springboot经验之sql注入、xss注入拦截（POST）

简介

sql注入、xss注入、cors攻击的简介以及解决方案，可以参考下面链接：
https://blog.csdn.net/yhhyhhyhhyhh/article/details/84504487
这里我就不做的的介绍了，解决sql注入根本方案在于使用预编译而不是拼接sql，
而通常拦截参数都只有针对GET方法，下面介绍下POST方法

POST防注入方案

1、增加httprequest包装类

import java.io.BufferedReader;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.*;
import java.util.regex.Pattern;import javax.servlet.ReadListener;
import javax.servlet.ServletInputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
import org.springframework.util.StreamUtils;@Slf4j
public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper {private static String key = "and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|;|or|-|+";private static Set notAllowedKeyWords = new HashSet(0);static {String keyStr[] = key.split("\\|");for (String str : keyStr) {notAllowedKeyWords.add(str);}}HttpServletRequest orgRequest = null;private Map parameterMap;private final byte[] body; //用于保存读取body中数据public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException{super(request);orgRequest = request;parameterMap = request.getParameterMap();body = StreamUtils.copyToByteArray(request.getInputStream());}// 重写几个HttpServletRequestWrapper中的方法/*** 获取所有参数名** @return 返回所有参数名*/@Overridepublic Enumeration getParameterNames() {Vector vector = new Vector(parameterMap.keySet());return vector.elements();}/*** 覆盖getParameter方法，将参数名和参数值都做xss & sql过滤。
* 如果需要获得原始的值，则通过super.getParameterValues(name)来获取
* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖*/@Overridepublic String getParameter(String name) {String[] results = parameterMap.get(name);if (results == null || results.length <= 0)return null;else {String value = results[0];if (value != null) {value = xssEncode(value);}return value;}}/*** 获取指定参数名的所有值的数组，如：checkbox的所有数据 接收数组变量 ，如checkobx类型*/@Overridepublic String[] getParameterValues(String name) {String[] results = parameterMap.get(name);if (results == null || results.length <= 0)return null;else {int length = results.length;for (int i = 0; i < length; i++) {results[i] = xssEncode(results[i]);}return results;}}/*** 覆盖getHeader方法，将参数名和参数值都做xss & sql过滤。
* 如果需要获得原始的值，则通过super.getHeaders(name)来获取
* getHeaderNames 也可能需要覆盖*/@Overridepublic String getHeader(String name) {String value = super.getHeader(xssEncode(name));if (value != null) {value = xssEncode(value);}return value;}/*** 将容易引起xss & sql漏洞的半角字符直接替换成全角字符* * @param s* @return*/private static String xssEncode(String s) {if (s == null || s.isEmpty()) {return s;} else {s = stripXSSAndSql(s);}StringBuilder sb = new StringBuilder(s.length() + 16);for (int i = 0; i < s.length(); i++) {char c = s.charAt(i);switch (c) {case '>':sb.append("＞");// 转义大于号break;case '<':sb.append("＜");// 转义小于号break;// case '\'':// sb.append("＇");// 转义单引号// break;// case '\"':// sb.append("＂");// 转义双引号// break;case '&':sb.append("＆");// 转义&break;case '#':sb.append("＃");// 转义#break;default:sb.append(c);break;}}return sb.toString();}/*** 获取最原始的request* * @return*/public HttpServletRequest getOrgRequest() {return orgRequest;}/*** 获取最原始的request的静态方法* * @return*/public static HttpServletRequest getOrgRequest(HttpServletRequest req) {if (req instanceof XssAndSqlHttpServletRequestWrapper) {return ((XssAndSqlHttpServletRequestWrapper) req).getOrgRequest();}return req;}/*** * 防止xss跨脚本攻击（替换，根据实际情况调整）*/public static String stripXSSAndSql(String value) {if (value != null) {// NOTE: It's highly recommended to use the ESAPI library and// uncomment the following line to// avoid encoded attacks.// value = ESAPI.encoder().canonicalize(value);// Avoid null characters/** value = value.replaceAll("", ""); ***/// Avoid anything between script tagsPattern scriptPattern = Pattern.compile("<[\r\n| | ]*script[\r\n| | ]*>(.*?)", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid anything in a// src="http://www.yihaomen.com/article/java/..." type of// e-xpressionscriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome  tagscriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome  tagscriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE);flag = scriptPattern.matcher(value).find();if (flag) {return flag;}// Remove any lonesome