WO2018068366A1 - 预防xss攻击的方法 - Google Patents

预防xss攻击的方法 Download PDF

Info

Publication number
WO2018068366A1
WO2018068366A1 PCT/CN2016/107349 CN2016107349W WO2018068366A1 WO 2018068366 A1 WO2018068366 A1 WO 2018068366A1 CN 2016107349 W CN2016107349 W CN 2016107349W WO 2018068366 A1 WO2018068366 A1 WO 2018068366A1
Authority
WO
WIPO (PCT)
Prior art keywords
width
characters
angle
preventing
xss
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/107349
Other languages
English (en)
French (fr)
Inventor
倪时龙
林振天
陈又咏
陈天宇
黄敬林
张望华
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
State Grid Information and Telecommunication Group Co Ltd
Fujian Yirong Information Technology Co Ltd
Great Power Science and Technology Co of State Grid Information and Telecommunication Co Ltd
State Grid Corp of China SGCC
Original Assignee
State Grid Information and Telecommunication Group Co Ltd
Fujian Yirong Information Technology Co Ltd
Great Power Science and Technology Co of State Grid Information and Telecommunication Co Ltd
State Grid Corp of China SGCC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by State Grid Information and Telecommunication Group Co Ltd, Fujian Yirong Information Technology Co Ltd, Great Power Science and Technology Co of State Grid Information and Telecommunication Co Ltd, State Grid Corp of China SGCC filed Critical State Grid Information and Telecommunication Group Co Ltd
Publication of WO2018068366A1 publication Critical patent/WO2018068366A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Definitions

