<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>lizongbo at 618119.com &#187; Xss</title>
	<atom:link href="http://618119.com/tag/xss/feed" rel="self" type="application/rss+xml" />
	<link>http://618119.com</link>
	<description>工作,生活,java,apache,tomcat,Resin,mina,Hessian,Openfire,XMPP,RPC,Ubuntu</description>
	<lastBuildDate>Sat, 21 Aug 2010 08:34:42 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>使用Servlet Filter来防止Xss漏洞和SQL注入的方法</title>
		<link>http://618119.com/archives/2010/02/23/156.html</link>
		<comments>http://618119.com/archives/2010/02/23/156.html#comments</comments>
		<pubDate>Tue, 23 Feb 2010 14:32:20 +0000</pubDate>
		<dc:creator>lizongbo</dc:creator>
				<category><![CDATA[Java]]></category>
		<category><![CDATA[filter]]></category>
		<category><![CDATA[servlet]]></category>
		<category><![CDATA[SQL]]></category>
		<category><![CDATA[Xss]]></category>

		<guid isPermaLink="false">http://618119.com/?p=156</guid>
		<description><![CDATA[使用Servlet Filter来防止Xss漏洞和SQL注入的方法
在用java进行web业务开发的时候，对于页面上接收到的参数，除了极少数是步可预知的内容外，大量的参数名和参数值都是不会出现触发Xss漏洞的字符。而通常为了避免Xss漏洞，都是开发人员各自在页面输出和数据入库等地方加上各种各样的encode方法来避免Xss问题。而由于开发人员的水平不一，加上在编写代码的过程中安全意识的差异，可能会粗心漏掉对用户输入内容进行encode处理。针对这种大量参数是不可能出现引起Xss和SQL注入漏洞的业务场景下，因此可以使用一个适用大多数业务场景的通用处理方法，牺牲少量用户体验，来避免Xss漏洞和SQL注入。
那就是利用Servlet的过滤器机制，编写定制的XssFilter，将request请求代理，覆盖getParameter和getHeader方法将参数名和参数值里的指定半角字符，强制替换成全角字符。
使得在业务层的处理时不用担心会有异常输入内容。
相关的代码如下：
XssFilter.java
[code]
package com.lizongbo.filter;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
public class XssFilter implements Filter {
@Override
public void init(FilterConfig config) throws ServletException {
}
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(
(HttpServletRequest) request);
chain.doFilter(xssRequest, response);
}
@Override
public void destroy() {
}
}
[/code]
XssHttpServletRequestWrapper.java
[code]
package com.lizongbo.filter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
/**
*
* @author lizongbo
*
*/
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
HttpServletRequest orgRequest = null;
public XssHttpServletRequestWrapper(HttpServletRequest [...]]]></description>
		<wfw:commentRss>http://618119.com/archives/2010/02/23/156.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
