springboot中防止sql注入 & 防止sql攻击

末蓝、 2022-05-20 03:45 695阅读 0赞

转自：[https://blog.csdn.net/jancislo/article/details/80847104][https_blog.csdn.net_jancislo_article_details_80847104]

#### 总结： ####

sql注入就是 在请求参数中传入sql的关键字   防止sql注入可以采用过滤器，替换掉请求中的关键字

#### 原文： ####

1.编写  XssHttpServletRequestWrapper

import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletRequestWrapper;
    
    public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
    
        public XssHttpServletRequestWrapper(HttpServletRequest servletRequest) {
            super(servletRequest);
        }
    
        public String[] getParameterValues(String parameter) {
            String[] values = super.getParameterValues(parameter);
            if (values==null)  {
                return null;
            }
            int count = values.length;
            String[] encodedValues = new String[count];
            for (int i = 0; i < count; i++) {
                encodedValues[i] = cleanXSS(values[i]);
            }
            return encodedValues;
        }
    
        /* 覆盖getParameter方法，将参数名和参数值都做xss过滤。
                * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取
                * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
        */
        public String getParameter(String parameter) {
            String value = super.getParameter(parameter);
            if (value == null) {
                return null;
            }
            return cleanXSS(value);
        }
    
        /**
         * 覆盖getHeader方法，将参数名和参数值都做xss过滤。
         * 如果需要获得原始的值，则通过super.getHeaders(name)来获取
         * getHeaderNames 也可能需要覆盖
         */
        public String getHeader(String name) {
            String value = super.getHeader(name);
            if (value == null)
                return null;
            return cleanXSS(value);
        }
        private String cleanXSS(String value) {
    
    
            //You'll need to remove the spaces from the html entities below
            value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");
            value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;");
            value = value.replaceAll("'", "& #39;");
            value = value.replaceAll("eval\\((.*)\\)", "");
            value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
            value = value.replaceAll("script", "");
            value = value.replaceAll("[*]","["+"*]");
            value = value.replaceAll("[+]","["+"+]");
            value = value.replaceAll("[?]","["+"?]");
    
    
            // replace sql 这里可以自由发挥
            String[] values = value.split(" ");
    
            String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|%|chr|mid|master|truncate|" +
                    "char|declare|sitename|net user|xp_cmdshell|;|or|-|+|,|like'|and|exec|execute|insert|create|drop|" +
                    "table|from|grant|use|group_concat|column_name|" +
                    "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|" +
                    "chr|mid|master|truncate|char|declare|or|;|-|--|,|like|//|/|%|#";
    
            String[] badStrs = badStr.split("\\|");
            for (int i = 0;i<badStrs.length;i++){
                for (int j = 0;j<values.length;j++){
                    if (values[j].equalsIgnoreCase(badStrs[i])){
                        values[j] = "forbid";
                    }
                }
            }
            StringBuilder sb = new StringBuilder();
            for (int i = 0;i<values.length;i++){
                if (i == values.length-1){
                    sb.append(values[i]);
                } else {
                    sb.append(values[i]+" ");
                }
            }
    
            value = sb.toString();
    
            return value;
        }
    
    }

2. XssFilter

import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    import javax.servlet.*;
    import javax.servlet.annotation.WebFilter;
    import javax.servlet.http.HttpServletRequest;
    import java.io.IOException;
    
    @WebFilter(urlPatterns = "/*")
    public class XssFilter implements Filter {
    
        private static final Logger logger = LoggerFactory.getLogger(XssFilter.class);
    
        FilterConfig filterConfig = null;
    
        @Override
        public void init(FilterConfig filterConfig) throws ServletException {
            this.filterConfig = filterConfig;
        }
    
        @Override
        public void destroy() {
            this.filterConfig = null;
        }
    
        @Override
        public void doFilter(ServletRequest request, ServletResponse response,
                             FilterChain chain) throws IOException, ServletException {
    
            logger.info("自定义过滤器->doFilter");
    
            chain.doFilter(new XssHttpServletRequestWrapper(
                    (HttpServletRequest) request), response);
        }
    }

3.在spring的启动类加注解

@ServletComponentScan
    public class InspectionApplication implements SchedulingConfigurer {

[https_blog.csdn.net_jancislo_article_details_80847104]: https://blog.csdn.net/jancislo/article/details/80847104