public class AntiXSS {
/**
* 濾除content中的危險 HTML 代碼, 主要是腳本代碼, 滾動字幕代碼以及腳本事件處理代碼
*
* @param content
* 需要濾除的字元串
* @return 過濾的結果
*/
public static String replaceHtmlCode(String content) {
if (null == content) {
return null;
}
if (0 == content.length()) {
return "";
}
// 需要濾除的腳本事件關鍵字
String[] eventKeywords = { "onmouseover", "onmouseout", "onmousedown",
"onmouseup", "onmousemove", "onclick", "ondblclick",
"onkeypress", "onkeydown", "onkeyup", "ondragstart",
"onerrorupdate", "onhelp", "onreadystatechange", "onrowenter",
"onrowexit", "onselectstart", "onload", "onunload",
"onbeforeunload", "onblur", "onerror", "onfocus", "onresize",
"onscroll", "oncontextmenu", "alert" };
content = replace(content, "<script", "<script", false);
content = replace(content, "</script", "</script", false);
content = replace(content, "<marquee", "<marquee", false);
content = replace(content, "</marquee", "</marquee", false);
content = replace(content, "'", "_", false);// 将單引号替換成下劃線
content = replace(content, "\"", "_", false);// 将雙引号替換成下劃線
// 濾除腳本事件代碼
for (int i = 0; i < eventKeywords.length; i++) {
content = replace(content, eventKeywords[i],
"_" + eventKeywords[i], false); // 添加一個"_", 使事件代碼無效
}
return content;
}
/**
* 将字元串 source 中的 oldStr 替換為 newStr, 并以大小寫敏感方式進行查找
*
* @param source
* 需要替換的源字元串
* @param oldStr
* 需要被替換的老字元串
* @param newStr
* 替換為的新字元串
*/
private static String replace(String source, String oldStr, String newStr) {
return replace(source, oldStr, newStr, true);
}
/**
* 将字元串 source 中的 oldStr 替換為 newStr, matchCase 為是否設定大小寫敏感查找
*
* @param source
* 需要替換的源字元串
* @param oldStr
* 需要被替換的老字元串
* @param newStr
* 替換為的新字元串
* @param matchCase
* 是否需要按照大小寫敏感方式查找
*/
private static String replace(String source, String oldStr, String newStr,
boolean matchCase) {
if (source == null) {
return null;
}
// 首先檢查舊字元串是否存在, 不存在就不進行替換
if (source.toLowerCase().indexOf(oldStr.toLowerCase()) == -1) {
return source;
}
int findStartPos = 0;
int a = 0;
while (a > -1) {
int b = 0;
String str1, str2, str3, str4, strA, strB;
str1 = source;
str2 = str1.toLowerCase();
str3 = oldStr;
str4 = str3.toLowerCase();
if (matchCase) {
strA = str1;
strB = str3;
} else {
strA = str2;
strB = str4;
}
a = strA.indexOf(strB, findStartPos);
if (a > -1) {
b = oldStr.length();
findStartPos = a + b;
StringBuffer bbuf = new StringBuffer(source);
source = bbuf.replace(a, a + b, newStr) + "";
// 新的查找開始點位于替換後的字元串的結尾
findStartPos = findStartPos + newStr.length() - b;
}
}
return source;
}
public static void main(String [] args){
//String str = "./fabu-advSousuo.jsp?userName=xxx<script>alert(123);</script>&password=yyy";
String str= "http://192.168.63.87:7001/xxx/xxxx/fabu-search.jsp?searchText=<script>alert('11');</script>";
System.out.println(AntiXSS.replaceHtmlCode(str));
}
}