JAVA 重写HttpServletRequest的获取参数防止xss攻击

import java.io.IOException;
 
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
 
import com.soufun.wap.servlet.XSSRequestWrapper;
 
public class SqlXssFilter implements Filter {
 
    private FilterConfig config = null;    //配置文件（可以从 web中获取参数）
    
   @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        this.config = filterConfig;
    }
 
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
       //对不是 get请求和post 请求 进行拦截
      if(!(req.getMethod().equalsIgnoreCase("get")||req.getMethod().equalsIgnoreCase("post"))) {  //
			return;
	  }
        chain.doFilter(new XSSRequestWrapper(req), response); //放行
    }
 
    public void destroy() {
    }

    /**
     *  获取敏感字
     *  在 web.xml 中获取获取敏感字符所在的路径
     *  在把它变为流 读进集合里面
     */
    private List
 
   getDirtyWords(){
        List
  
    dirtyWords = new ArrayList
   
    (); String dirtyWordPath = config.getInitParameter("dirtyWord"); //获取参数值 InputStream inputStream = config.getServletContext().getResourceAsStream(dirtyWordPath); //传入路径变为流 InputStreamReader is = null; try { is = new InputStreamReader(inputStream,"UTF-8"); //把流转换为utf-8编码 } catch (UnsupportedEncodingException e2) { e2.printStackTrace(); } BufferedReader reader = new BufferedReader(is); String line; try { while ((line = reader.readLine())!= null) {//如果 line为空说明读完了 dirtyWords.add(line); //把敏感字符丢进集合里面 } } catch (IOException e) { e.printStackTrace(); } return dirtyWords; } }
   
  
 

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
 
import org.apache.commons.lang.StringEscapeUtils;
 
public class XSSRequestWrapper extends HttpServletRequestWrapper {
    public XSSRequestWrapper(HttpServletRequest servletRequest) {
        super(servletRequest);
    }
 
    /*
     *重写getParameterValues方法
     */
    @Override
    public String[] getParameterValues(String parameter) {
        String[] values = super.getParameterValues(parameter);  //调用父类getParameterValues 获取原始值
        if ("pageChildren".equals(parameter)) {      //对原始值进行判断做出选择
            return values;
        }
        if (values == null) {
            return null;
        }
        int count = values.length;
        String[] encodedValues = new String[count];  //创建一个字符数组
        for (int i = 0; i < count; i++) {
            encodedValues[i] = stripXSS(values[i]);   //循坏替换 值中的关键字
        }
        return encodedValues;
    }
 
     /* 
      *重写getParameter方法方法
      */
    @Override
    public String getParameter(String parameter) {
        String value = super.getParameter(parameter);  //调用父类获取原始值
        return stripXSS(value); //替换
    }
    
    /*
     *对值中的关键字进行替换
     */
    private String stripXSS(String value) {
        if (null != value) {
            value = value.replaceAll("<", "<").replaceAll(">", ">");
            value = value.replaceAll("\\(", "(").replaceAll("\\)", ")");
            value = value.replaceAll("'", "'");
            value = value.replaceAll("eval\\((.*)\\)", "");
            value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
            value = value.replaceAll("script", "");
            value = StringEscapeUtils.escapeSql(value);
        }
        return value;
    }
}

 
    
  
   sqlXssFilter
  
    
  
   com.soufun.wap.filter.SqlXssFilter
  
    
  
      
   
   
    dirtyWord
    
   
    /WEB-INF/DirtyWord.txt
    
  

 


 
    
  
   sqlXssFilter
  
    
  
   /*