Java使用过滤器防止SQL注入XSS脚本注入的实现

package com.cn.unit.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import org.apache.commons.lang.StringUtils;
import org.springframework.web.multipart.MultipartHttpServletRequest;
import org.springframework.web.multipart.commons.CommonsMultipartResolver;

/**
 * 过滤器
 * Created by adonis on 2020/12/12
 */
public class SafeFilter implements Filter{
 
 // 配置信息对象
 public FilterConfig filterConfig;
 
 /**
 * 初始化
 * 与我们编写的Servlet程序一样，Filter的创建和销毁由WEB服务器负责。 
 * Web应用程序启动时，Web服务器将创建Filter的实例对象，并调用其init方法，读取web.xml配置，
 * 完成对象的初始化功能，从而为后续的用户请求作好拦截的准备工作。
 * Filter对象只会创建一次，init方法也只会执行一次。
 * 开发人员通过init方法的参数，可获得代表当前Filter配置信息的FilterConfig对象。
 */
  @Override
  public void init(FilterConfig filterConfig) throws ServletException {
   filterCOnfig= config;
 }
 
 /**
   * 拦截请求
   * 这个方法完成实际的过滤操作。当客户请求访问与过滤器关联的URL的时候，Servlet过滤器将先执行doFilter方法。
   * FilterChain参数用于访问后续过滤器。
   */
  @Override
  public void doFilter(ServletRequest request, ServletResponse response,
             FilterChain chain) throws IOException, ServletException {
    HttpServletRequest httpRequest = (HttpServletRequest) request;
    String enctype = httpRequest.getContentType();
    if(StringUtils.isNotBlank(enctype) && enctype.contains("multipart/form-data")){
     // 上传文件
     CommonsMultipartResolver commOnsMultipartResolver= new CommonsMultipartResolver(
     httpRequest.getSession().getServletContext());
   MultipartHttpServletRequest multipartRequest = commonsMultipartResolver.resolveMultipart(httpRequest);
   XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(multipartRequest);
   chain.doFilter(xssRequest, response);
    }else{
     // 普通表单和Ajax
     XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest) request);
     chain.doFilter(xssRequest, response);
    }
  }
  
  /**
   * 销毁
   * Filter对象创建后会驻留在内存，当Web应用移除或服务器停止时才销毁。在Web容器卸载Filter对象之前被调用。
   * 该方法在Filter的生命周期中仅执行一次。在这个方法中，可以释放过滤器使用的资源。
   */
  @Override
  public void destroy() {
   this.filterCOnfig= null;
 }
 
}

package com.cn.unit.filter;

import java.util.Map;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

/**
 * 用户请求包装类
 * Created by adonis on 2020/12/12
 */
public class SafeHttpServletRequestWrapper extends HttpServletRequestWrapper{

  public SafeHttpServletRequestWrapper(HttpServletRequest request) { 
    super(request);
  }
  
  @Override 
  public String getParameter(String name) { 
    String value = super.getParameter(name); 
    if (value != null) { 
      value = xssEncode(value); 
    } 
    return value; 
  }
  @Override
  public String[] getParameterValues(String name) {
    String[] value = super.getParameterValues(name);
    if(value != null){
      for (int i = 0; i ", "＞");
    value = value.replaceAll("'", "＇");
    value = value.replaceAll(";", "﹔");
    value = value.replaceAll("&", "＆");
    value = value.replaceAll("%", "﹪");
    value = value.replaceAll("#", "＃");
    value = value.replaceAll("select", "sele&＃7428;t");// "c"→"&＃7428;"
    value = value.replaceAll("truncate", "trun&＃7428;ate");// "c"→"&＃7428;"
    value = value.replaceAll("exec", "exe&＃7428;");// "c"→"&＃7428;"
    value = value.replaceAll("join", "j&＃7439;in");// "o"→"&＃7439;"
    value = value.replaceAll("union", "uni&＃7439;n");// "o"→"&＃7439;"
    value = value.replaceAll("drop", "dr&＃7439;p");// "o"→"&＃7439;"
    value = value.replaceAll("count", "c&＃7439;unt");// "o"→"&＃7439;"
    value = value.replaceAll("insert", "ins&＃8494;rt");// "e"→"&＃8494;"
    value = value.replaceAll("update", "updat&＃8494;");// "e"→"&＃8494;"
    value = value.replaceAll("delete", "delet&＃8494;");// "e"→"&＃8494;"
    
    value = value.replaceAll("script", "s&＃7428;ript");// "c"→"&＃7428;"
    value = value.replaceAll("COOKIE", "c&＃7439;&＃7439;kie");// "o"→"&＃7439;"
    value = value.replaceAll("iframe", "ifram&＃8494;");// "e"→"&＃8494;"
    value = value.replaceAll("onmouseover", "onmouseov&＃8494;r");// "e"→"&＃8494;"
    value = value.replaceAll("onmousemove", "onmousemov&＃8494;");// "e"→"&＃8494;"*/
    return value;
  } 
}

  XssSqlFilter
  com.cn.unit.filter.SafeFilter


  XssSqlFilter
  /*

 excludeFilter
 /document/;/ligentres/

public FilterConfig filterConfig;
public String[] excludeFilterArray;
@Override
public void init(FilterConfig config) throws ServletException {
 filterCOnfig= config;
  // 读取web配置文件中的静态资源所在路径
 String excludeFilter = filterConfig.getInitParameter("excludeFilter");
 excludeFilterArray = excludeFilter.split(";");
}

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
  HttpServletRequest httpRequest = (HttpServletRequest) request;
  String uri = httpRequest.getRequestURI();
  // 静态资源直接跳过,不进行过滤
  if(uri==null||this.isContains(uri, excludeFilterArray)) {
   chain.doFilter(request, response);
   return;
  }
  ......
}

// 判断数组是否包含某一元素
public boolean isContains(String uri, String[] regx) {
  boolean result = false;
  for (int i = 0; i