程序里用了setAttribute(Stirng name, Object o)方法，如何对这个方法做xss处理

Question

程序里用了setAttribute(Stirng name, Object o)方法，如何对这个方法做xss处理,下面是我的代码，请问各位如何对这个方法做xss处理

import java.util.regex.Pattern;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
 
public class XSSRequestWrapper extends HttpServletRequestWrapper {
 
    public XSSRequestWrapper(HttpServletRequest servletRequest) {
        super(servletRequest);
    }
  
  @Override
    public void setAttribute(String name , Object o) {
        super.setAttribute(name, o);
    }
 
    private String stripXSS(String value) {
        if (value != null) {
           
            value = value.replaceAll("", "");
 
            
            Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
 
            
            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
 
            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
 
            
            scriptPattern = Pattern.compile("</script>", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
 
            
            scriptPattern = Pattern.compile("<script(.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
 
            
            scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
 
            
            scriptPattern = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
 
            
            scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
 
         
            scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
 
            scriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
        }
        return value;
    }
 
}
 

Answer 1

参考GPT和自己的思路：你的代码是实现一个自定义的HttpServletRequestWrapper，用于在setAttrubute()方法中对传入的参数进行XSS处理。具体来说，stripXSS()方法使用了一系列正则表达式，去掉了一些可能会造成XSS漏洞的字符或脚本。然后，在setAttribute()方法内部，调用super.setAttribute()方法之前，先调用stripXSS()方法对传入的Object o参数进行处理，确保不会存在XSS漏洞。同时需要注意的是，这个方法仅仅是对setAttribute()方法做了XSS防御，并不适用于所有的用户输入场景。在实际开发中，还需要结合其他技术手段进行XSS漏洞防御。