Struts2 Xss 攻击预防的处理

于 2017-12-15 23:01:15 发布 2425 收藏 1
分类专栏： xxs攻击，SQL注入 文章标签： 安全漏洞

摘要： 关于XSS问题的处理，此前在博客 http://blog.csdn.net/catoop/article/details/50338259 中写过处理方法。刚好最近朋友有问到“在Struts2中按文章中那样处理无效”，后来验证了下发现，Struts2 对请求的二次封装有所不同，于是针对Struts.

关于XSS问题的处理，此前在博客 http://blog.csdn.net/catoop/article/details/50338259 中写过处理方法。刚好最近朋友有问到“在Struts2中按文章中那样处理无效”，后来验证了下发现，Struts2 对请求的二次封装有所不同，于是针对Struts2如何处理XSS问题，按照本文的方法可以解决。

其主要思路就是，重写了StrutsPrepareAndExecuteFilter过滤器。

正常情况下我们在web.xml 中配置StrutsPrepareAndExecuteFilter的代码为：

  1. …………
  2.     <filter>
  3.         <filter-name>struts2</filter-name>
  4.         <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>
  5.     </filter>
  6. …………

将文章后面的几个类保存到项目中后，修改web.xml 的配置，指定我们新的MStrutsPrepareAndExecuteFilter类，代码如下：

  1. …………
  2.     <filter>
  3.         <filter-name>struts2</filter-name>
  4.         <filter-class>cn.gx.wedding.common.struts2.MStrutsPrepareAndExecuteFilter</filter-class>
  5.     </filter>
  6. …………

下面是相关的4个类源码（直接下载附件也行）
MDispatcher.java
MMultiPartRequestWrapper.java
MStrutsPrepareAndExecuteFilter.java
MStrutsRequestWrapper.java

这里说明下，因为struts2的源码中这4个类存在紧密的依赖耦合，所以只能把这4个类都重写出来，实际上其中并没有修改什么（详见MMultiPartRequestWrapper.java 和 MStrutsRequestWrapper.java）。