  • the invention belongs to the field of web security, and particularly relates to the field of xss attacks.
  • Cross-site scripting attacks also known as xss attacks
  • xss attacks usually refer to hackers who inject tampering with web pages and insert malicious scripts to control an attack on the user's browser when the user browses the web. This is the number one enemy in web security.
  • the OWASP TOP 10 threat has listed xss at the top of the list many times. The xss is powerfully destructive, and the resulting scene is complex and difficult to solve at one time.
  • the whitelisting policy controls user input by setting characters or keywords that the user is allowed to input.
  • the blacklisting policy is to set characters or keys that are not allowed to be input by the user. Word to control user input.
  • the whitelisting strategy needs to exhaust all the characters or keywords that the user is allowed to input. As long as there is a slight omission, it may result in the legal input being not in the whitelist. And affect the system function; blacklist strategy, you need to exhaust all the characters or keywords that are not allowed to enter the user, as long as there is a slight omission, it may lead to illegal input is not in the blacklist, causing system xss attacks.
  • the embodiment of the invention provides a method for preventing an xss attack to solve the problem of an xss attack in some cases.
  • the inventors provide a method for preventing an xss attack, including the steps of:
  • the xssfilter is configured to filter the parameters of the request sent by the webpage to the target server in the filtering function, and the filtering refers to determining whether the parameter of the request includes the set keyword, and if the set key is present in the requested parameter Word, replace it with the corresponding set character.
  • the set keyword refers to all characters except the number, the uppercase letter, the lowercase letter, and the dollar sign in the ASCII code, and the character corresponding to the set keyword is the corresponding full-width character.
  • configuration xssfilter includes the following steps:
  • the method further includes setting a keyword whitelist, and when filtering the requested parameter, the character in the keyword whitelist is not replaced.
  • the set keyword includes at least one or more of the following characters: a half angle left angle bracket, a half angle right angle bracket; a half angle left angle bracket, a half angle right angle bracket respectively corresponding to the set character is a full angle left angle bracket, full angle Right angle brackets.
  • the set keyword includes at least one or more of the following characters: a half-width double vertical line and a half-width equal sign, and a half-angle left angle bracket and a half-angle right angle bracket respectively correspond to a set character of a full-foot double vertical line and a full-width equal sign
  • the set keyword includes at least one or more of the following characters: a half-width character '" ⁇ /#&; a half-width '" ⁇ /#& respectively corresponding setting character is a full-width '" ⁇ /#&.
  • the above method is simple to set up, and different verification is performed on each parameter used for the request in different jsp functions respectively (for example, whether the parameter of the user name and password logged in by the user in the jsp function commonly used in the prior art is performed.
  • the method of the embodiment of the present invention does not need to set the verification rule one by one, but can filter the parameters of the request sent by the webpage, and effectively defend against the xss attack. It also reduces the amount of code for engineers, effectively reducing development time and shortening development costs.
  • the hacker cannot circumvent the space in the filter character by filtering the characters, so that the hacker in the prior art can avoid the space by adding a space in the string.
  • FIG. 1 is a schematic diagram of an embodiment of an embodiment of the present invention.
  • the embodiment of the present invention seeks to provide a solution for the xss attack in some scenarios, instead of solving all possible xss attacks.
  • an embodiment of the present invention provides a method for preventing an xss attack, including the following steps:
  • the xssfilter is configured to filter the parameters of the request sent by the webpage to the target server in the filtering function, and the filtering refers to determining whether the parameter of the request includes the set keyword, and if the set key is present in the requested parameter Word, replace it with the corresponding set character.
  • the web application accepts input from a user via an HTTP request (such as GET or POST) and then displays the information in some places using the output HTML code, there may be an xss vulnerability, which is illustrated by the following example to address the above xss The method of attack:
  • the web request is as follows:
  • the HTML content returned by the server includes:
  • the method of the embodiment of the present invention can be implemented by configuring the open xssfilter in the web.xml, implementing a custom HttpServletRequestWrapper, and then calling it in the Filter to replace the getParameter.
  • the function filters the parameters of the request sent by the web page to the target server.
  • the filtering refers to whether the parameter of the request request includes the set keyword, and if the set keyword appears in the requested parameter, it is replaced with the corresponding set character, that is, the parameter in the request.
