XXS攻击，HTML代码注入

时间:2019-03-12
本文章向大家介绍XXS攻击，HTML代码注入，主要包括XXS攻击，HTML代码注入使用实例、应用技巧、基本知识点总结和需要注意事项，具有一定的参考价值，需要的朋友可以参考一下。

       针对现在很多企业级开发的同学，避免不了页面进行编辑，或者评论，或者是富文本编辑等操作，只要涉及到这些操作，就要防止非法入侵，下面可以分享一下自己在开发中遇到的这种情况，直接上工具类：

package com.***.****.admin.utils;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

public class DelHtmlTagUtils {

    // 普通输入框的过滤
    public static String delHTMLTag(String htmlStr) {
        if (htmlStr != null && htmlStr.length() > 0) {
            String regExscript = "<script[^>]*?>[\\s\\S]*?<\\/script>"; // 定义script的正则表达式
            String regExstyle = "<style[^>]*?>[\\s\\S]*?<\\/style>"; // 定义style的正则表达式
            String regExHtml = "&lt;script.*?&gt;.*?&lt;/script&gt;"; // 定义转义后script标签的正则表达式
            String regExHtml1 = "&lt;script.*?&gt;"; // 定义转义后script标签的正则表达式
            String regExHtml2 = "&lt;/script&gt;"; // 定义转义后script标签的正则表达式
            String regExHtml3 = "script"; // 定义转义后script标签的正则表达式
            String regExHtml4 = "javascript";
            String regExHtml5 = "eval\\((.*)\\)";
            String regExHtml6 = "<[^>]+>";
            String regExHtml7 = "<>";
            String regExHtml8 = "src[\r\n]*=[\r\n]*\\\'(.*?)\\\'";
            String regExHtml10 = "&lt;[^>]*on.*?&gt;";
            String regExHtml11 = "&lt;/[^>]*on.*&gt;";
            String regExHtml13 = "<a[^>]*?>[\\s\\S]*?<\\/a>";
            String regExHtml14 = "<iframe[^>]*?>[\\s\\S]*?<\\/iframe>";
            String regExHtml15 = "&lt;a.*?&gt;.*?&lt;/a&gt;"; // 定义转义后script标签的正则表达式
            String regExHtml16 = "&lt;iframe.*?&gt;.*?&lt;/iframe&gt;";

            Pattern pScript = Pattern.compile(regExscript, Pattern.CASE_INSENSITIVE);
            Matcher mScript = pScript.matcher(htmlStr);
            htmlStr = mScript.replaceAll(""); // 过滤

            Pattern pStyle = Pattern.compile(regExstyle, Pattern.CASE_INSENSITIVE);
            Matcher mStyle = pStyle.matcher(htmlStr);
            htmlStr = mStyle.replaceAll(""); // 过滤style标签

            Pattern pHtml = Pattern.compile(regExHtml, Pattern.CASE_INSENSITIVE);
            Matcher mHtml = pHtml.matcher(htmlStr);
            htmlStr = mHtml.replaceAll(""); // 过滤转义后script标签

            Pattern pHtml1 = Pattern.compile(regExHtml1, Pattern.CASE_INSENSITIVE);
            Matcher mHtml1 = pHtml1.matcher(htmlStr);
            htmlStr = mHtml1.replaceAll(""); // 过滤转义后script标签

            Pattern pHtml2 = Pattern.compile(regExHtml2, Pattern.CASE_INSENSITIVE);
            Matcher mHtml2 = pHtml2.matcher(htmlStr);
            htmlStr = mHtml2.replaceAll(""); // 过滤转义后script标签

            Pattern pHtml3 = Pattern.compile(regExHtml3, Pattern.CASE_INSENSITIVE);
            Matcher mHtml3 = pHtml3.matcher(htmlStr);
            htmlStr = mHtml3.replaceAll(""); // 过滤script标签

            Pattern pHtml4 = Pattern.compile(regExHtml4, Pattern.CASE_INSENSITIVE);
            Matcher mHtml4 = pHtml4.matcher(htmlStr);
            htmlStr = mHtml4.replaceAll(""); // 过滤javascript标签

