git-svn-id: https://192.168.57.71/svn/jsgkj@1833 931142cf-59ea-a443-aa0e-51397b428577

gkoa/trunk/gkoa/src/com/xtframe/core/filter/XssFilter.java

@@ -0,0 +1,28 @@
+package com.xtframe.core.filter;
+import java.io.IOException;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+
+public class XssFilter implements Filter {
+    FilterConfig filterConfig = null;
+
+    public void init(FilterConfig filterConfig) throws ServletException {
+        this.filterConfig = filterConfig;
+    }
+
+    public void destroy() {
+        this.filterConfig = null;
+    }
+
+    public void doFilter(ServletRequest request, ServletResponse response,
+            FilterChain chain) throws IOException, ServletException {
+        chain.doFilter(new XssHttpServletRequestWrapper(
+                (HttpServletRequest) request), response);
+    }
+}

gkoa/trunk/gkoa/src/com/xtframe/core/filter/XssHttpServletRequestWrapper.java

@@ -0,0 +1,46 @@
+package com.xtframe.core.filter;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
+
+public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {  
+    public XssHttpServletRequestWrapper(HttpServletRequest servletRequest) {
+        super(servletRequest);
+    }
+    public String[] getParameterValues(String parameter) {
+      String[] values = super.getParameterValues(parameter);
+      if (values==null)  {
+                  return null;
+          }
+      int count = values.length;
+      String[] encodedValues = new String[count];
+      for (int i = 0; i < count; i++) {
+                 encodedValues[i] = cleanXSS(values[i]);
+       }
+      return encodedValues;
+    }
+    public String getParameter(String parameter) {
+          String value = super.getParameter(parameter);
+          if (value == null) {
+                 return null;
+                  }
+          return cleanXSS(value);
+    }
+    public String getHeader(String name) {
+        String value = super.getHeader(name);
+        if (value == null)
+            return null;
+        return cleanXSS(value);
+    }
+    private String cleanXSS(String value) {
+                //You'll need to remove the spaces from the html entities below
+        value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");
+        //value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;");
+        //value = value.replaceAll("'", "& #39;");
+        value = value.replaceAll("eval\\((.*)\\)", "");
+        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
+        value = value.replaceAll("script", "");
+        value = value.replaceAll("%", "\\\\u0025");
+        return value;
+    }
+
+}