  • the browser does not execute ⁇ script>alert('xss%20attack') ⁇ /script>, but displays a plain text: Section Title ⁇ /h1> ⁇ script>alert( 'xss attack') ⁇ /script>, ie after a full-width half-turn, the script Has been corrupted and cannot be executed in the browser, so the xss attack is invalid.
  • the above method is simple to set up, and different verification is performed on each parameter used for the request in different jsp functions respectively (for example, whether the parameter of the user name and password logged in by the user in the jsp function commonly used in the prior art is performed.
  • the method of the embodiment of the present invention does not need to set the verification rule one by one, but can filter the parameters of the request sent by the webpage, and effectively defend against the xss attack. It also reduces the amount of code for engineers, effectively reducing development time and shortening development costs.
  • the hacker cannot circumvent the space in the filter character by filtering the characters, so that the hacker in the prior art can avoid the space by adding a space in the string.
  • the "set keyword” refers to a full-width character corresponding to all characters except the number, uppercase letter, lowercase letter, and dollar sign in the ASCII code.
  • the set keyword refers to all characters except the number, the uppercase letter, the lowercase letter, the dollar sign, and the characters included in the keyword white list in the ASCII code. This makes it easy to quickly improve the filtering effect during system development and maintenance, depending on the specific xss attack scenario or the needs of the test project.
  • the set keyword includes at least one or more of the following characters: a half-angle left angle bracket, a half-angle right angle bracket; a half-angle left angle bracket, and a half-angle right angle bracket respectively corresponding to a full-width left Angle brackets, full-width right angle brackets. It can be understood that if in the Section Title ⁇ /h1> ⁇ script>alert('xss attack') ⁇ /script>, replacing the half-width ⁇ with the full-width ⁇ is enough to affect its resolution in the browser, so that Cannot be executed in the browser.
  • the set keyword includes one or more of the following characters: a half-width double vertical line and a half-width equal sign, and a half-width double vertical line and a half-width equal-number corresponding to each of the set characters are full-foot double vertical Line and full-width equals.
  • the user initiates a request as follows:
  • This request is intended to implement the deletion of this user with a userid of 1001.
  • This statement deletes all the information in the user table.
  • This statement contains a full-foot character, not a legal sql statement, which cannot be executed.
  • the set keyword includes one or more of the following characters: a half-width '" ⁇ /#&; a half-width '" ⁇ /#& respectively corresponding setting character is a full-width '" ⁇ /# &.
  • the terms “including”, “comprising”, or any other variant thereof are intended to encompass a non-exclusive inclusion, such that a process, method, article or terminal device comprising a series of elements. It includes not only those elements, but also other elements that are not explicitly listed, or elements that are inherent to such processes, methods, items, or end equipment. An element defined by the phrase “including” or “comprising” does not exclude the presence of additional elements in the process, method, article or terminal device including the element.
  • “greater than”, “less than”, “over”, etc. are understood as not including the number; “above”, “below”, “inside”, etc. are understood to include the number.
  • the computer program instructions can also be stored in a computer device readable memory that can direct the computer device to operate in a particular manner, such that instructions stored in the computer device readable memory produce an article of manufacture comprising the instruction device, the instruction device being implemented in the process Figure One or more processes and/or block diagrams of the functions specified in a block or blocks.
  • These computer program instructions can also be loaded onto a computer device such that a series of operational steps are performed on the computer device to produce computer-implemented processing, such that instructions executed on the computer device are provided for implementing one or more processes in the flowchart And/or block diagram of the steps of a function specified in a box or blocks.
  • the method of the embodiment of the present invention is simple to set up, and each of the parameters for requesting is differently verified in different jsp functions respectively (for example, the user name and password for logging in to the user in the jsp function commonly used in the prior art). Whether the parameter is a full-value check, or a full-letter proof
  • the method provided by the embodiment of the present invention does not need to set the verification rules one by one, but can filter the parameters of the request sent by the webpage, and effectively defends the xss attack, and reduces the code amount of the engineer, effectively shortening. Development time and development costs are reduced.
  • the hacker cannot circumvent the space in the filter character by filtering the characters, so that the hacker in the prior art can avoid the space by adding a space in the string.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Document Processing Apparatus (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本发明实施例属于web安全领域，特别涉及xss攻击领域。本发明实施例提供一种预防xss攻击的方法解决一些情况下xss攻击的问题。其包括步骤：配置xssfilter，使其在过滤函数中对网页向目标服务器发送的请求的参数进行过滤，所述进行过滤指判断请求的参数中是否包含设定的关键字，若请求的参数中出现设定的关键字，则将其替换为对应的设定字符。

