com.relaxed.common.xss.filters

类 XssFilter

java.lang.Object

org.springframework.web.filter.GenericFilterBean

org.springframework.web.filter.OncePerRequestFilter

com.relaxed.common.xss.filters.XssFilter

所有已实现的接口:

javax.servlet.Filter, org.springframework.beans.factory.Aware, org.springframework.beans.factory.BeanNameAware, org.springframework.beans.factory.DisposableBean, org.springframework.beans.factory.InitializingBean, org.springframework.context.EnvironmentAware, org.springframework.core.env.EnvironmentCapable, org.springframework.web.context.ServletContextAware

public class XssFilter
extends org.springframework.web.filter.OncePerRequestFilter

XSS过滤器 用于过滤HTTP请求中的XSS攻击内容 继承自OncePerRequestFilter，确保每个请求只被过滤一次

从以下版本开始:

1.0

作者:

Yakir

字段概要

从类继承的字段 org.springframework.web.filter.OncePerRequestFilter

ALREADY_FILTERED_SUFFIX

从类继承的字段 org.springframework.web.filter.GenericFilterBean

logger

构造器概要

构造器

构造器和说明
XssFilter()

方法概要

限定符和类型	方法和说明
protected void	doFilterInternal(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, javax.servlet.FilterChain filterChain) 执行XSS过滤 使用XssRequestWrapper包装请求对象，对请求参数进行XSS过滤
protected boolean	shouldNotFilter(javax.servlet.http.HttpServletRequest request) 判断当前请求是否应该跳过XSS过滤

从类继承的方法 org.springframework.web.filter.OncePerRequestFilter

doFilter, doFilterNestedErrorDispatch, getAlreadyFilteredAttributeName, isAsyncDispatch, isAsyncStarted, shouldNotFilterAsyncDispatch, shouldNotFilterErrorDispatch

从类继承的方法 org.springframework.web.filter.GenericFilterBean

addRequiredProperty, afterPropertiesSet, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

构造器详细资料

XssFilter

public XssFilter()

方法详细资料

doFilterInternal

protected void doFilterInternal(javax.servlet.http.HttpServletRequest request,
                                javax.servlet.http.HttpServletResponse response,
                                javax.servlet.FilterChain filterChain)
                         throws javax.servlet.ServletException,
                                IOException

执行XSS过滤 使用XssRequestWrapper包装请求对象，对请求参数进行XSS过滤

指定者:

doFilterInternal 在类中 org.springframework.web.filter.OncePerRequestFilter

参数:

request - HTTP请求对象

response - HTTP响应对象

filterChain - 过滤器链

抛出:

javax.servlet.ServletException - 如果处理请求时发生异常

IOException - 如果处理IO时发生异常

shouldNotFilter

protected boolean shouldNotFilter(javax.servlet.http.HttpServletRequest request)
                           throws javax.servlet.ServletException

判断当前请求是否应该跳过XSS过滤

覆盖:

shouldNotFilter 在类中 org.springframework.web.filter.OncePerRequestFilter

参数:

request - HTTP请求对象

返回:

true表示跳过过滤，false表示需要过滤

抛出:

javax.servlet.ServletException - 如果判断过程中发生异常