:23:45 投稿：jingxian

下面小編就為大家?guī)?lái)一篇java 過(guò)濾器filter防sql注入的實(shí)現(xiàn)代碼。小編覺(jué)得挺不錯(cuò)的，現(xiàn)在就分享給大家，也給大家做個(gè)參考。一起跟隨小編過(guò)來(lái)看看吧

實(shí)例如下：

XSSFilter.java

public void doFilter(ServletRequest servletrequest,
			ServletResponse servletresponse, FilterChain filterchain)
			throws IOException, ServletException {
		

		//flag = true 只做URL驗(yàn)證; flag = false 做所有字段的驗(yàn)證;
		boolean flag = true;
		if(flag){
			//只對(duì)URL做xss校驗(yàn)
			HttpServletRequest httpServletRequest = (HttpServletRequest) servletrequest;
			HttpServletResponse httpServletResponse = (HttpServletResponse) servletresponse;
			
			String requesturi = httpServletRequest.getRequestURL().toString();
			requesturi = URLDecoder.decode(requesturi, "UTF-8");
			if(requesturi!=null&&requesturi.indexOf("alipay_hotel_book_return.html")!=-1){
				filterchain.doFilter(servletrequest, servletresponse);
				return;
			}
			if(requesturi!=null&&requesturi.indexOf("account_bank_return.html")!=-1){
				filterchain.doFilter(servletrequest, servletresponse);
				return;
			}
			if(requesturi!=null&&requesturi.indexOf("/alipay/activity.html")!=-1){
				filterchain.doFilter(servletrequest, servletresponse);
				return ;
			}
			if(requesturi!=null&&requesturi.indexOf("/alipayLogin.html")!=-1){
				filterchain.doFilter(servletrequest, servletresponse);
				return ;
			}
			RequestWrapper rw = new RequestWrapper(httpServletRequest);
			String param = httpServletRequest.getQueryString();
			if(!"".equals(param) && param != null) {
				param = URLDecoder.decode(param, "UTF-8");
				String originalurl = requesturi + param;
				
				String sqlParam = param;
				//添加sql注入的判斷
				if(requesturi.endsWith("/askQuestion.html") || requesturi.endsWith("/member/answer.html")){
					sqlParam = rw.cleanSQLInject(param);
				}
				
				String xssParam = rw.cleanXSS(sqlParam);
				requesturi += "?"+xssParam;
				
				
				if(!xssParam.equals(param)){
					System.out.println("requesturi::::::"+requesturi);
					httpServletResponse.sendRedirect(requesturi);
					System.out.println("no entered.");
//					filterchain.doFilter(new RequestWrapper((HttpServletRequest) servletrequest), servletresponse);
					return ;
				}
			}
			filterchain.doFilter(servletrequest, servletresponse);
		}else{
			
			//對(duì)請(qǐng)求中的所有東西都做校驗(yàn)，包括表單。此功能校驗(yàn)比較嚴(yán)格容易屏蔽表單正常輸入，使用此功能請(qǐng)注意。
			filterchain.doFilter(new RequestWrapper((HttpServletRequest) servletrequest), servletresponse);
		}
	}
requestMapping: 


public RequestWrapper(){
		super(null);
	}

	public RequestWrapper(HttpServletRequest httpservletrequest) {
		super(httpservletrequest);
	}

	public String[] getParameterValues(String s) {
		String str[] = super.getParameterValues(s);
		if (str == null) {
			return null;
		}
		int i = str.length;
		String as1[] = new String[i];
		for (int j = 0; j < i; j++) {
			as1[j] = cleanXSS(cleanSQLInject(str[j]));
		}

		return as1;
	}

	public String getParameter(String s) {
		String s1 = super.getParameter(s);
		if (s1 == null) {
			return null;
		} else {
			return cleanXSS(cleanSQLInject(s1));
		}
	}

	public String getHeader(String s) {
		String s1 = super.getHeader(s);
		if (s1 == null) {
			return null;
		} else {
			return cleanXSS(cleanSQLInject(s1));
		}
	}

	public String cleanXSS(String src) {
		String temp =src;

		System.out.println("xss---temp-->"+src);
    src = src.replaceAll("<", "<").replaceAll(">", ">");
    // if (src.indexOf("address")==-1)
	//	{
     src = src.replaceAll("\\(", "(").replaceAll("\\)", ")");
		//}
   
    src = src.replaceAll("'", "'");
    
    Pattern pattern=Pattern.compile("(eval\\((.*)\\)|script)",Pattern.CASE_INSENSITIVE);  
	  Matcher matcher=pattern.matcher(src);  
	  src = matcher.replaceAll("");

	  pattern=Pattern.compile("[\\\"\\'][\\s]*javascript:(.*)[\\\"\\']",Pattern.CASE_INSENSITIVE); 
	  matcher=pattern.matcher(src);
	  src = matcher.replaceAll("\"\"");
	  
	  //增加腳本 
	  src = src.replaceAll("script", "").replaceAll(";", "")
	  	.replaceAll("\"", "").replaceAll("@", "")
	  	.replaceAll("0x0d", "")
	  	.replaceAll("0x0a", "").replaceAll(",", "");

		if(!temp.equals(src)){
			System.out.println("輸入信息存在xss攻擊！");
			System.out.println("原始輸入信息-->"+temp);
			System.out.println("處理后信息-->"+src);
		}
		return src;
	}
	
	//需要增加通配，過(guò)濾大小寫(xiě)組合
	public String cleanSQLInject(String src) {
		String temp =src;
    src = src.replaceAll("insert", "forbidI")
    	.replaceAll("select", "forbidS")
    	.replaceAll("update", "forbidU")
    	.replaceAll("delete", "forbidD")
    	.replaceAll("and", "forbidA")
    	.replaceAll("or", "forbidO");
    
		if(!temp.equals(src)){
			System.out.println("輸入信息存在SQL攻擊！");
			System.out.println("原始輸入信息-->"+temp);
			System.out.println("處理后信息-->"+src);
		}
		return src;
	}

xml配置：

<filter>
		<filter-name>XssFilter</filter-name>
		<filter-class>cn.com.jsoft.xss.XSSFilter</filter-class>
		<init-param>
			<param-name>encoding</param-name>
			<param-value>UTF-8</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>XssFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

以上代碼僅僅將特殊的sql字符，特殊script腳本字符處理掉，具體的頁(yè)面處理還需要后臺(tái)處理??！

關(guān)于這篇java 過(guò)濾器filter防sql注入的實(shí)現(xiàn)代碼就是小編分享給大家的全部?jī)?nèi)容了，希望能給大家一個(gè)參考，也希望大家多多支持腳本之家。

您可能感興趣的文章: