Web常见攻击手段（二）

过滤器如下：
@WebFilter(filterName = "xssFilter", urlPatterns = "/*")
public class XssFilter implements Filter {


public void init(FilterConfig filterConfig) throws ServletException {


}


public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
// 程序防止XSS攻击原理
// 1. 使用过滤器拦截所有参数
HttpServletRequest req = (HttpServletRequest) request;
// 2.重写getParameter方法
XssHttpServletRequestWrapper xssHttpServletRequestWrapper = new XssHttpServletRequestWrapper(req);
// 放行程序，继续往下执行
chain.doFilter(xssHttpServletRequestWrapper, response);
    }
    public void destroy() {
    }
}


public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
private HttpServletRequest request;


/**
* @param request
*/
public XssHttpServletRequestWrapper(HttpServletRequest request) {
super(request);
this.request = request;
}


@Override
public String getParameter(String name) {
// 获取之前的参数
String olValue = super.getParameter(name);
System.out.print("原来参数:" + olValue);
if (!StringUtils.isEmpty(olValue)) {
// 将特殊字符转换成html展示 // 3.使用(StringEscapeUtils.escapeHtml(name)转换特殊参数
olValue = StringEscapeUtils.escapeHtml(olValue);
System.out.println("转换后" + olValue);
}
System.out.println();
return olValue;
  }
}