Implementation method and system for solving cross-site script attack based on JAVA filter and HttpServletRequest Wrapper packaging class

Abstract

The invention relates to the technical field of JAVA rear ends, in particular to an implementation method and system for solving cross-site script attacks based on a JAVA filter and an HttpServletRequest Wrapper packaging class, and the implementation method comprises the following steps: writing a packaging class XssHttpServletRequest Wrapper; writing a method cleanXSS for filtering illegal characters, and filtering and replacing requested parameters; filtering the request parameters; writing a filter class XssFilter to realize an interface of the filter; a filter XssFilter is configured in the web.xml, so that the XssFilter can intercept all requests; the implementation method and system for solving the cross-site script attack based on the JAVA filter and the HttpServletRequest Wrapper packaging class have the advantages that the Filter filter of the JAVA is used for intercepting all requests at the front end, then the inheriting packaging class HttpServletRequest is used for packaging an HttpServletRequest object, methods of getParameter Values, getParameter and the like are rewritten, the parameters of the requests are processed, and therefore the method and system for solving the cross-site script attack based on the JAVA filter and the HttpServletRequest Wrapper packaging class have the advantages that the method and system for solving the cross-site script attack based on the JAVA filter and the HttpServletRequest Wrapper packaging class are Sensitive characters and illegal characters are replaced and filtered to achieve the purpose of safety.

Description

Technical Field

[0001] The present invention relates to the technical field of JAVA backend, in particular to a method and system for solving cross-site scripting attacks based on JAVA filter and HttpServletRequestWrapper packaging class. Background Art

[0002] With the rapid development of the Internet, information security issues have become one of the most concerned focuses of enterprises. In the era of mobile Internet, in addition to traditional security issues such as XSS and CSRF, new security issues such as network hijacking and illegal calls to Hybrid API are often encountered. Of course, browsers themselves are also constantly evolving and developing, constantly introducing new technologies such as CSP and Same-Site Cookies to enhance security, but there are still many potential threats.

[0003] XSS stands for Cross Site Scripting. XSS attack refers to a method by which hackers inject malicious scripts into HTML files or DOM, and then use the injected malicious scripts to attack users when they browse the page. Malicious scripts can do things such as stealing cookie information, monitoring user behavior, and modifying DOM. For example, by modifying DOM, a login window is forged to trick users into entering account information, passwords, and other information, and to generate floating window ads on the page.

[0004] A filter is a component in a JAVA Web application that performs pre-processing and post-processing operations on requests and responses before the request reaches the Servlet or JSP or before the response is sent back to the client. By using filters, you can filter requests, intercept requests, modify request parameters, and perform some pre-processing operations before the request is processed; you can also filter responses, modify the response content, and add some additional processing.

[0005] HttpServletRequestWrapper is an abstract class that is part of the Servlet API. This class provides a convenient way to wrap the HttpServletRequest object so that the behavior of the request object can be modified or enhanced. By extending the HttpServletRequestWrapper class, you can create a custom request wrapper class in which you can override methods to change the behavior of the request. For example, you can add security verification, logging, or modify request header information.

[0006] Therefore, it is necessary to solve the cross-site scripting attack problem of JAVA and provide a more flexible and convenient way to solve this problem. Using this method, users can easily replace sensitive characters and illegal characters. Summary of the invention

[0007] The purpose of the present invention is to provide a method and system for solving cross-site scripting attacks based on JAVA filter and HttpServletRequestWrapper packaging class, so as to solve the problems raised in the above background technology.

[0008] To achieve the above object, the present invention provides the following technical solution: a method for solving cross-site scripting attacks based on JAVA filter and HttpServletRequestWrapper packaging class, the method comprising the following steps:

[0009] Write the wrapper class XssHttpServletRequestWrapper;

[0010] Write a method called cleanXSS to filter illegal characters, and filter and replace the request parameters;

[0011] Filter request parameters;

[0012] Write the filter class XssFilter to implement the Filter interface;

[0013] Configure the filter XssFilter in web.xml so that XssFilter can intercept all requests.

