Java处理XSS漏洞的四种方法小结

public String encodeHtmlEntities(String input) {
    String encoded = input.replaceAll("&", "&")
                          .replaceAll("\"", """)
                          .replaceAll("'", "'")
                          .replaceAll("<", "&lt;")
                          .replaceAll(">", "&gt;");
    return encoded;
}

public static void main(String[] args) {
    String input = "<script>alert('XSS Attack!')</script>";
    String encoded = encodeHtmlEntities(input);
    System.out.println(encoded); // 输出: &lt;script&gt;alert('XSS Attack!')&lt;/script&gt;
}

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://trusted.js.com;">

import org.springframework.web.filter.OncePerRequestFilter;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
public class XssFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain) throws ServletException, IOException {
        HttpServletRequest wrappedRequest = new XssHttpServletRequestWrapper(request);
        filterChain.doFilter(wrappedRequest, response);
    }
}

@Configuration
public class WebConfig extends WebMvcConfigurerAdapter {
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new XssFilter());
    }
}

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
public class XssFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        // 在这里添加XSS防护逻辑
        // 例如，你可以使用第三方库如HTMLSanitizer或XSSFilter
        // 继续传递请求和响应
        chain.doFilter(httpRequest, httpResponse);
    }
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }
    @Override
    public void destroy() {
    }
}