[JAVA]Filter XSS Cross-Site Scripting (XSS) 필터

Filter XSS Cross-Site Scripting (XSS) 필터

Cross-Site Scripting (XSS)에대한 방어책은 다양하게 많지만, 그 방어책 중에 하나인 필터를 활용하는 방법을 공유합니다. 

참고 소스인 com.josephoconnell.html.HTMLInputFilter.class를 활용한 필터를 만들어 봤습니다. 

보안 위협 요소중의 하나인 Cross-Site Scripting (XSS) 에 대한 대비책으로 활용할 만합니다. 

1. 참조 필터

- 참조 클래스 : com.josephoconnell.html.HTMLInputFilter.class

2. HTMLinputFilter을 활용한 필터 샘플 소스

- RequestWrapper 클래스 

package client;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;

import com.josephoconnell.html.HTMLInputFilter;

public class RequestWrapper extends HttpServletRequestWrapper {

public RequestWrapper(HttpServletRequest servletRequest){

super(servletRequest); 

}

public String[] getParameterValues(String parameter){

String[] values = super.getParameterValues(parameter);

if(values == null){

return null;

}

int count = values.length;

String[] encodedValues = new String[count];

for(int i = 0; i < count; i++){

encodedValues[i] = filter(values[i]);

}

return encodedValues;

}

public String getParameter(String parameter){

String value = super.getParameter(parameter);

if(value == null){

return null;

}

return filter(value);

}

public String filter(String input){

if(input == null){

return null;

}

String clean = new HTMLInputFilter().filter(input.replaceAll("\"", "%22").

replaceAll("\'","%27"));

return clean.replaceAll("<", "%3C").replaceAll(">", "%3E");

}

}

- XssFilter 클래스

package client;

import java.io.IOException;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

public class XssFilter implements Filter {

private FilterConfig fc;

public void destroy(){

this.fc = null;

}

public void doFilter(ServletRequest req, ServletResponse resp,FilterChain chain)                             throws IOException, ServletException {

chain.doFilter(new RequestWrapper((HttpServletRequest) req), resp);

}

public void init(FilterConfig fc) throws ServletException {

this.fc = fc;

}

}

3. web.xml 필터 적용

<FILTER>  

    <FILTER-NAME>XSS</FILTER-NAME>  

    <DISPLAY-NAME>XSS</DISPLAY-NAME>  

    <DESCRIPTION></DESCRIPTION>  

    <FILTER-CLASS>client.XssFilter</FILTER-CLASS>  

</FILTER>  

<FILTER-MAPPING>  

    <FILTER-NAME>XSS</FILTER-NAME>  

    <URL-PATTERN>/*</URL-PATTERN>  

</FILTER-MAPPING>