admin/MaxKey
1
0
Fork 0
mirror of https://gitee.com/dromara/MaxKey.git synced 2025-12-06 17:08:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

Xss

Browse Source
This commit is contained in:
MaxKey 2021-03-25 17:24:10 +08:00
parent 5d5ac8dab1
commit 41ad5e9b32
7 changed files with 72 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
build.gradle
View File

@ -133,6 +133,7 @@ subprojects {
compile group: 'commons-collections', name: 'commons-collections', version: '3.2.2'
compile group: 'org.apache.commons', name: 'commons-collections4', version: '4.4'
//compile group: 'org.apache.commons', name: 'commons-csv', version: '1.7'
compile group: 'org.apache.commons', name: 'commons-text', version: '1.9'
compile group: 'org.apache.commons', name: 'commons-dbcp2', version: '2.6.0'
compile group: 'commons-dbutils', name: 'commons-dbutils', version: '1.7'
compile group: 'org.apache.commons', name: 'commons-digester3', version: '3.2'

1
config/build_docker.gradle
View File

@ -133,6 +133,7 @@ subprojects {
compile group: 'commons-collections', name: 'commons-collections', version: '3.2.2'
compile group: 'org.apache.commons', name: 'commons-collections4', version: '4.4'
//compile group: 'org.apache.commons', name: 'commons-csv', version: '1.7'
compile group: 'org.apache.commons', name: 'commons-text', version: '1.9'
compile group: 'org.apache.commons', name: 'commons-dbcp2', version: '2.6.0'
compile group: 'commons-dbutils', name: 'commons-dbutils', version: '1.7'
compile group: 'org.apache.commons', name: 'commons-digester3', version: '3.2'

1
config/build_jar.gradle
View File

@ -133,6 +133,7 @@ subprojects {
compile group: 'commons-collections', name: 'commons-collections', version: '3.2.2'
compile group: 'org.apache.commons', name: 'commons-collections4', version: '4.4'
//compile group: 'org.apache.commons', name: 'commons-csv', version: '1.7'
compile group: 'org.apache.commons', name: 'commons-text', version: '1.9'
compile group: 'org.apache.commons', name: 'commons-dbcp2', version: '2.6.0'
compile group: 'commons-dbutils', name: 'commons-dbutils', version: '1.7'
compile group: 'org.apache.commons', name: 'commons-digester3', version: '3.2'

1
config/build_standard.gradle
View File

@ -133,6 +133,7 @@ subprojects {
compile group: 'commons-collections', name: 'commons-collections', version: '3.2.2'
compile group: 'org.apache.commons', name: 'commons-collections4', version: '4.4'
//compile group: 'org.apache.commons', name: 'commons-csv', version: '1.7'
compile group: 'org.apache.commons', name: 'commons-text', version: '1.9'
compile group: 'org.apache.commons', name: 'commons-dbcp2', version: '2.6.0'
compile group: 'commons-dbutils', name: 'commons-dbutils', version: '1.7'
compile group: 'org.apache.commons', name: 'commons-digester3', version: '3.2'

12
maxkey-core/src/main/java/org/maxkey/autoconfigure/MvcAutoConfiguration.java
View File

@ -25,6 +25,7 @@ import javax.servlet.Filter;
import org.maxkey.constants.ConstantsProperties;
import org.maxkey.constants.ConstantsTimeInterval;
import org.maxkey.web.WebXssRequestFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.InitializingBean;
@ -260,6 +261,17 @@ public class MvcAutoConfiguration implements InitializingBean {
return new SecurityContextHolderAwareRequestFilter();
}
@Bean
public FilterRegistrationBean<Filter> webXssRequestFilter() {
_logger.debug("delegatingFilterProxy init for /* ");
FilterRegistrationBean<Filter> registrationBean = new FilterRegistrationBean<Filter>(new WebXssRequestFilter());
registrationBean.addUrlPatterns("/*");
registrationBean.setName("webXssRequestFilter");
registrationBean.setOrder(2);
return registrationBean;
}
@Bean
public FilterRegistrationBean<Filter> delegatingFilterProxy() {
_logger.debug("delegatingFilterProxy init for /* ");

43
maxkey-core/src/main/java/org/maxkey/web/WebXssRequestFilter.java Normal file
View File

@ -0,0 +1,43 @@
package org.maxkey.web;
import java.io.IOException;
import java.util.Enumeration;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.apache.commons.text.StringEscapeUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.filter.GenericFilterBean;
public class WebXssRequestFilter extends GenericFilterBean {
final static Logger _logger = LoggerFactory.getLogger(GenericFilterBean.class);
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
_logger.trace("WebXssRequestFilter");
boolean isWebXss = false;
Enumeration<String> parameterNames = request.getParameterNames();
while (parameterNames.hasMoreElements()) {
String key = (String) parameterNames.nextElement();
String value = request.getParameter(key);
_logger.trace("parameter name "+key +" , value " + value);
if(!StringEscapeUtils.escapeHtml4(value).equals(value)
||value.toLowerCase().indexOf("script")>-1) {
isWebXss = true;
_logger.error("parameter name "+key +" , value " + value
+ ", contains dangerous content ! ");
break;
}
}
if(!isWebXss) {
chain.doFilter(request, response);
}
}
}

13
maxkey-core/src/test/java/org/maxkey/EscapeHtml4Test.java Normal file
View File

@ -0,0 +1,13 @@
package org.maxkey;
import java.sql.SQLException;
import org.apache.commons.text.StringEscapeUtils;
public class EscapeHtml4Test {
public static void main(String[] args) throws SQLException {
String value="<IMG SRC=javascript:alert('XSS')<javascript>>";
System.out.println(StringEscapeUtils.escapeHtml4(value));
System.out.println(StringEscapeUtils.escapeEcmaScript(value));
}
}