Description

预防xss攻击的方法
相关申请的交叉引用
本申请基于申请号为201610897875.5、申请日为2016年10月14日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本发明属于web安全领域，特别涉及xss攻击领域。
背景技术
跨站脚本攻击，又称xss攻击，通常指黑客通过html注入了篡改网页，插入恶意的脚本，从而在用户浏览网页时，控制用户浏览器的一种攻击，是web安全中的头号大敌，OWASP TOP 10威胁多次把xss列在榜首，xss破坏力强大，且产生的场景复杂，难以一次性解决。
对于web应用，用户通过浏览器访问应用的时候，用户的输入通过html表单(form)来实现，最终用户所有的输入以表单(form)的形式发送到web服务端，xss攻击就是发生在这个时候，黑客利用技术手段，将恶意脚本，混淆在用户输入的表单中，导致xss攻击。防御xss攻击，最主要就是对用户的输入要进行安全过滤，比如对用户的输入过滤掉<script>、alert、iframe等关键字，但黑客通过在上述关键字中间加入空格，即可轻松的避开对script alert iframe的过滤，例如将javascript写为java script。
在过滤的实现策略上，又有白名单策略和黑名单策略，白名单策略是通过设置允许用户输入的字符或关键字来控制用户输入，黑名单策略是通过设置不允许用户输入的字符或关键字来控制用户输入。
这些策略在具体实施的时候，存在这样的缺点：白名单策略，则需要穷举出所有允许用户输入的字符或关键字，只要稍有遗漏，就有可能导致因合法的输入不在白名单中，而影响系统功能；黑名单策略，则需要穷举出所有不允许用户输入的字符或关键字，只要稍有遗漏，就有可能导致非法输入不在黑名单中，引起系统xss攻击。
综上所述，不管是采用白名单策略还是黑名单策略，前提都是构造一份完整的没有遗漏的白名单或黑名单，而这在现实中基本上是不太可行的，因为随着系统的不断升级，新的功能不断开发，这个白名单，永远都在不断增加，同样黑客技术也在不断发展，今天认为安全的字符或关键字，在明天有可能就是不安全的了。
发明内容
以下给出对一个或更多个方面的简化概述以力图提供对此类方面的基本理解。此概述不是所有构想到的方面的详尽综览，并且既非旨在指认出所有方面的关键性或决定性要素亦非试图界定任何或所有方面的范围。其唯一的目的是，要以简化形式给出一个或更多个方面的一些概念，以作为稍后给出的更加具体的说明之序。
本发明实施例提供一种预防xss攻击的方法解决一些情况下xss攻击的问题。
为实现上述目的，发明人提供了一种预防xss攻击的方法，包括步骤：
配置xssfilter，使其在过滤函数中对网页向目标服务器发送的请求的参数进行过滤，所述进行过滤指判断请求的参数中是否包含设定的关键字，若请求的参数中出现设定的关键字，则将其替换为对应的设定字符。
进一步，所述设定的关键字指ASCII编码中的指除数字、大写字母、小写字母、美元符号外的所有字符，设定的关键字所对应的字符为其对应的全角字符。
进一步，所述的配置xssfilter包括步骤：
在web应用的配置文件web.xml中进行配置使xssfilter生效；
通过xssHttpRequestWrapper获取请求的参数；
并对请求的参数进行过滤。
进一步，所述方法还包含设置关键字白名单，在对请求的参数进行过滤时，对关键字白名单中的字符不进行替换处理。
进一步，所述设定的关键字至少包括以下一个或多个字符：半角左尖括号、半角右尖括号；半角左尖括号、半角右尖括号分别对应的设定字符为全角左尖括号、全角右尖括号。
进一步，所述设定的关键字至少包括以下一个或多个字符：半角双竖线和半角等号，半角左尖括号、半角右尖括号分别对应的设定字符为全脚双竖线和全角等号
进一步，所述设定的关键字至少包括以下一个或多个字符：半角字符'"\/#&；半角'"\/#&分别对应的设定字符为全角'"\/#&。
上述方法设置简单，相比分别在不同的jsp函数中对用于请求的每个参数都进行不同的验证(例如现有技术中常用的在jsp函数中对用户登入的用户名和密码的参数进行是否是全数值的校验、或全字母的校验)，本发明实施例提供的方法不需要逐一设置验证规则，而可以对网页发送的请求的参数进行过滤，其有效的防御xss攻击的同时，也降低了工程师的代码量，有效的缩短了开发时间和缩短了开发成本。
相比于通过过滤script等关键字符串，本发明实施例通过过滤字符，黑客无法在过滤字符中注入空格等方式规避，从而有效的避免现有技术中黑客通过在字符串中加入空格等方式规避对xss攻击的过滤的问题。
为能达成前述及相关目的，这一个或更多个方面包括在下文中充分描述并在所附权利要求中特别指出的特征。以下描述和附图详细阐述了这一 个或更多个方面的某些说明性特征。但是，这些特征仅仅是指示了可采用各种方面的原理的各种方式中的若干种，并且本描述旨在涵盖所有此类方面及其等效方面。
附图说明
以下将结合附图来描述所公开的方面，提供附图是为了说明而非限定所公开的方面，附图中相似的标号标示相似要素，并且在其中：
图1为本发明实施例的一种实施方式的示意图。
具体实施方式
为详细说明技术方案的技术内容、构造特征、所实现目的及效果，以下结合具体实施例并配合附图1详予说明。在以下描述中，出于解释目的阐述了众多的具体细节以提供对一个或更多个方面的透彻理解。但是显而易见的是，没有这些具体细节也可实践此类方面。
可以理解的是xss攻击产生的场景复杂，且黑客的xss攻击代码在不断进化，本发明实施例力求提供在一些场景中的xss攻击的解决方案，而并非解决所有可能的xss攻击。
参照图1，本发明实施例提供一种预防xss攻击的方法，包括步骤：
配置xssfilter，使其在过滤函数中对网页向目标服务器发送的请求的参数进行过滤，所述进行过滤指判断请求的参数中是否包含设定的关键字，若请求的参数中出现设定的关键字，则将其替换为对应的设定字符。
如果Web应用程序接受用户通过HTTP请求(如GET或POST)提交的输入信息，然后使用输出HTML代码在某些地方显示这些信息，便可能存在xss漏洞，通过下述实施例说明本发明解决上述xss攻击的方法：
1、Web请求如下所示：
GET http://www.example.com/page.asp？pageid＝10&title＝Section％20Title
2、在发出请求后，服务器返回的HTML内容包括：
<h1>Section Title</h1>
3、现在，如果遇到xss攻击，例如攻击者通过摆脱<h1>标记来注入代码：
http://www.example.com/page.asp？pageid＝1&title＝Section％20Title</h1><script>alert(‘xss％20attack’)</script>
这个请求的HTML输出将为：
<h1>Section Title</h1><script>alert(‘xss attack’)</script></h1>