[0014] Preferably, the specific operations of writing the wrapper class XssHttpServletRequestWrapper include:

[0015] Write a wrapper class XssHttpServletRequestWrapper that inherits HttpServletRequestWrapper and call the constructor of the parent class in the constructor.

[0016] Preferably, a method cleanXSS for filtering illegal characters is written, and the specific operations of filtering and replacing the request parameters include:

[0017] Escape characters, for example, replace characters with (; replace characters with); replace characters ' with '; replace " with "; replace script characters javascript, onload, expression characters of javascript with empty strings; write the characters to be replaced in the configuration file or database, then call and obtain them in the cleanXSS method, and then replace the requested characters to make character replacement configurable.

[0018] Preferably, the specific operation of filtering the request parameters includes:

[0019] Rewrite the getParameterValues, getParameter, getHeader, and getParameterMap methods of XssHttpServletRequestWrapper. Each method calls cleanXSS to filter the request parameters.

[0020] Preferably, the specific operations of writing the filter class XssFilter to implement the Filter interface include:

[0021] Intercept all user requests, use XssHttpServletRequestWrapper to wrap the request object in the doFilter method, and filter sensitive and illegal characters when getting parameters from the request object.

[0022] A system for implementing cross-site scripting attacks based on JAVA filters and HttpServletRequestWrapper wrapper classes, the system comprising:

[0023] Wrapper class writing module, used to write the wrapper class XssHttpServletRequestWrapper;

[0024] Parameter preprocessing module, used to write the method cleanXSS to filter illegal characters, and filter and replace the request parameters;

[0025] Parameter filtering module, used to filter request parameters;

[0026] The interface writing module is used to write the filter class XssFilter to implement the Filter interface;

[0027] The filter configuration module is used to configure the filter XssFilter in web.xml so that XssFilter can intercept all requests.

[0028] Preferably, a wrapper class writing module is used to write a wrapper class XssHttpServletRequestWrapper that inherits HttpServletRequestWrapper, and the constructor of the parent class is called in the constructor.

[0029] Preferably, the parameter preprocessing module escapes the characters, for example, replaces the characters with (; replaces the characters with); replaces the characters ' with '; replaces " with "; replaces the script characters javascript, onload, and expression characters of javascript with empty strings; writes the characters to be replaced in a configuration file or a database, then calls and obtains them in the cleanXSS method, and then replaces the requested characters, so that the character replacement is configurable.

[0030] Preferably, the parameter filtering module rewrites the getParameterValues, getParameter, getHeader, and getParameterMap methods of XssHttpServletRequestWrapper, and each method calls cleanXSS to filter the request parameters.

[0031] Preferably, the interface writing module intercepts all user requests, and uses XssHttpServletRequestWrapper to wrap the request object in the doFilter method. When obtaining parameters from the request object in the future, data with sensitive characters and illegal characters are filtered.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] The invention proposes an implementation method and system for solving cross-site scripting attacks based on a JAVA filter and an HttpServletRequestWrapper wrapper class. The JAVA filter is used to intercept all requests from the front end, and then the inherited wrapper class HttpServletRequestWrapper is used to wrap the HttpServletRequest object, and methods such as getParameterValues ​​and getParameter are rewritten to process the parameters of the request, and sensitive characters and illegal characters are replaced and filtered to achieve security purposes. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0035] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] For example, see Figure 1 The present invention provides a technical solution: a method for solving cross-site scripting attacks based on JAVA filter and HttpServletRequestWrapper packaging class, the method comprising the following steps:

[0037] Write the wrapper class XssHttpServletRequestWrapper

[0038] First, write a wrapper class XssHttpServletRequestWrapper that inherits HttpServletRequestWrapper and call the parent class's constructor in the constructor.

