网站XSS安全的漏洞问题如何解决

Question

我在测试自己网站http://www.xxx.com/">alert(55) 敲这样一个链接会弹窗 查询了一下应该是存在XSS漏洞吧 求大神告知该如何修复呢

Answer 1

配起来有点麻烦，大概就下面的思路，你在网上找找吧

[#escape x as htmlEnc(x)]
[/#escape]

 public class HtmlEncFunction implements TemplateMethodModel {

    private static final String EMPTY = "";

    /**
     * 
     * 特殊字符转义.
     * 
     * @see freemarker.template.TemplateMethodModel#exec(java.util.List)
     */
    @Override
    public Object exec(List arguments) throws TemplateModelException {
        String result = EMPTY;
        if (CollectionUtils.isNotEmpty(arguments)) {
            Object param = arguments.get(0);
            if (param instanceof String) {
                result = (String) param;
                if (StringUtils.isNotBlank(result)) {
                    result = ESAPI.encoder().encodeForHTML(result);
                }
            }
        }
        return result;
    }

    public static String cleanXSS(String value) {
        if (StringUtils.isNotBlank(value)){
            value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");
            value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "&#41;");
            value = value.replaceAll("'", "& #39;");
            value = value.replaceAll("eval\\((.*)\\)", "");
            value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']",
                    "\"\"");
            value = value.replaceAll("script", "");
        }
        return value;
    }
}