拦截XSS攻击

话不多说直接上代码

@Configuration
public class XssConfiguration {/*** 描述 : xssObjectMapper** @param builder builder* @return xssObjectMapper*/@SuppressWarnings("SpringJavaInjectionPointsAutowiringInspection")@Bean@Primarypublic ObjectMapper xssObjectMapper(Jackson2ObjectMapperBuilder builder) {//解析器ObjectMapper objectMapper = builder.createXmlMapper(false).build();//注册xss解析器SimpleModule xssModule = new SimpleModule("XssStringJsonSerializer");xssModule.addSerializer(new XssStringJsonSerializer());objectMapper.registerModule(xssModule);//返回return objectMapper;}
}

/*** 描述 : 跨站请求防范*/
public class XssFilter implements Filter {/*** 描述 : 日志*/private static final Logger LOGGER = LoggerFactory.getLogger(XssFilter.class);@Overridepublic void init(FilterConfig filterConfig) {LOGGER.debug("(XssFilter) initialize");}@Overridepublic void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)throws IOException, ServletException {XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest) request);chain.doFilter(xssRequest, response);}@Overridepublic void destroy() {LOGGER.debug("(XssFilter) destroy");}
}

/*** 描述 : 跨站请求防范** @author 01373842*/
@SuppressWarnings("unused")
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {/*** 描述 : 构造函数** @param request 请求对象*/public XssHttpServletRequestWrapper(HttpServletRequest request) {super(request);}@Overridepublic String getHeader(String name) {String value = super.getHeader(name);return value == null ? null : HtmlUtils.htmlEscape(value);}@Overridepublic String getParameter(String name) {String value = super.getParameter(name);return value == null ? null : HtmlUtils.htmlEscape(value);}@Overridepublic String[] getParameterValues(String name) {String[] values = super.getParameterValues(name);if (values != null) {int length = values.length;String[] escapeValues = new String[length];for (int i = 0; i < length; i++) {escapeValues[i] = HtmlUtils.htmlEscape(values[i]);}return escapeValues;}return super.getParameterValues(name);}
}

/*** 描述 : 基于xss的JsonSerializer** @author 89003438*/
public class XssStringJsonSerializer extends JsonSerializer<String> {@Overridepublic Class<String> handledType() {return String.class;}@Overridepublic void serialize(String value, JsonGenerator jsonGenerator, SerializerProvider serializerProvider) throws IOException {if (value != null) {String encodedValue = HtmlUtils.htmlEscape(value);jsonGenerator.writeString(encodedValue);}}
}

大功告成