[0039] The code is as follows:

[0040] public class XssHttpServletRequestWrapper extendsHttpServletRequestWrapper{

[0041] public XssHttpServletRequestWrapper(HttpServletRequest request){

[0042] super(request);}.

[0043] Write a method called cleanXSS to filter illegal characters and filter and replace the requested parameters

[0044] Escape some characters, for example, replace the character ( with (; replace the character) with ); replace the character ' with '; replace " with "; replace the script characters javascript, onload, expression and other characters of javascript with empty strings. You can also write the characters to be replaced in the configuration file or database, then call and obtain them in the cleanXSS method, and then replace the requested characters, so that the character replacement is configurable.

[0045] The code is as follows:

[0046]

[0047]

[0048]

[0049] Rewrite the getParameterValues, getParameter, getHeader, getParameterMap and other methods of XssHttpServletRequestWrapper. Each method calls cleanXSS to filter the request parameters.

[0050] The code is as follows:

[0051]

[0052]

[0053]

[0054] Write a filter class XssFilter to implement the Filter interface, intercept all user requests, and use XssHttpServletRequestWrapper to wrap the request object in the doFilter method. When getting parameters from the request object in the future, the data with sensitive characters and illegal characters will be filtered.

[0055] The code is as follows:

[0056]

[0057]

[0058] Configure the filter XssFilter in web.xml so that XssFilter can intercept all requests.

[0059] <filter>

[0060] <filter-name> xssFilter< / filter-name>

[0061] <filter-class> com.test.XssFilter< / filter-class>

[0062] < / filter>

[0063] <filter-mapping>

[0064] <filter-name> xssFilter< / filter-name>

[0065] <url-pattern> / *< / url-pattern>

[0066] < / filter-mapping>

[0067] In this way, all HTTP requests will be intercepted by the filter xssFilter, and then the class XssHttpServletRequestWrapper will wrap the Request object and filter out special characters in all request parameters, thereby preventing XSS attacks.

[0068] Embodiment 2, based on embodiment 1, proposes a system for solving cross-site scripting attacks based on JAVA filter and HttpServletRequestWrapper wrapper class, the system comprising:

[0069] The wrapper class writing module is used to write the wrapper class XssHttpServletRequestWrapper; write a wrapper class XssHttpServletRequestWrapper that inherits HttpServletRequestWrapper and call the parent class's constructor in the constructor.

[0070] The parameter preprocessing module is used to write the method cleanXSS for filtering illegal characters, filter and replace the parameters of the request; escape the characters, for example, replace the character with (; replace the character with); replace the character ' with '; replace " with "; replace the script characters javascript, onload, and expression characters of javascript with empty strings; write the characters to be replaced in the configuration file or database, then call and obtain them in the cleanXSS method, and then replace the requested characters to make the character replacement configurable.

[0071] The parameter filtering module is used to filter request parameters; rewrite the getParameterValues, getParameter, getHeader, and getParameterMap methods of XssHttpServletRequestWrapper, and each method calls cleanXSS to filter request parameters.

[0072] The interface writing module is used to write the filter class XssFilter to implement the Filter interface; intercept all user requests, and use XssHttpServletRequestWrapper to wrap the request object in the doFilter method. When obtaining parameters from the request object in the future, data with sensitive characters and illegal characters are filtered.

[0073] The filter configuration module is used to configure the filter XssFilter in web.xml so that XssFilter can intercept all requests.

[0074] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for solving cross-site scripting attacks based on JAVA filter and HttpServletRequestWrapper packaging class, characterized in that: The method comprises the following steps: Write the wrapper class XssHttpServletRequestWrapper; Write a method called cleanXSS to filter illegal characters, and filter and replace the request parameters; Filter request parameters; Write the filter class XssFilter to implement the Filter interface; Configure the filter XssFilter in web.xml so that XssFilter can intercept all requests.