参照图1，例如对于ie浏览器，可以通过下述方法实现本发明实施例的方法：在web.xml中配置打开xssfilter，通过实现一个自定义的HttpServletRequestWrapper，然后在Filter里面调用它，替换掉getParameter函数即可将网页向目标服务器发送的请求的参数进行过滤。本领域技术人员在了解了针对一个浏览器的上述xssfilter设置方法，其也可以根据其已掌握的其他浏览器的知识，为其他浏览器设置实现上述方法的代码。
本发明实施例中进行过滤指判断请求的参数中是否包含设定的关键字，若请求的参数中出现设定的关键字，则其替换为对应的设定字符，即请求中的参数中
即上述例子中在getParameter函数中将title对应的参数值Section％20Title</h1><script>alert(‘xss％20attack’)</script>的所有的半角尖括号字符转成全角的尖括号字符，则这个请求的HTML输出将为：
<h1>Section Title</h1><script>alert(‘xss attack’)</script></h1>，其中下划线内的至少尖括号为全角字符，在另一些替换方式中也可以是将、反斜杠、单引号替换为全角字符。
因此破坏了html标签原有的语义，浏览器不会执行<script>alert(‘xss％20attack’)</script>，而是显示一段普通的文本：Section Title</h1><script>alert(‘xss attack’)</script>，即经过半角转全角后，脚本 已被破坏，不能在浏览器中执行，所以xss攻击失效。
上述方法设置简单，相比分别在不同的jsp函数中对用于请求的每个参数都进行不同的验证(例如现有技术中常用的在jsp函数中对用户登入的用户名和密码的参数进行是否是全数值的校验、或全字母的校验)，本发明实施例提供的方法不需要逐一设置验证规则，而可以对网页发送的请求的参数进行过滤，其有效的防御xss攻击的同时，也降低了工程师的代码量，有效的缩短了开发时间和缩短了开发成本。
相比于通过过滤script等关键字符串，本发明实施例通过过滤字符，黑客无法在过滤字符中注入空格等方式规避，从而有效的避免现有技术中黑客通过在字符串中加入空格等方式规避对xss攻击的过滤的问题。
优选的所述“设定的关键字”是指ASCII编码中的指除数字、大写字母、小写字母、美元符号外的所有字符所对应的全角字符。
还包含设置关键字白名单，在对请求的参数进行过滤时，对关键字白名单中的字符不进行替换处理。即设定的关键字指ASCII编码中的指除数字、大写字母、小写字母、美元符号，以及关键字白名单所包含的字符的之外的所有字符。从而便于在系统开发和维护过程中，根据具体的xss攻击的情景或检测项目的需求，快速的改进过滤效果。
在另一些实施例中所述设定的关键字至少包括以下一个或多个字符：半角左尖括号、半角右尖括号；半角左尖括号、半角右尖括号分别对应的设定字符为全角左尖括号、全角右尖括号。可以理解的是若在Section Title</h1><script>alert(‘xss attack’)</script>中，将半角<替换为全角<，也足以影响其在浏览器中的解析，从而使其在浏览器中不能执行。在另一些实施例中，所述设定的关键字包括以下一个或多个字符：半角双竖线和半角等号，半角双竖线和半角等号分别对应的设定字符为全脚双竖线和全角等号。
以下实施例用于说明本方法：
用户发起一个请求如下：
http://127.0.0.1:7001/ams-web/UserServlet？deleteUser&userid＝1001
这个请求本意是实现删除userid为1001的这个用户。
假设服务端实现业务逻辑的sql语句是这样的：sql＝”delete t_user where id＝”+userid，userid为用户提交的请求参数。
黑客只要在请求中针对userid这个请求参数，进行修改如下
http://127.0.0.1:7001/ams-web/UserServlet？deleteUser&userid＝1001||1＝1
则服务端执行的sql语句变成
“delete t_user where id＝1001||1＝1”
该语句会删除所有用户表中信息。
引入上述安全过滤机制后，上面请求参数中的userid＝1001||1＝1，过滤器中会将1001||1＝1中的特殊字符，这样在服务端拼接的sql语句变成：
“delete t_usre where id＝1001||1＝1”
这条语句包含了全脚字符，不是一个合法的sql语句，是不能被执行的。
从而避免了xss攻击对服务器数据库的非法修改。
在另一些实施例中，所述设定的关键字包括以下一个或多个字符：半角'"\/#&；半角'"\/#&分别对应的设定字符为全角'"\/#&。
需要说明的是，在本发明实施例中，诸如术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者终端设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者终端设备所固有的要素。在没有更多限制的情况下，由语句“包括……”或“包含……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者终端设备中还存在另外的要素。此外，在本发明实施例中，“大于”、“小于”、“超过”等理解为不包括本数；“以上”、“以下”、“以内”等理解为包括本数。
上述各实施例是参照根据实施例所述的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到计算机设备的处理器以产生一个机器，使得通过计算机设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机设备以特定方式工作的计算机设备可读存储器中，使得存储在该计算机设备可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机设备上，使得在计算机设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已经对上述各实施例进行了描述，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例做出另外的变更和修改，所以以上所述仅为本发明的实施例，并非因此限制本发明的专利保护范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围之内。
工业实用性
本发明实施例的方法设置简单，相比分别在不同的jsp函数中对用于请求的每个参数都进行不同的验证(例如现有技术中常用的在jsp函数中对用户登入的用户名和密码的参数进行是否是全数值的校验、或全字母的校 验)，本发明实施例提供的方法不需要逐一设置验证规则，而可以对网页发送的请求的参数进行过滤，其有效的防御xss攻击的同时，也降低了工程师的代码量，有效的缩短了开发时间和缩短了开发成本。
相比于通过过滤script等关键字符串，本发明实施例通过过滤字符，黑客无法在过滤字符中注入空格等方式规避，从而有效的避免现有技术中黑客通过在字符串中加入空格等方式规避对xss攻击的过滤的问题。

