Java 用于MultipartTTPServletRequest的XSS筛选器

我使用一个过滤器过滤掉对应用程序可能进行的XSS攻击。对于发送到控制器的大多数表单数据，下面的过滤器工作正常。但对于包含文件的表单，即multipartttpServletRequest，该过滤器似乎不起作用

public class XSSFilter implements Filter{


    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }

    @Override
    public void destroy() {
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {

        chain.doFilter(new XSSRequestWrapper((HttpServletRequest) request), response);

    }

使用以下包装器

public class XSSRequestWrapper extends HttpServletRequestWrapper {

private static final Logger LOG = Logger.getLogger(SessionTimeoutCookieFilter.class);



private static Pattern[] patterns = new Pattern[]{
    // Script fragments
    Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE),
    // src='...'
    Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    // lonely script tags
    Pattern.compile("</script>", Pattern.CASE_INSENSITIVE),
    Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    // eval(...)
    Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    // expression(...)
    Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    // javascript:...
    Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE),
    // vbscript:...
    Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE),
    // onload(...)=...
    Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    //cmd for xls injection...
    Pattern.compile("=cmd(.*?)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
    // img tag element
    Pattern.compile("<img(.*?)>", Pattern.CASE_INSENSITIVE)
};

public XSSRequestWrapper(HttpServletRequest servletRequest) {
    super(servletRequest);
    LOG.info("= Inside XSSRequestWrapper  = ");
}

@Override
public String[] getParameterValues(String parameter) {
    String[] values = super.getParameterValues(parameter);

    if (values == null) {
        return null;
    }

    int count = values.length;
    String[] encodedValues = new String[count];
    for (int i = 0; i < count; i++) {
        encodedValues[i] = stripXSS(values[i]);
    }

    return encodedValues;
}

@Override
public String getParameter(String parameter) {
    String value = super.getParameter(parameter);

            return stripXSS(value);
}

@Override
public String getHeader(String name) {
    String value = super.getHeader(name);

    return stripXSS(value);
}

private String stripXSS(String value) {
    if (value != null) {
        // NOTE: It's highly recommended to use the ESAPI library and uncomment the following line to
        // avoid encoded attacks.
        //value = ESAPI.encoder().canonicalize(value);


        // Avoid null characters
        value = value.replaceAll("\0", "");

        // Remove all sections that match a pattern
        for (Pattern scriptPattern : patterns){
            value = scriptPattern.matcher(value).replaceAll("");
        }


    }
    return value;
}

}

现在这在大多数情况下都很好。但是当请求类型为org.springframework.web.multipart.multipartttpServletRequest时，此筛选器似乎不起作用。我对这一切都不熟悉。任何帮助都将不胜感激

---

谢谢。

一个快速解决方案是转义文件名以避免xss攻击，另一个选项是添加自定义XSSFilter以处理常见的多部分 下面的文章可能会有所帮助。

用servlet过滤器“阻止”XSS是一种奇怪的思维方式。在将HTML代码写入响应过程中，而不是在处理请求负载过程中，通常会阻止XSS。我建议去掉这个奇怪的过滤器，直接正确地转义HTML。一个像样的MVC框架已经内置了这方面的功能。

public class WebAppInitilizer extends  AbstractAnnotationConfigDispatcherServletInitializer {

@Override
public void onStartup(ServletContext servletContext) throws ServletException {
    super.onStartup(servletContext);
    servletContext.addFilter("name", XSSFilter.class)
                  .addMappingForUrlPatterns(null, false, "/*");
}