  1. package cn.gx.wedding.common.struts2;
  2.  
  3. import java.util.Enumeration;
  4.  
  5. import javax.servlet.http.HttpServletRequest;
  6.  
  7. import org.apache.struts2.dispatcher.StrutsRequestWrapper;
  8.  
  9. import cn.gx.wedding.util.XssShieldUtil;
  10.  
  11. public class MStrutsRequestWrapper extends StrutsRequestWrapper {
  12.  
  13.     public MStrutsRequestWrapper(HttpServletRequest req) {
  14.         super(req);
  15.     }
  16.     
  17.     public MStrutsRequestWrapper(HttpServletRequest req, boolean bool) {
  18.         super(req, bool);
  19.     }
  20.  
  21.     @Override
  22.     public String getParameter(String name) {
  23.         name = XssShieldUtil.stripXss(name);
  24.         // 返回值之前 先进行过滤
  25.         return XssShieldUtil.stripXss(super.getParameter(name));
  26.     }
  27.  
  28.     @Override
  29.     public String[] getParameterValues(String name) {
  30.         name = XssShieldUtil.stripXss(name);
  31.         // 返回值之前 先进行过滤
  32.         String[] values = super.getParameterValues(name);
  33.         if(values != null){
  34.             for (int i = 0; i < values.length; i++) {
  35.                 values[i] = XssShieldUtil.stripXss(values[i]);
  36.             }
  37.         }
  38.         return values;
  39.     }
  40.  
  41.     @Override
  42.     public Enumeration<String> getParameterNames() {
  43. //        Enumeration<String> names = super.getParameterNames();
  44. //        while(names.hasMoreElements()){
  45. //            String name = names.nextElement();
  46. //            name = XssShieldUtil.stripXss(name);
  47. //        }
  48. //        return names;
  49.         
  50.         return super.getParameterNames();
  51.     }
  52.     
  53. }
  1. package cn.gx.wedding.common.struts2;
  2.  
  3. import java.io.File;
  4. import java.io.IOException;
  5. import java.util.Map;
  6.  
  7. import javax.servlet.ServletContext;
  8. import javax.servlet.http.HttpServletRequest;
  9.  
  10. import org.apache.struts2.StrutsConstants;
  11. import org.apache.struts2.dispatcher.Dispatcher;
  12. import org.apache.struts2.dispatcher.StrutsRequestWrapper;
  13. import org.apache.struts2.dispatcher.multipart.MultiPartRequest;
  14. import org.apache.struts2.dispatcher.multipart.MultiPartRequestWrapper;
  15.  
  16. import com.opensymphony.xwork2.LocaleProvider;
  17. import com.opensymphony.xwork2.inject.Inject;
  18. import com.opensymphony.xwork2.util.logging.Logger;
  19. import com.opensymphony.xwork2.util.logging.LoggerFactory;
  20.  
  21. public class MDispatcher extends Dispatcher {
  22.  
  23.     /**
  24.      * Provide a logging instance.
  25.      */
  26.     private static final Logger LOG = LoggerFactory.getLogger(MDispatcher.class);
  27.     
  28.     /**
  29.      * Store state of StrutsConstants.DISABLE_REQUEST_ATTRIBUTE_VALUE_STACK_LOOKUP setting.
  30.      */
  31.     private boolean disableRequestAttributeValueStackLookup;
  32.     
  33.     private ServletContext servletContext;
  34.     private Map<String, String> initParams;
  35.  
  36.     private String multipartSaveDir;
  37.     
  38.     /**
  39.      * Store state of StrutsConstants.STRUTS_DEVMODE setting.
  40.      */
  41.     private boolean devMode;
  42.     
  43.     public MDispatcher(ServletContext servletContext, Map<String, String> initParams) {
  44.         super(servletContext, initParams);
  45.         this.servletContext = servletContext;
  46.         this.initParams = initParams;
  47.     }
  48.     
  49.     @Override
  50.     public HttpServletRequest wrapRequest(HttpServletRequest request, ServletContext servletContext)
  51.             throws IOException {
  52.          // don't wrap more than once
  53.         if (request instanceof StrutsRequestWrapper) {
  54.             return request;
  55.         }
  56.  
  57.         String content_type = request.getContentType();
  58.         if (content_type != null && content_type.contains("multipart/form-data")) {
  59.             MultiPartRequest mpr = getMultiPartRequest();
  60.             LocaleProvider provider = getContainer().getInstance(LocaleProvider.class);
  61.             request = new MMultiPartRequestWrapper(mpr, request, getSaveDir(servletContext), provider);
  62.         } else {
  63.             request = new MStrutsRequestWrapper(request, disableRequestAttributeValueStackLookup);
  64.         }
  65.  
  66.         return request;
  67.     }
  68.  
  69.     private String getSaveDir(ServletContext servletContext) {
  70.         String saveDir = multipartSaveDir.trim();
  71.  
  72.         if (saveDir.equals("")) {
  73.             File tempdir = (File) servletContext.getAttribute("javax.servlet.context.tempdir");
  74.             if (LOG.isInfoEnabled()) {
  75.             LOG.info("Unable to find 'struts.multipart.saveDir' property setting. Defaulting to javax.servlet.context.tempdir");
  76.             }
  77.  
  78.             if (tempdir != null) {
  79.                 saveDir = tempdir.toString();
  80.                 setMultipartSaveDir(saveDir);
  81.             }
  82.         } else {
  83.             File multipartSaveDir = new File(saveDir);
  84.  
  85.             if (!multipartSaveDir.exists()) {
  86.                 if (!multipartSaveDir.mkdirs()) {
  87.                     String logMessage;
  88.                     try {
  89.                         logMessage = "Could not find create multipart save directory '" + multipartSaveDir.getCanonicalPath() + "'.";
  90.                     } catch (IOException e) {
  91.                         logMessage = "Could not find create multipart save directory '" + multipartSaveDir.toString() + "'.";
  92.                     }
  93.                     if (devMode) {
  94.                         LOG.error(logMessage);
