springboot防止xss和sql注入改写http请求getParameter，getParameterValues，getHeader等方法有点东西银河系天城知识宝库-

 目录

1.springboot 启动类 引入 过滤器配置

2.过滤器

3.XssAndSqlHttpServletRequestWrapper包装器 包装类

4.修改验证登录代码 这里只写了基础的 了解意思即可 

5.测试内容 

6.测试结果

7.反黑客小介绍（黑客大哥们好小弟这没啥大用O(∩_∩)O~，但是对待小白黑客还好）

1.springboot 启动类 引入 过滤器配置

 package com.superman;  import java.util.HashMap; import java.util.Map;  import org.apache.log4j.BasicConfigurator; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.web.servlet.FilterRegistrationBean; import org.springframework.context.annotation.Bean;  import com.superman.conf.filter.XssAndSqlFilter; import com.superman.tonifi.InitInfo;  /**  * 项目启动类  *   * @author yushen  *  */ @SpringBootApplication public class Provider_App {   /**   * 项目启动入口   *    * @param args   */  public static void main(String[] args) {    SpringApplication.run(Provider_App.class, args);      InitInfo.Info(); //初始化内容      // 自动快速地使用缺省Log4j环境。   BasicConfigurator.configure();   }   /**   * 防止xss 和 sql 注入    *    * @return   */  @SuppressWarnings({ "unchecked", "rawtypes" })  @Bean  public FilterRegistrationBean xssFilterRegistrationBean() {   FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();   filterRegistrationBean.setFilter(new XssAndSqlFilter());   filterRegistrationBean.setOrder(1);   filterRegistrationBean.setEnabled(true);   filterRegistrationBean.addUrlPatterns("/*");   filterRegistrationBean.setName("XssAndSqlFilter");   Map<String, String> initParameters = new HashMap();   initParameters.put("excludes", "/favicon.ico,/img/*,/js/*,/css/*");   initParameters.put("isIncludeRichText", "true");   filterRegistrationBean.setInitParameters(initParameters);   return filterRegistrationBean;  }     } 

• 这个可以注册到的的地方除了springbootappliaction 以外别的 配置也可以注册更具自己选择，最好方springbootappliaction 中 方便省事

2.过滤器

 package com.superman.conf.filter;   import java.io.BufferedReader; import java.io.IOException; import java.io.PrintWriter;  import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest;  import org.apache.commons.lang3.StringUtils;  /**  * 防止  * xss 和 sql 注入漏洞  * @author yushen  * 20200611  *  */ public class XssAndSqlFilter implements Filter {   /**   * TODO 这个可以注册到的的地方除了springbootappliaction 以外别的 配置也可以注册更具自己选择，最好方springbootappliaction 中 方便省事   *   * @Bean  public FilterRegistrationBean xssFilterRegistrationBean() {   FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();   filterRegistrationBean.setFilter(new XssAndSqlFilter());   filterRegistrationBean.setOrder(1);   filterRegistrationBean.setEnabled(true);   filterRegistrationBean.addUrlPatterns("/*");   filterRegistrationBean.setName("XssAndSqlFilter");   Map<String, String> initParameters = new HashMap();   initParameters.put("excludes", "/favicon.ico,/img/*,/js/*,/css/*");   initParameters.put("isIncludeRichText", "true");   filterRegistrationBean.setInitParameters(initParameters);   return filterRegistrationBean;  }   */     @Override     public void destroy() {         // TODO Auto-generated method stub      }      @Override     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)             throws IOException, ServletException {         String method = "GET";         String param = "";         XssAndSqlHttpServletRequestWrapper xssRequest = null;         if (request instanceof HttpServletRequest) {             method = ((HttpServletRequest) request).getMethod();             xssRequest = new XssAndSqlHttpServletRequestWrapper((HttpServletRequest) request);         }         if ("POST".equalsIgnoreCase(method)) {             param = this.getBodyString(xssRequest.getReader());             if(StringUtils.isNotBlank(param)){                 if(xssRequest.checkXSSAndSql(param)){                     response.setCharacterEncoding("UTF-8");                     response.setContentType("application/json;charset=UTF-8");                     PrintWriter out = response.getWriter(); //                    out.write(JSONResponseUtil.getWrappedERRString("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!"));                       out.write("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!");                     return;                 }             }         }         if (xssRequest.checkParameter()) {             response.setCharacterEncoding("UTF-8");             response.setContentType("application/json;charset=UTF-8");             PrintWriter out = response.getWriter(); //            out.write(JSONResponseUtil.getWrappedERRString("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!"));             out.write("您所访问的页面请求中有违反安全规则元素存在，拒绝访问!");             return;         }         chain.doFilter(xssRequest, response);     }      @Override     public void init(FilterConfig arg0) throws ServletException {         // TODO Auto-generated method stub      }      // 获取request请求body中参数     public static String getBodyString(BufferedReader br) {         String inputLine;         String str = "";         try {             while ((inputLine = br.readLine()) != null) {                 str += inputLine;             }             br.close();         } catch (IOException e) {             System.out.println("IOException: " + e);         }         return str;      }  } 