            Pattern pHtml5 = Pattern.compile(regExHtml5, Pattern.CASE_INSENSITIVE);
            Matcher mHtml5 = pHtml5.matcher(htmlStr);
            htmlStr = mHtml5.replaceAll(""); // 过滤eval标签

            Pattern pHtml6 = Pattern.compile(regExHtml6, Pattern.CASE_INSENSITIVE);
            Matcher mHtml6 = pHtml6.matcher(htmlStr);
            htmlStr = mHtml6.replaceAll(""); // 过滤html标签

            Pattern pHtml7 = Pattern.compile(regExHtml7, Pattern.CASE_INSENSITIVE);
            Matcher mHtml7 = pHtml7.matcher(htmlStr);
            htmlStr = mHtml7.replaceAll(""); // 过滤html标签

            Pattern pHtml8 = Pattern.compile(regExHtml8, Pattern.CASE_INSENSITIVE);
            Matcher mHtml8 = pHtml8.matcher(htmlStr);
            htmlStr = mHtml8.replaceAll(""); // 过滤html标签

            Pattern pHtml10 = Pattern.compile(regExHtml10, Pattern.CASE_INSENSITIVE);
            Matcher mHtml10 = pHtml10.matcher(htmlStr);
            htmlStr = mHtml10.replaceAll("");

            Pattern pHtml11 = Pattern.compile(regExHtml11, Pattern.CASE_INSENSITIVE);
            Matcher mHtml11 = pHtml11.matcher(htmlStr);
            htmlStr = mHtml11.replaceAll("");

            Pattern pHtml13 = Pattern.compile(regExHtml13, Pattern.CASE_INSENSITIVE);
            Matcher mHtml13 = pHtml13.matcher(htmlStr);
            htmlStr = mHtml13.replaceAll("");

            Pattern pHtml14 = Pattern.compile(regExHtml14, Pattern.CASE_INSENSITIVE);
            Matcher mHtml14 = pHtml14.matcher(htmlStr);
            htmlStr = mHtml14.replaceAll("");

            Pattern pHtml15 = Pattern.compile(regExHtml15, Pattern.CASE_INSENSITIVE);
            Matcher mHtml15 = pHtml15.matcher(htmlStr);
            htmlStr = mHtml15.replaceAll("");

            Pattern pHtml16 = Pattern.compile(regExHtml16, Pattern.CASE_INSENSITIVE);
            Matcher mHtml16 = pHtml16.matcher(htmlStr);
            htmlStr = mHtml16.replaceAll("");

            return htmlStr.trim(); // 返回文本字符串
        } else {
            return htmlStr;
        }

    }

    // 富文本框的过滤
    public static String delHTMLTag2(String htmlStr) {
        if (htmlStr != null && htmlStr.length() > 0) {
            String regExscript = "<script[^>]*?>[\\s\\S]*?<\\/script>"; // 定义script的正则表达式
            String regExstyle = "<style[^>]*?>[\\s\\S]*?<\\/style>"; // 定义style的正则表达式
            String regExHtml = "&lt;script.*?&gt;.*?&lt;/script&gt;"; // 定义转义后script标签的正则表达式
            String regExHtml1 = "&lt;script.*?&gt;"; // 定义转义后script标签的正则表达式
            String regExHtml2 = "&lt;/script&gt;"; // 定义转义后script标签的正则表达式
            String regExHtml3 = "script"; // 定义转义后script标签的正则表达式
            String regExHtml4 = "javascript";
            String regExHtml5 = "eval\\((.*)\\)";
            String regExHtml6 = "&lt;[^>]*java.*?&gt;";
            String regExHtml7 = "&lt;/[^>]*java.*?&gt;";
            String regExHtml8 = "<on[^>]*?>[\\s\\S]*?<\\/on>";
            String regExHtml9 = "<java[^>]*?>[\\s\\S]*?<\\/java>";
            String regExHtml10 = "&lt;[^>]*on.*?&gt;";
            String regExHtml11 = "&lt;/[^>]*on.*&gt;";
            String regExHtml12 = "&lt;java.*?&gt;.*?&lt;/java&gt;";
            String regExHtml13 = "<a[^>]*?>[\\s\\S]*?<\\/a>";
            String regExHtml14 = "<iframe[^>]*?>[\\s\\S]*?<\\/iframe>";
            String regExHtml15 = "&lt;a.*?&gt;.*?&lt;/a&gt;"; // 定义转义后script标签的正则表达式
            String regExHtml16 = "&lt;iframe.*?&gt;.*?&lt;/iframe&gt;";

