Struts2修复xss***

时间 2020-04-03

原文原文链接

概述

struts版本：2.3.4.1
tomcat版本：6tomcat

第一种修复方法

参考文章：https://yq.aliyun.com/articles/7126 （不过安全按照该方法没法修复，只能参考思路）安全

重写StrutsPrepareAndExecuteFilter，注册自定义Dispatcher服务器

public class MStrutsPrepareAndExecuteFilter extends
    StrutsPrepareAndExecuteFilter {
@Override
public void init(FilterConfig filterConfig) throws ServletException {
    InitOperations init = new InitOperations();
    try {
        FilterHostConfig config = new FilterHostConfig(filterConfig);
        init.initLogging(config);
        Dispatcher dispatcher = initDispatcher(config);
        init.initStaticContentLoader(config, dispatcher);

        prepare = new PrepareOperations(filterConfig.getServletContext(), dispatcher);
        execute = new ExecuteOperations(filterConfig.getServletContext(), dispatcher);
        this.excludedPatterns = init.buildExcludedPatternsList(dispatcher);

        postInit(dispatcher, filterConfig);
    } finally {
        init.cleanup();
    }

}
/**
 * Creates and initializes the dispatcher
 */
public Dispatcher initDispatcher( HostConfig filterConfig ) {
    Dispatcher dispatcher = createDispatcher(filterConfig);
    dispatcher.init();
    return dispatcher;
}
/**
 * Create a {@link Dispatcher}
 */
private Dispatcher createDispatcher(HostConfig filterConfig) {
    Map<String, String> params = new HashMap<String, String>();
    for (Iterator e = filterConfig.getInitParameterNames(); e.hasNext();) {
        String name = (String) e.next();
        String value = filterConfig.getInitParameter(name);
        params.put(name, value);
    }
    return new MDispatcher(filterConfig.getServletContext(), params);
}

写自定义Dispatcher，继承Dispatcher，重写createContextMap方法，将 Map params = new HashMap(request.getParameterMap());改行修改成 Map params = new HashMap(new ParamFormatWarp(request).getParameterMap());

ParamFormatWarp类参考以下app

public class ParamFormatWarp extends HttpServletRequestWrapper {

public ParamFormatWarp(HttpServletRequest request) {
    super(request);
}

private String clearXss(String value) {
    if (value == null || "".equals(value)) {
        return value;
    }
    value = stripXSSAndSql(value);
    return value;
}
/** 
 *  
 * 防止xss跨脚本***（替换，根据实际状况调整） 
 */  

public  String stripXSSAndSql(String value) {  
    if (value != null) {  
        Pattern scriptPattern = Pattern.compile("<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>", Pattern.CASE_INSENSITIVE);  
        value = scriptPattern.matcher(value).replaceAll("");  

    }  
    return value;  
}  
@Override
public Map getParameterMap() {  
    HashMap paramMap = (HashMap) super.getParameterMap();  
    paramMap = (HashMap) paramMap.clone();  
    for (Iterator iterator = paramMap.entrySet().iterator(); iterator.hasNext(); ) {  
        Map.Entry  entry = (Map.Entry ) iterator.next();  
        String [] values =(String[])entry.getValue();  
        for (int i = 0; i < values.length; i++) {  
            if(values[i] instanceof String){  
                values[i] = clearXss(values[i]);  
            }  
        }  
        entry.setValue(values);  
    }  
    return paramMap;  
}  
}

上面这种修改方法有可能在其余应用服务器下有问题，如http://zydky.iteye.com/blog/558973 ，我未测试，若有问题可按照以下方式过滤getParameterMap获取的map http://blog.csdn.net/aeroleo/article/details/52204789 xss

第二种方法

参照：http://blog.csdn.net/huplion/article/details/49001151 和
http://blog.csdn.net/huplion/article/details/49000309 必定要两个连接一块儿看，不然不起做用，另外有一处代码记得按照以下修改：ide

Map<String, Object> map = inaction.getParameters();
        for (Map.Entry<String, Object> entry : map.entrySet()) {
            String[] values = ((String[]) (entry.getValue()));
            for (int i = 0; i < values.length; i++) {
                values[i]=XssUtil.clearXss(values[i]);
            }
            entry.setValue(values);
        }

为何存在values[[]，有可能请求的连接是url?t=1&t=2&t=3 post