3.XssAndSqlHttpServletRequestWrapper包装器 包装类

 package com.superman.conf.filter;  import java.io.BufferedReader; import java.io.ByteArrayInputStream; import java.io.IOException; import java.io.InputStreamReader; import java.util.Enumeration; import java.util.HashMap; import java.util.Map; import java.util.Set; import java.util.Vector; import java.util.regex.Pattern;  import javax.servlet.ReadListener; import javax.servlet.ServletInputStream; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper;  import org.springframework.util.StreamUtils;  /**  * 过滤器相关  * @author yushen  * 20200611  * 创建XssAndSqlHttpServletRequestWrapper包装器，这是实现XSS过滤的关键，  * 在其内重写了getParameter，getParameterValues，getHeader等方法，对http请求内的参数进行了过滤  *  */ public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {      HttpServletRequest orgRequest = null;     private Map<String, String[]> parameterMap;     private final byte[] body; //用于保存读取body中数据      public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException{         super(request);         orgRequest = request;         parameterMap = request.getParameterMap();         body = StreamUtils.copyToByteArray(request.getInputStream());     }      // 重写几个HttpServletRequestWrapper中的方法     /**      * 获取所有参数名      *      * @return 返回所有参数名      */     @Override     public Enumeration<String> getParameterNames() {         Vector<String> vector = new Vector<String>(parameterMap.keySet());         return vector.elements();     }      /**      * 覆盖getParameter方法，将参数名和参数值都做xss & sql过滤。<br/>      * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>      * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖      */     @Override     public String getParameter(String name) {         String[] results = parameterMap.get(name);         if (results == null || results.length <= 0)             return null;         else {             String value = results[0];             if (value != null) {                 value = xssEncode(value);             }             return value;         }     }      /**      * 获取指定参数名的所有值的数组，如：checkbox的所有数据 接收数组变量 ，如checkobx类型      */     @Override     public String[] getParameterValues(String name) {         String[] results = parameterMap.get(name);         if (results == null || results.length <= 0)             return null;         else {             int length = results.length;             for (int i = 0; i < length; i++) {                 results[i] = xssEncode(results[i]);             }             return results;         }     }      /**      * 覆盖getHeader方法，将参数名和参数值都做xss & sql过滤。<br/>      * 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>      * getHeaderNames 也可能需要覆盖      */     @Override     public String getHeader(String name) {          String value = super.getHeader(xssEncode(name));         if (value != null) {             value = xssEncode(value);         }         return value;     }      /**      * 将容易引起xss & sql漏洞的半角字符直接替换成全角字符      *       * @param s      * @return      */     private static String xssEncode(String s) {         if (s == null || s.isEmpty()) {             return s;         } else {             s = stripXSSAndSql(s);         }         StringBuilder sb = new StringBuilder(s.length() + 16);         for (int i = 0; i < s.length(); i++) {             char c = s.charAt(i);             switch (c) {             case '>':                 sb.append("＞");// 转义大于号                 break;             case '<':                 sb.append("＜");// 转义小于号                 break;             // case ''':             // sb.append("＇");// 转义单引号             // break;             // case '"':             // sb.append("＂");// 转义双引号             // break;             case '&':                 sb.append("＆");// 转义&                 break;             case '#':                    sb.append("＃");// 转义#                 break;             default:                 sb.append(c);                 break;             }         }         return sb.toString();     }      /**      * 获取最原始的request      *       * @return      */     public HttpServletRequest getOrgRequest() {         return orgRequest;     }      /**      * 获取最原始的request的静态方法      *       * @return      */     public static HttpServletRequest getOrgRequest(HttpServletRequest req) {         if (req instanceof XssAndSqlHttpServletRequestWrapper) {             return ((XssAndSqlHttpServletRequestWrapper) req).getOrgRequest();         }          return req;     }      /**      *       * 防止xss跨脚本攻击（替换，根据实际情况调整）      */      public static String stripXSSAndSql(String value) {         if (value != null) {             // NOTE: It's highly recommended to use the ESAPI library and             // uncomment the following line to             // avoid encoded attacks.             // value = ESAPI.encoder().canonicalize(value);             // Avoid null characters             /** value = value.replaceAll("", ""); ***/             // Avoid anything between script tags             Pattern scriptPattern = Pattern.compile(                     "<[rn| | ]*script[rn| | ]*>(.*?)</[rn| | ]*script[rn| | ]*>", Pattern.CASE_INSENSITIVE);             value = scriptPattern.matcher(value).replaceAll("");             // Avoid anything in a             // src="https://www.yihaomen.com/article/java/..." type of             // e-xpression             scriptPattern = Pattern.compile("src[rn| | ]*=[rn| | ]*[\"|\'](.*?)[\"|\']",                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);             value = scriptPattern.matcher(value).replaceAll("");             // Remove any lonesome </script> tag             scriptPattern = Pattern.compile("</[rn| | ]*script[rn| | ]*>", Pattern.CASE_INSENSITIVE);             value = scriptPattern.matcher(value).replaceAll("");             // Remove any lonesome <script ...> tag             scriptPattern = Pattern.compile("<[rn| | ]*script(.*?)>",                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);             value = scriptPattern.matcher(value).replaceAll("");             // Avoid eval(...) expressions             scriptPattern = Pattern.compile("eval\((.*?)