            Pattern pScript = Pattern.compile(regExHtml9, Pattern.CASE_INSENSITIVE);
            Matcher mScript = pScript.matcher(htmlStr);
            htmlStr = mScript.replaceAll(""); // 过滤

            Pattern pStyle = Pattern.compile(regExstyle, Pattern.CASE_INSENSITIVE);
            Matcher mStyle = pStyle.matcher(htmlStr);
            htmlStr = mStyle.replaceAll(""); // 过滤style标签

            Pattern pHtml = Pattern.compile(regExHtml, Pattern.CASE_INSENSITIVE);
            Matcher mHtml = pHtml.matcher(htmlStr);
            htmlStr = mHtml.replaceAll(""); // 过滤转义后script标签

            Pattern pHtml1 = Pattern.compile(regExHtml1, Pattern.CASE_INSENSITIVE);
            Matcher mHtml1 = pHtml1.matcher(htmlStr);
            htmlStr = mHtml1.replaceAll(""); // 过滤转义后script标签

            Pattern pHtml2 = Pattern.compile(regExHtml2, Pattern.CASE_INSENSITIVE);
            Matcher mHtml2 = pHtml2.matcher(htmlStr);
            htmlStr = mHtml2.replaceAll(""); // 过滤转义后script标签

            Pattern pHtml3 = Pattern.compile(regExHtml3, Pattern.CASE_INSENSITIVE);
            Matcher mHtml3 = pHtml3.matcher(htmlStr);
            htmlStr = mHtml3.replaceAll(""); // 过滤script标签

            Pattern pHtml4 = Pattern.compile(regExHtml4, Pattern.CASE_INSENSITIVE);
            Matcher mHtml4 = pHtml4.matcher(htmlStr);
            htmlStr = mHtml4.replaceAll(""); // 过滤javascript标签

            Pattern pHtml5 = Pattern.compile(regExHtml5, Pattern.CASE_INSENSITIVE);
            Matcher mHtml5 = pHtml5.matcher(htmlStr);
            htmlStr = mHtml5.replaceAll(""); // 过滤eval标签

            Pattern pHtml6 = Pattern.compile(regExHtml6, Pattern.CASE_INSENSITIVE);
            Matcher mHtml6 = pHtml6.matcher(htmlStr);
            htmlStr = mHtml6.replaceAll(""); // 过滤转义后的javascript标签

            Pattern pHtml7 = Pattern.compile(regExHtml7, Pattern.CASE_INSENSITIVE);
            Matcher mHtml7 = pHtml7.matcher(htmlStr);
            htmlStr = mHtml7.replaceAll(""); // 过滤转义后的javascript标签

            Pattern pHtml8 = Pattern.compile(regExHtml8, Pattern.CASE_INSENSITIVE);
            Matcher mHtml8 = pHtml8.matcher(htmlStr);
            htmlStr = mHtml8.replaceAll(""); // 过滤on标签

            Pattern pHtml9 = Pattern.compile(regExscript, Pattern.CASE_INSENSITIVE);
            Matcher mHtml9 = pHtml9.matcher(htmlStr);
            htmlStr = mHtml9.replaceAll("");

            Pattern pHtml10 = Pattern.compile(regExHtml10, Pattern.CASE_INSENSITIVE);
            Matcher mHtml10 = pHtml10.matcher(htmlStr);
            htmlStr = mHtml10.replaceAll("");

            Pattern pHtml11 = Pattern.compile(regExHtml11, Pattern.CASE_INSENSITIVE);
            Matcher mHtml11 = pHtml11.matcher(htmlStr);
            htmlStr = mHtml11.replaceAll("");

            Pattern pHtml12 = Pattern.compile(regExHtml12, Pattern.CASE_INSENSITIVE);
            Matcher mHtml12 = pHtml12.matcher(htmlStr);
            htmlStr = mHtml12.replaceAll("");

            Pattern pHtml13 = Pattern.compile(regExHtml13, Pattern.CASE_INSENSITIVE);
            Matcher mHtml13 = pHtml13.matcher(htmlStr);
            htmlStr = mHtml13.replaceAll("");

