Java中防止XSS攻击的10种方法

import java.util.regex.Pattern;
 public class InputValidation {
    public static boolean isValidUsername(String username) {
        // 此处示例验证用户名只包含字母和数字
        String regex = "^[a-zA-Z0-9]+$";
        return Pattern.matches(regex, username);
    }
     public static String sanitizeInput(String input) {
        // 此处示例移除输入中的HTML标签
        return input.replaceAll("<[^>]*>", "");
    }
     public static void main(String[] args) {
        String username = "John123";
        if (isValidUsername(username)) {
            System.out.println("Valid username");
        } else {
            System.out.println("Invalid username");
        }
         String userInput = "<script>alert('XSS attack');</script>";
        String sanitizedInput = sanitizeInput(userInput);
        System.out.println("Sanitized input: " + sanitizedInput);
    }
}

import org.apache.commons.text.StringEscapeUtils;
 public class HtmlEncoding {
    public static void main(String[] args) {
        String userInput = "<script>alert('XSS attack');</script>";
        String encodedInput = StringEscapeUtils.escapeHtml4(userInput);
        System.out.println("Encoded input: " + encodedInput);
    }
}

import java.io.UnsupportedEncodingException;
import java.net.URLEncoder;
 public class UrlEncoding {
    public static void main(String[] args) {
        try {
            String userInput = "Hello, 你好!";
            String encodedInput = URLEncoder.encode(userInput, "UTF-8");
            System.out.println("Encoded input: " + encodedInput);
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        }
    }
}

import java.util.HashMap;
import java.util.Map;
import org.apache.http.HttpResponse;
import org.apache.http.client.HttpClient;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.HttpClientBuilder;
 public class ContentSecurityPolicyExample {
     public static void main(String[] args) throws Exception {
        String url = "https://your-website.com";
         HttpClient httpClient = HttpClientBuilder.create().build();
        HttpGet httpGet = new HttpGet(url);
         // 设置Content Security Policy
        Map<String, String> headers = new HashMap<>();
        headers.put("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline'");
        headers.forEach(httpGet::setHeader);
         HttpResponse response = httpClient.execute(httpGet);
         // 打印响应结果
        System.out.println("Response Code: " + response.getStatusLine().getStatusCode());
    }
}

import org.owasp.encoder.Encode;
import org.owasp.html.PolicyFactory;
import org.owasp.html.Sanitizers;
import org.owasp.html.examples.EbayPolicyExample;
 public class SecureTemplateEngineExample {
    public static void main(String[] args) {
        // 创建一个HTML过滤策略
        PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.BLOCKS);
         // 模拟从用户输入中获取的数据
        String userInput = "<script>alert('Hello, World!');</script>";
         // 使用安全的模板引擎处理用户输入
        String sanitizedInput = policy.sanitize(userInput);
         // 输出经过转义和过滤的用户输入
        System.out.println("Sanitized Input: " + Encode.forHtml(sanitizedInput));
    }
}

import org.jsoup.Jsoup;
import org.jsoup.safety.Whitelist;
 public class SecureRichTextEditorExample {
    public static void main(String[] args) {
        // 模拟从用户输入中获取的富文本内容
        String userInput = "<script>alert('Hello, World!');</script><p>Some <b>bold</b> text.</p>";
         // 使用Jsoup库进行输入过滤和验证
        String sanitizedInput = Jsoup.clean(userInput, Whitelist.basic());
         // 输出经过转义和过滤的富文本内容
        System.out.println("Sanitized Input: " + sanitizedInput);
    }
}

import java.util.Scanner;
 public class UserInputValidationExample {
    public static void main(String[] args) {
        Scanner scanner = new Scanner(System.in);
         System.out.print("请输入一个整数：");
        int userInput = scanner.nextInt();
         if (userInput >= 0 && userInput <= 100) {
            System.out.println("输入有效，范围在0到100之间。");
        } else {
            System.out.println("输入无效，范围不在0到100之间。");
        }
    }
}

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletResponse;
 public class CookieSecurityExample {
    public static void main(String[] args) {
        // 创建一个Cookie对象
        Cookie cookie = new Cookie("username", "john.doe");
         // 设置Secure标志为true，只能通过HTTPS传输
        cookie.setSecure(true);
         // 设置HttpOnly标志为true，禁止通过JavaScript访问Cookie
        cookie.setHttpOnly(true);
         // 设置Cookie的过期时间为1小时
        cookie.setMaxAge(60 * 60);
         // 添加Cookie到响应头中
        HttpServletResponse response = null; // 获取HttpServletResponse对象
        response.addCookie(cookie);
    }
}

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
import java.security.SecureRandom;
import java.util.Base64;
 public class CsrfProtectionExample {
    public static void main(String[] args) {
        // 生成随机令牌
        String token = generateCsrfToken();
         // 将令牌存储在会话中
        HttpServletRequest request = null; // 获取HttpServletRequest对象
        HttpSession session = request.getSession();
        session.setAttribute("csrfToken", token);
         // 在表单中包含令牌
        String formHtml = "<form action='/process' method='POST'>"
                + "<input type='hidden' name='csrfToken' value='" + token + "'>"
                + "<input type='text' name='username'>"
                + "<input type='password' name='password'>"
                + "<input type='submit' value='Submit'>"
                + "</form>";
    }
     private static String generateCsrfToken() {
        byte[] csrfToken = new byte[32];
        new SecureRandom().nextBytes(csrfToken);
        return Base64.getEncoder().encodeToString(csrfToken);
    }
}

<project>
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.example</groupId>
  <artifactId>my-app</artifactId>
  <version>1.0.0</version>
  <dependencies>
    <dependency>
      <groupId>com.example</groupId>
      <artifactId>dependency1</artifactId>
      <version>1.0.0</version>
    </dependency>
    <dependency>
      <groupId>com.example</groupId>
      <artifactId>dependency2</artifactId>
      <version>2.0.0</version>
    </dependency>
  </dependencies>
</project>