\)",                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);             value = scriptPattern.matcher(value).replaceAll("");             // Avoid e-xpression(...) expressions             scriptPattern = Pattern.compile("e-xpression\((.*?)\)",                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);             value = scriptPattern.matcher(value).replaceAll("");             // Avoid javascript:... expressions             scriptPattern = Pattern.compile("javascript[rn| | ]*:[rn| | ]*", Pattern.CASE_INSENSITIVE);             value = scriptPattern.matcher(value).replaceAll("");             // Avoid vbscript:... expressions             scriptPattern = Pattern.compile("vbscript[rn| | ]*:[rn| | ]*", Pattern.CASE_INSENSITIVE);             value = scriptPattern.matcher(value).replaceAll("");             // Avoid onload= expressions             scriptPattern = Pattern.compile("onload(.*?)=",                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);             value = scriptPattern.matcher(value).replaceAll("");         }         return value;     }      public static boolean checkXSSAndSql(String value) {         boolean flag = false;         if (value != null) {             // NOTE: It's highly recommended to use the ESAPI library and             // uncomment the following line to             // avoid encoded attacks.             // value = ESAPI.encoder().canonicalize(value);             // Avoid null characters             /** value = value.replaceAll("", ""); ***/             // Avoid anything between script tags             Pattern scriptPattern = Pattern.compile(                     "<[rn| | ]*script[rn| | ]*>(.*?)</[rn| | ]*script[rn| | ]*>", Pattern.CASE_INSENSITIVE);             flag = scriptPattern.matcher(value).find();             if (flag) {                 return flag;             }             // Avoid anything in a             // src="https://www.yihaomen.com/article/java/..." type of             // e-xpression             scriptPattern = Pattern.compile("src[rn| | ]*=[rn| | ]*[\"|\'](.*?)[\"|\']",                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);             flag = scriptPattern.matcher(value).find();             if (flag) {                 return flag;             }             // Remove any lonesome </script> tag             scriptPattern = Pattern.compile("</[rn| | ]*script[rn| | ]*>", Pattern.CASE_INSENSITIVE);             flag = scriptPattern.matcher(value).find();             if (flag) {                 return flag;             }             // Remove any lonesome <script ...> tag             scriptPattern = Pattern.compile("<[rn| | ]*script(.*?)>",                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);             flag = scriptPattern.matcher(value).find();             if (flag) {                 return flag;             }             // Avoid eval(...) expressions             scriptPattern = Pattern.compile("eval\((.*?)\)",                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);             flag = scriptPattern.matcher(value).find();             if (flag) {                 return flag;             }             // Avoid e-xpression(...) expressions             scriptPattern = Pattern.compile("e-xpression\((.*?)\)",                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);             flag = scriptPattern.matcher(value).find();             if (flag) {                 return flag;             }             // Avoid javascript:... expressions             scriptPattern = Pattern.compile("javascript[rn| | ]*:[rn| | ]*", Pattern.CASE_INSENSITIVE);             flag = scriptPattern.matcher(value).find();             if (flag) {                 return flag;             }             // Avoid vbscript:... expressions             scriptPattern = Pattern.compile("vbscript[rn| | ]*:[rn| | ]*", Pattern.CASE_INSENSITIVE);             flag = scriptPattern.matcher(value).find();             if (flag) {                 return flag;             }             // Avoid onload= expressions             scriptPattern = Pattern.compile("onload(.*?)=",                     Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);             flag = scriptPattern.matcher(value).find();             if (flag) {                 return flag;             }         }         return flag;     }      public final boolean checkParameter() {         Map<String, String[]> submitParams = new HashMap(parameterMap);         Set<String> submitNames = submitParams.keySet();         for (String submitName : submitNames) {             Object submitValues = submitParams.get(submitName);             if ((submitValues instanceof String)) {                 if (checkXSSAndSql((String) submitValues)) {                     return true;                 }             } else if ((submitValues instanceof String[])) {                 for (String submitValue : (String[])submitValues){                     if (checkXSSAndSql(submitValue)) {                         return true;                     }                 }             }         }         return false;     }          @Override         public BufferedReader getReader() throws IOException {             return new BufferedReader(new InputStreamReader(getInputStream()));         }              @Override         public ServletInputStream getInputStream() throws IOException {             final ByteArrayInputStream bais = new ByteArrayInputStream(body);             return new ServletInputStream() {                      @Override                 public int read() throws IOException {                     return bais.read();                 }                @Override               public boolean isFinished() {                   // TODO Auto-generated method stub                   return false;               }                @Override               public boolean isReady() {                   // TODO Auto-generated method stub                   return false;               }                @Override               public void setReadListener(ReadListener arg0) {                   // TODO Auto-generated method stub                                  }             };         }  }