Claims (7)

  1. 一种预防xss攻击的方法，包括步骤：
    配置xssfilter，使其在过滤函数中对网页向目标服务器发送的请求的参数进行过滤，所述进行过滤指判断请求的参数中是否包含设定的关键字，若请求的参数中出现设定的关键字，则将其替换为对应的设定字符。
  2. 根据权利要求1所述的预防xss攻击的方法，其中，所述设定的关键字指ASCII编码中的指除数字、大写字母、小写字母、美元符号外的所有字符，设定的关键字所对应的字符为其对应的全角字符。
  3. 根据权利要求1所述的预防xss攻击的方法，其中，所述的配置xssfilter包括步骤：
    在web应用的配置文件web.xml中进行配置使xssfilter生效；
    通过xssHttpRequestWrapper获取请求的参数；
    并对请求的参数进行过滤。
  4. 根据权利要求1所述的预防xss攻击的方法，其中，所述方法还包含设置关键字白名单，在对请求的参数进行过滤时，对关键字白名单中的字符不进行替换处理。
  5. 根据权利要求1所述的预防xss攻击的方法，其中，所述设定的关键字至少包括以下一个或多个字符：半角左尖括号、半角右尖括号；半角左尖括号、半角右尖括号分别对应的设定字符为全角左尖括号、全角右尖括号。
  6. 根据权利要求1所述的预防xss攻击的方法，其中，所述设定的关键字至少包括以下一个或多个字符：半角双竖线和半角等号，半角左尖括号、半角右尖括号分别对应的设定字符为全脚双竖线和全角等号。
  7. 根据权利要求1所述的预防xss攻击的方法，其中，所述设定的关键字至少包括以下一个或多个字符：半角字符'"\/#&；半角'"\/#& 分别对应的设定字符为全角'"\/#&。
PCT/CN2016/107349 2016-10-14 2016-11-25 预防xss攻击的方法 Ceased WO2018068366A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610897875.5 2016-10-14
CN201610897875.5A CN106357668A (zh) 2016-10-14 2016-10-14 预防xss攻击的方法

Publications (1)

Publication Number Publication Date
WO2018068366A1 true WO2018068366A1 (zh) 2018-04-19