2. According to claim 1, a method for implementing a cross-site scripting attack based on a JAVA filter and an HttpServletRequestWrapper wrapper class, characterized in that: The specific operations of writing the wrapper class XssHttpServletRequestWrapper include: Write a wrapper class XssHttpServletRequestWrapper that inherits HttpServletRequestWrapper and call the constructor of the parent class in the constructor.

3. According to claim 1, a method for implementing a cross-site scripting attack based on a JAVA filter and an HttpServletRequestWrapper wrapper class, characterized in that: Write a method called cleanXSS to filter illegal characters. The specific operations for filtering and replacing the request parameters include: Escape characters, for example, replace characters with (; replace characters with); replace characters ' with '; replace " with "; replace script characters javascript, onload, expression characters of javascript with empty strings; write the characters to be replaced in the configuration file or database, then call and obtain them in the cleanXSS method, and then replace the requested characters to make character replacement configurable.

4. According to claim 1, a method for implementing a cross-site scripting attack based on a JAVA filter and an HttpServletRequestWrapper wrapper class, characterized in that: The specific operations for filtering request parameters include: Rewrite the getParameterValues, getParameter, getHeader, and getParameterMap methods of XssHttpServletRequestWrapper. Each method calls cleanXSS to filter the request parameters.

5. According to claim 1, a method for implementing a cross-site scripting attack based on a JAVA filter and an HttpServletRequestWrapper wrapper class, characterized in that: The specific operations of writing the filter class XssFilter to implement the Filter interface include: Intercept all user requests, use XssHttpServletRequestWrapper to wrap the request object in the doFilter method, and filter sensitive and illegal characters when getting parameters from the request object.

6. A method for implementing a cross-site scripting attack based on a JAVA filter and a HttpServletRequestWrapper wrapper class according to any one of claims 1 to 5, and a system for implementing a cross-site scripting attack based on a JAVA filter and a HttpServletRequestWrapper wrapper class, characterized in that: The system comprises: Wrapper class writing module, used to write the wrapper class XssHttpServletRequestWrapper; Parameter preprocessing module, used to write the method cleanXSS to filter illegal characters, and filter and replace the request parameters; Parameter filtering module, used to filter request parameters; The interface writing module is used to write the filter class XssFilter to implement the Filter interface; The filter configuration module is used to configure the filter XssFilter in web.xml so that XssFilter can intercept all requests.

7. According to claim 6, a system for implementing a method of solving cross-site scripting attacks based on JAVA filter and HttpServletRequestWrapper packaging class, characterized in that: Wrapper class writing module, write a wrapper class XssHttpServletRequestWrapper inherits HttpServletRequestWrapper, call the parent class's constructor in the constructor.

8. According to claim 6, a system for implementing a method of solving cross-site scripting attacks based on JAVA filter and HttpServletRequestWrapper packaging class, characterized in that: The parameter preprocessing module escapes characters, for example, replaces characters with (; replaces characters with); replaces characters ' with '; replaces " with "; replaces JavaScript script characters javascript, onload, and expression characters with empty strings; writes the characters to be replaced in the configuration file or database, then calls and obtains them in the cleanXSS method, and then replaces the requested characters, making character replacement configurable.

9. The implementation system for solving cross-site scripting attacks based on JAVA filter and HttpServletRequestWrapper packaging class according to claim 6 is characterized in that: The parameter filtering module rewrites the getParameterValues, getParameter, getHeader, and getParameterMap methods of XssHttpServletRequestWrapper. Each method calls cleanXSS to filter the request parameters.

10. The implementation system for solving cross-site scripting attacks based on JAVA filter and HttpServletRequestWrapper packaging class according to claim 6 is characterized in that: The interface writing module intercepts all user requests and uses XssHttpServletRequestWrapper to wrap the request object in the doFilter method. When obtaining parameters from the request object in the future, data with sensitive characters and illegal characters are filtered.

Images