4.修改验证登录代码 这里只写了基础的 了解意思即可 

 //2.校验手机号和token号     String sql = "select * from userlogin where phonenum='"+phonenum+"' and token='"+tokennum+"' ";    //3.不准确退回从新输入登录    try {     int resttokenjy = aed.queryApiInfo(sql).size();     if(resttokenjy != 1){      return new AsyncResult<>("验证码不正确！");     }    } catch (Exception e) {     log.error(e.toString());     return new AsyncResult<>("验证码不正确！");    }    

• 重点是加上try 如果发生异常 也好吧信息异步返回 回去
• 更具业务需求，返回自己特殊更多的内容，有需要进行其他安全设施的也可以像安全记录中进行记录数据
• 如发现危险用户 恶意攻击系统等

5.测试内容 

6.测试结果

 Loading class `com.mysql.jdbc.Driver'. This is deprecated. The new driver class is `com.mysql.cj.jdbc.Driver'. The driver is automatically registered via the SPI and manual loading of the driver class is generally unnecessary. 2020-06-12 10:02:22.045 INFO  com.alibaba.druid.pool.DruidDataSource - {dataSource-1} inited 2020-06-12 10:02:22.192 ERROR com.superman.global.service.usercheck.UserLoginCheckService - org.springframework.jdbc.BadSqlGrammarException:  ### Error querying database.  Cause: java.sql.SQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '＃'' at line 1 ### The error may exist in file [D:eclipseworks_2020superporjectsuper_portaltargetclassesmybatismapperds1ApiOneDao.xml] ### The error may involve com.superman.globaldao.ds1.ApiOneDao.queryApiInfo-Inline ### The error occurred while setting parameters ### SQL: select id from userlogin where phonenum='15600000000' and token='' or 1=1 ＃' ### Cause: java.sql.SQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '＃'' at line 1 ; bad SQL grammar []; nested exception is java.sql.SQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '＃'' at line 1 

7.反黑客小介绍（黑客大哥们好小弟这没啥大用O(∩_∩)O~，但是对待小白黑客还好）

• ok 我们这里可以看到 原本 半角代码 # 已经变成全角代码＃ 如此以来就可以完全防止sql 和xss 注入了，当然，还有有高手
• 攻击破解系统，这时候就是继续再加点过滤器和系统安全防护策略，还有安全校验来实现，
• 总体来讲
• 要向防止系统被攻破
• 就要自己多方几堵墙 阻挡破解的墙越多，黑客发现这么多阻挡，由于利益的权衡后发现，破解你的系统有些亏，大部分就
• 去破解别的系统去了^_^ , 这说法仅当参考哈，还是你们想和黑客战斗的大哥们去战斗比试比试吧，
• pk 下谁更牛 棒棒哒   O(∩_∩)O   

ok