java - Struts 2 对输入参数进行编码以避免 XSS

Question

我有一个使用 Struts 2 构建的应用程序。它在跨站点脚本 (XSS) 攻击方面存在一些问题。我想以与 JSP 类似的方式对一些 Action 输入参数进行编码 <c:out value="${somevalue}"/>在 Struts 2 中有没有简单的方法可以做到这一点？ Java API 方法就可以了。

编辑我找到了这个 - http://www.owasp.org/index.php/Talk:How_to_perform_HTML_entity_encoding_in_Java

有什么经验吗？

Answer 1

你可以使用

<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn" %>

${fn:escapeXml(someValue)}

---

还有一个很好的 API JSoup

Sanitize untrusted HTML

Problem

You want to allow untrusted users to supply HTML for output on your website (e.g. as comment submission). You need to clean this HTML to avoid cross-site scripting (XSS) attacks.

Solution

Use the jsoup HTML Cleaner with a configuration specified by a Whitelist.

String unsafe = 
      "<p><a href='http://example.com/' onclick='stealCookies()'>Link</a></p>";
String safe = Jsoup.clean(unsafe, Whitelist.basic());
      // now: <p><a href="http://example.com/" rel="nofollow">Link</a></p>

因此，您基本上需要做的就是在处理提交的文本期间执行以下操作:

String text = request.getParameter("text");
String safe = Jsoup.clean(text, Whitelist.basic());
// Persist 'safe' in DB instead.

---

有struts2securityaddons

This project contains additional configuration, interceptors, and other code used to improve the security of struts 2 applications.

另见

• XSS Prevention oin Java
• Prevent jsp from XSS
• struts2securityaddons