  95.                     } else {
  96.                         if (LOG.isWarnEnabled()) {
  97.                             LOG.warn(logMessage);
  98.                         }
  99.                     }
  100.                 }
  101.             }
  102.         }
  103.  
  104.         if (LOG.isDebugEnabled()) {
  105.             LOG.debug("saveDir=" + saveDir);
  106.         }
  107.  
  108.         return saveDir;
  109.     }
  110.     
  111.     /**
  112.      * Modify state of StrutsConstants.STRUTS_MULTIPART_SAVEDIR setting.
  113.      * @param val New setting
  114.      */
  115.     @Override
  116.     @Inject(StrutsConstants.STRUTS_MULTIPART_SAVEDIR)
  117.     public void setMultipartSaveDir(String val) {
  118.         multipartSaveDir = val;
  119.     }
  120.     
  121.     /**
  122.      * Modify state of StrutsConstants.STRUTS_DEVMODE setting.
  123.      * @param mode New setting
  124.      */
  125.     @Override
  126.     @Inject(StrutsConstants.STRUTS_DEVMODE)
  127.     public void setDevMode(String mode) {
  128.         devMode = "true".equals(mode);
  129.     }
  130. }
  1. package cn.gx.wedding.common.struts2;
  2.  
  3. import java.util.Enumeration;
  4.  
  5. import javax.servlet.http.HttpServletRequest;
  6.  
  7. import org.apache.struts2.dispatcher.multipart.MultiPartRequest;
  8. import org.apache.struts2.dispatcher.multipart.MultiPartRequestWrapper;
  9.  
  10. import cn.gx.wedding.util.XssShieldUtil;
  11.  
  12. import com.opensymphony.xwork2.LocaleProvider;
  13.  
  14. public class MMultiPartRequestWrapper extends MultiPartRequestWrapper {
  15.  
  16.     public MMultiPartRequestWrapper(MultiPartRequest multiPartRequest, HttpServletRequest request, String saveDir,
  17.             LocaleProvider provider) {
  18.         super(multiPartRequest, request, saveDir, provider);
  19.     }
  20.  
  21.     @Override
  22.     public String getParameter(String name) {
  23.         name = XssShieldUtil.stripXss(name);
  24.         // 返回值之前 先进行过滤
  25.         return XssShieldUtil.stripXss(super.getParameter(name));
  26.     }
  27.  
  28.     @Override
  29.     public String[] getParameterValues(String name) {
  30.         name = XssShieldUtil.stripXss(name);
  31.         // 返回值之前 先进行过滤
  32.         String[] values = super.getParameterValues(name);
  33.         if(values != null){
  34.             for (int i = 0; i < values.length; i++) {
  35.                 values[i] = XssShieldUtil.stripXss(values[i]);
  36.             }
  37.         }
  38.         return values;
  39.     }
  40.  
  41.     @Override
  42.     public Enumeration<String> getParameterNames() {
  43. //        Enumeration<String> names = super.getParameterNames();
  44. //        while(names.hasMoreElements()){
  45. //            String name = names.nextElement();
  46. //            name = XssShieldUtil.stripXss(name);
  47. //        }
  48. //        return names;
  49.         
  50.         return super.getParameterNames();
  51.     }
  52.     
  53. }
  1. package cn.gx.wedding.common.struts2;
  2.  
  3. import java.util.HashMap;
  4. import java.util.Iterator;
  5. import java.util.Map;
  6.  
  7. import javax.servlet.FilterConfig;
  8. import javax.servlet.ServletException;
  9.  
  10. import org.apache.struts2.dispatcher.Dispatcher;
  11. import org.apache.struts2.dispatcher.ng.ExecuteOperations;
  12. import org.apache.struts2.dispatcher.ng.HostConfig;
  13. import org.apache.struts2.dispatcher.ng.InitOperations;
  14. import org.apache.struts2.dispatcher.ng.PrepareOperations;
  15. import org.apache.struts2.dispatcher.ng.filter.FilterHostConfig;
  16. import org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter;
  17.  
  18. public class MStrutsPrepareAndExecuteFilter extends StrutsPrepareAndExecuteFilter {
  19.  
  20.     @Override
  21.     public void init(FilterConfig filterConfig) throws ServletException {
  22.         InitOperations init = new InitOperations();
  23.         Dispatcher dispatcher = null;
  24.         try {
  25.             FilterHostConfig config = new FilterHostConfig(filterConfig);
  26.             init.initLogging(config);
  27.             dispatcher = initDispatcher(config);
  28.             init.initStaticContentLoader(config, dispatcher);
  29.  
  30.             prepare = new PrepareOperations(filterConfig.getServletContext(), dispatcher);
  31.             execute = new ExecuteOperations(filterConfig.getServletContext(), dispatcher);
  32.             this.excludedPatterns = init.buildExcludedPatternsList(dispatcher);
  33.  
  34.             postInit(dispatcher, filterConfig);
  35.         } finally {
  36.             if (dispatcher != null) {
  37.                 dispatcher.cleanUpAfterInit();
  38.             }
  39.             init.cleanup();
  40.         }
  41.     }
  42.  
  43.     /**
  44.      * Creates and initializes the dispatcher
  45.      */
  46.     public Dispatcher initDispatcher(HostConfig filterConfig) {
  47.         Dispatcher dispatcher = createDispatcher(filterConfig);
  48.         dispatcher.init();
  49.         return dispatcher;
  50.     }
  51.  
  52.     /**
  53.      * Create a {@link Dispatcher}
  54.      */
  55.     private Dispatcher createDispatcher(HostConfig filterConfig) {
  56.         Map<String, String> params = new HashMap<String, String>();
  57.         for (Iterator e = filterConfig.getInitParameterNames(); e.hasNext();) {
  58.             String name = (String) e.next();
  59.             String value = filterConfig.getInitParameter(name);
  60.             params.put(name, value);
  61.         }
  62.         return new MDispatcher(filterConfig.getServletContext(), params);
  63.     }
  64. }

如果使用的是springmvc、springboot等其他“非struts2”的框架，请参考 http://blog.csdn.net/catoop/article/details/50338259


原文地址：https://yq.aliyun.com/articles/7126#