java ssm框架xss 过滤

后台部分：

web.xml

<!-- xss过滤 -->
	<filter>
		<display-name>IllegalCharacterFilter</display-name>
		<filter-name>IllegalCharacterFilter</filter-name>
		<filter-class>
			com.hunuo.filter.IllegalCharacterFilter
		</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>IllegalCharacterFilter</filter-name>
		<url-pattern>/web/saveLeaveMsg</url-pattern>
	</filter-mapping>
	<!-- Shiro filter end -->

Controller

package com.xxx.filter;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {

    HttpServletRequest orgRequest = null;

    public XssHttpServletRequestWrapper(HttpServletRequest request) {
        super(request);
        orgRequest = request;
    }

    /**
     * 覆盖getParameter方法，将参数名和参数值都做xss过滤。<br/>
     * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>
     * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
     */
    @Override
    public String getParameter(String name) {
        String value = super.getParameter(xssEncode(name));
        if (value != null) {
            value = xssEncode(value);
        }
        return value;
    }

    /**
     * 覆盖getHeader方法，将参数名和参数值都做xss过滤。<br/>
     * 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/>
     * getHeaderNames 也可能需要覆盖
     */
    @Override
    public String getHeader(String name) {

        String value = super.getHeader(xssEncode(name));
        if (value != null) {
            value = xssEncode(value);
        }
        return value;
    }

    /**
     * 将容易引起xss漏洞的半角字符直接替换成全角字符
     *
     * @param s
     * @return
     */
    private static String xssEncode(String s) {
        if (s == null || s.isEmpty()) {
            return s;
        }
        StringBuilder sb = new StringBuilder(s.length() + 16);
        for (int i = 0; i < s.length(); i++) {
            char c = s.charAt(i);
            switch (c) {
                case '>':
                    sb.append("＞");// 转义大于号
                    break;
                case '<':
                    sb.append("＜");// 转义小于号
                    break;
                case '\'':
                    sb.append("＇");// 转义单引号
                    break;
                case '\"':
                    sb.append("＂");// 转义双引号
                    break;
                case '&':
                    sb.append("＆");// 转义&
                    break;
                case '@':
                    sb.append("＠");// 转义@
                    break;
                case '%':
                    sb.append("％");// 转义%
                    break;
                case '(':
                    sb.append("（");// 转义(
                    break;
                case ')':
                    sb.append("）");// 转义)
                    break;
                case ',':
                    sb.append("，");// 转义,
                    break;
                case '.':
                    sb.append("。");// 转义.
                    break;
                case ';':
                    sb.append("；");// 转义;
                    break;
                case '|':
                    sb.append("｜");// 转义|
                    break;
                default:
                    sb.append(c);
                    break;
            }
        }
        return sb.toString();
    }

    /**
     * 获取最原始的request
     *
     * @return
     */
    public HttpServletRequest getOrgRequest() {
        return orgRequest;
    }

    /**
     * 获取最原始的request的静态方法
     *
     * @return
     */
    public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
        if (req instanceof XssHttpServletRequestWrapper) {
            return ((XssHttpServletRequestWrapper) req).getOrgRequest();
        }

        return req;
    }

}

package com.xxx.filter;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;


public class IllegalCharacterFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
                         FilterChain chain) throws IOException, ServletException {

        XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(
                (HttpServletRequest) request);
        chain.doFilter(xssRequest, response);
    }

    @Override
    public void destroy() {
    }
}

前端部分：

function check_xss2(value) {
    var falg = true;
    var isValid;
    if(value!="" && value!=null){
        //".*/.*",'.*<>.*','.*".*','.*;.*','.*,.*',".*'.*",
        var arr = [".*/.*",'.*<>.*','.*".*','.*;.*','.*,.*',".*'.*",'.*script.*', '.*svg.*','.*alert.*','.*confirm.*','.*prompt.*',
            '.*onfocus.*','.*onload.*','.*onerror.*','.*xss.*']
        for (var i = 0; i < arr.length; i++) {
            isValid=value.match(arr[i]);
            if(null!=isValid){
                console.log(value)
                falg=false;
                break;
            }
        }
    }
    return falg;
}

html调用

if(!check_xss2($("#SKIP").val())){
                alert('请勿输入违法字符');
                return false;
            }