Cross-Site Scripting (XSS) 필터 샘플

Cross-Site Scripting (XSS)에대한 방어책은 다양하게 많지만, 그 방어책 중에 하나인 필터를 활용하는 방법을 공유합니다. 참고 소스인 com.josephoconnell.html.HTMLInputFilter.class를 활용한 필터를 만들어 봤습니다. 보안 위협 요소중의 하나인 Cross-Site Scripting (XSS)에 대한 대비책으로 활용할 만합니다.

1. 참조 필터
   - 참조 클래스 : com.josephoconnell.html.HTMLInputFilter.class(링크)

2. HTMLInputFilter을 활용한 필터 샘플 소스
 - RequestWrapper 클래스

package client;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import com.josephoconnell.html.HTMLInputFilter;

public class RequestWrapper extends HttpServletRequestWrapper 
{
    public RequestWrapper(HttpServletRequest servletRequest) {   
        super(servletRequest);   
    }   
       
    public String[] getParameterValues(String parameter) {   
  
      String[] values = super.getParameterValues(parameter);   
      if (values==null)  {   
                  return null;   
          }   
      int count = values.length;   
      String[] encodedValues = new String[count];   
      for (int i = 0; i < count; i++) {   
                 encodedValues[i] = filter(values[i]);   
       }     
      return encodedValues;    
    }   
       
    public String getParameter(String parameter) {   
          String value = super.getParameter(parameter);   
          if (value == null) {   
                 return null;    
                  }   
          return filter(value);   
    }   
       
    public String getHeader(String name) {   
        String value = super.getHeader(name);   
        if (value == null)   
            return null;   
        return filter(value);   
           
    }   
  
    private String filter(String input) {
        if(input==null) {
            return null;
        }
        String clean = new HTMLInputFilter().
        	filter(input.replaceAll("\"", "%22").
                    replaceAll("\'","%27"));
        return clean.replaceAll("<", "%3C").replaceAll(">", "%3E");
    }
}

 - XssFilter 클래스

package client;

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

public class XssFilter implements Filter 
{
	private FilterConfig fc;
	public void destroy() {
		this.fc = null; 
	}

	public void doFilter(ServletRequest req, ServletResponse resp,
			FilterChain chain) throws IOException, ServletException {
		chain.doFilter(new RequestWrapper(
				(HttpServletRequest) req), resp);

	}

	public void init(FilterConfig fc) throws ServletException {
		this.fc = fc;
	}
}

3. web.xml 필터 적용

<FILTER>  
    <FILTER-NAME>XSS</FILTER-NAME>  
    <DISPLAY-NAME>XSS</DISPLAY-NAME>  
    <DESCRIPTION></DESCRIPTION>  
    <FILTER-CLASS>client.XssFilter</FILTER-CLASS>  
</FILTER>  
<FILTER-MAPPING>  
    <FILTER-NAME>XSS</FILTER-NAME>  
    <URL-PATTERN>/*</URL-PATTERN>  
</FILTER-MAPPING>

출처 : http://mimul.com/pebble/default/2009/10/04/1254641100000.html