            Pattern pHtml14 = Pattern.compile(regExHtml14, Pattern.CASE_INSENSITIVE);
            Matcher mHtml14 = pHtml14.matcher(htmlStr);
            htmlStr = mHtml14.replaceAll("");

            Pattern pHtml15 = Pattern.compile(regExHtml15, Pattern.CASE_INSENSITIVE);
            Matcher mHtml15 = pHtml15.matcher(htmlStr);
            htmlStr = mHtml15.replaceAll("");

            Pattern pHtml16 = Pattern.compile(regExHtml16, Pattern.CASE_INSENSITIVE);
            Matcher mHtml16 = pHtml16.matcher(htmlStr);
            htmlStr = mHtml16.replaceAll("");

            return htmlStr.trim(); // 返回文本字符串
        } else {
            return htmlStr;
        }

    }
}

上面是一个我们写的一个工具类，直接调用在前端输入框可以过滤掉工具类中有写的js，script标签等

下面的工具类也可以复用，具体根据你们自己的业务需求去更改

 

package ***.***.***.util;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

/**
 * 
 * @author guoyunlong
 * @since 2019-3-12
 * @version 0.0.1
 */
public class HTMLUtils {

/**
 * 过滤所有HTML 标签
 * @param htmlStr
 * @return
 */
public static String filterHTMLTag(String htmlStr) {


    //定义HTML标签的正则表达式 
    String reg_html="<[^>]+>"; 
    Pattern pattern=Pattern.compile(reg_html,Pattern.CASE_INSENSITIVE); 
    Matcher matcher=pattern.matcher(htmlStr); 
    htmlStr=matcher.replaceAll(""); //过滤html标签 
    return htmlStr;
}

/**
 * 过滤标签，通过标签名
 * @param htmlStr
 * @param tagName
 * @return
 */
public static String filterTagByName(String htmlStr,String tagName) {
    String reg_html="<"+tagName+"[^>]*?>[\\s\\S]*?<\\/"+tagName+">";
    Pattern pattern=Pattern.compile(reg_html,Pattern.CASE_INSENSITIVE); 
    Matcher matcher=pattern.matcher(htmlStr); 
    htmlStr=matcher.replaceAll(""); //过滤html标签 
    return htmlStr;
}

/**
 * 过滤标签上的 style 样式
 * @param htmlStr
 * @return
 */
public static String filterHTMLTagInStyle(String htmlStr) {
    String reg_html="style=('|\")(.*?)('|\")";
    Pattern pattern=Pattern.compile(reg_html,Pattern.CASE_INSENSITIVE); 
    Matcher matcher=pattern.matcher(htmlStr); 
    htmlStr=matcher.replaceAll(""); //过滤html标签 
    return htmlStr;
}

/**
 * 替换表情
 * @param htmlStr
 * @param tagName
 * @return
 */
public static String replayFace(String htmlStr) {
    String reg_html="\\[em_\\d{1,}\\]";
    Pattern pattern =Pattern.compile(reg_html,Pattern.CASE_INSENSITIVE); 
    Matcher matcher=pattern.matcher(htmlStr);
    if(matcher.find()) {
        matcher.reset();
        while(matcher.find()) {
            String num = matcher.group(0);
            String number=num.substring(num.lastIndexOf('_')+1, num.length()-1);
            htmlStr = htmlStr.replace(num, "<img src='/face/arclist/"+number+".gif' border='0' />");
        }
    }
    return htmlStr;
}

    public static void main(String[] args) {
        String html = "<script>alert('test');</script><img src='/face/arclist/5.gif' border='0' /><div style='position:fixs;s'></div><style>body{color:#fff;}</style><Style>body{color:#fff;}</Style><STYLE>body{color:#fff;}</STYLE>";
        System.out.println("html="+html);
        html = HTMLUtils.filterTagByName(html, "style");
        System.out.println("html="+html);
        html = HTMLUtils.filterTagByName(html, "script");
        System.out.println("html="+html);
        html = HTMLUtils.filterHTMLTagInStyle(html);
        System.out.println("html="+html);
    }

}

 

随机文章
WEB前端知识点必读
最近更新