Family

ID=57866550

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/107349 Ceased WO2018068366A1 (zh) 2016-10-14 2016-11-25 预防xss攻击的方法

Country Status (2)

Country Link
CN (1) CN106357668A (zh)
WO (1) WO2018068366A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106357668A (zh) * 2016-10-14 2017-01-25 福建亿榕信息技术有限公司 预防xss攻击的方法
CN107301345B (zh) * 2017-06-06 2019-12-06 新浪网技术(中国)有限公司 一种阻止xss攻击的方法、系统及装置
CN108234453A (zh) * 2017-12-12 2018-06-29 杭州安恒信息技术有限公司 一种基于规则的Java的web安全防御方法
CN110958221B (zh) * 2019-10-25 2021-12-28 杭州数梦工场科技有限公司 动态检测xml外部实体注入漏洞的方法及装置
CN115664856A (zh) * 2022-12-26 2023-01-31 北京安锐卓越信息技术股份有限公司 一种请求过滤方法、系统、设备及介质
CN118075031B (zh) * 2024-04-19 2024-06-21 三峡高科信息技术有限责任公司 一种组件化实现系统xss防护的系统和方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104182685A (zh) * 2014-08-19 2014-12-03 北京京东尚科信息技术有限公司 一种用于java web应用的xss防御方法及组件
CN104601540A (zh) * 2014-12-05 2015-05-06 华为技术有限公司 一种跨站脚本XSS攻击防御方法及Web服务器
CN106357668A (zh) * 2016-10-14 2017-01-25 福建亿榕信息技术有限公司 预防xss攻击的方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104182685A (zh) * 2014-08-19 2014-12-03 北京京东尚科信息技术有限公司 一种用于java web应用的xss防御方法及组件
CN104601540A (zh) * 2014-12-05 2015-05-06 华为技术有限公司 一种跨站脚本XSS攻击防御方法及Web服务器
CN106357668A (zh) * 2016-10-14 2017-01-25 福建亿榕信息技术有限公司 预防xss攻击的方法

Also Published As

Publication number Publication date
CN106357668A (zh) 2017-01-25

Similar Documents

Publication Publication Date Title
Weichselbaum et al. Csp is dead, long live csp! on the insecurity of whitelists and the future of content security policy
Heiderich et al. Scriptless attacks: stealing the pie without touching the sill
Van Gundy et al. Noncespaces: Using randomization to defeat cross-site scripting attacks
Rydstedt et al. Busting frame busting: a study of clickjacking vulnerabilities at popular sites
Chen et al. App isolation: get the security of multiple browsers with just one
WO2018068366A1 (zh) 预防xss攻击的方法
CN101356535A (zh) 一种检测和防止java脚本程序中不安全行为的方法和装置
Wang et al. A new cross-site scripting detection mechanism integrated with HTML5 and CORS properties by using browser extensions
Felt et al. Talking to strangers without taking their candy: isolating proxied content
Shalini et al. Prevention of cross-site scripting attacks (xss) on web applications in the client side
Saini et al. The darker side of firefox extension
Ofuonye et al. Securing web-clients with instrumented code and dynamic runtime monitoring
Patel et al. SQL injection attacks: techniques and protection mechanisms
Samo et al. An in-depth analysis of cross-site scripting (XSS): threats, mechanisms, and mitigation strategies
Sung et al. Light-weight CSRF protection by labeling user-created contents
Zhou et al. Strengthening XSRF defenses for legacy web applications using whitebox analysis and transformation
Ankush XSS attack prevention using DOM based filtering API
Singh Detecting and prevention cross–site scripting techniques
Niemietz Analysis of UI redressing attacks and countermeasures
Patil An insecure wild web: A large-scale study of effectiveness of web security mechanisms
Heiderich et al. Waiting for CSP–securing legacy web applications with JSAgents
Aung et al. Recent Techniques Supporting Vulnerabilities Management for Secure Online Apps
Yamazaki et al. Xilara: An XSS filter based on HTML template restoration
Lekies Client-side Cross-site Scripting: Exploitation, Detection, Mitigation, and Prevention
Ryck et al. Attacks on the Client-Side Context

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16918750

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16918750

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 16918750

Country of ref document: EP

Kind code of ref document: A1