我不确定如何在我的Java项目中执行HTML转义以防止跨站脚本攻击。

huangapple
go评论178阅读模式
英文:

I am not sure how to perform html escaping in my java project to prevent XSS

问题

以下是您提供的代码的中文翻译：

  1. 只是一个提示，这是为了课堂。我本应该查看课堂材料，但那里没有解决这个问题（学校有点差劲）。当我问老师时，他说要谷歌搜索。我尝试过谷歌搜索，但可惜我的理解力还不够好。
  3. 我的设置如下。这是一个使用DerbyDB、Glassfish 5、Java和JavaScript Servlet的Web应用程序。
  5. 我知道这个问题在这里已经回答了100000次，但我就是理解不了...
  6. 我有一个Java Web应用程序（没有使用Maven）。登录使用login.jsp，并通过authenticate.java进行身份验证。
  7. 当然，这没有进行转义，所以容易受到跨站脚本攻击（XSS）。
  8. 我只是不确定如何实现这一点。如果有人能指导我一下。如果有一个库或什么东西可以加载，如果有的话，如何使用它。
  10. login.jsp
  12. <%--
  13.     文档：login
  14.     创建时间：2015年8月10日 下午7:53:14
  15.     作者：吉姆
  16. --%>
  18. <%@page contentType="text/html" pageEncoding="UTF-8"%>
  19. <!DOCTYPE html>
  20. <html>
  21. <head>
  22.     <title>SDEV425 登录</title>
  23.     <meta charset="UTF-8">
  24.     <meta name="viewport" content="width=device-width, initial-scale=1.0">
  25.     <link href="styles.css" rel="stylesheet" type="text/css">
  26. </head>
  27. <body>
  28.     <div id="main">
  29.         <%@include file="WEB-INF/jspf/menus.jspf" %>
  30.         <p></p>
  31.         <p></p>
  32.         <h2>登录</h2>
  34.         <% if (session.getAttribute("UMUCUserEmail") == null) {
  35.         %>
  37.         <form action="Authenticate" method="post">
  38.             <table class="center">
  39.                 <tr>
  40.                     <td>Email: </td><td><input type="text"  name="emailAddress"  size="50" autofocus> </td>
  41.                 </tr>
  42.                 <tr>
  43.                     <td>
  44.                         密码： </td><td><input type="password" name="pfield" size="50" autocomplete="off"></td>
  45.                 </tr>
  46.                 <tr>
  47.                     <td>
  48.                         &amp;nbsp;
  49.                     </td>
  50.                     <td>
  51.                         <input type="submit" name="SignIn" value="登录">
  52.                     </td>
  53.                 </tr>
  54.             </table>
  55.             <p></p>
  56.             <!-- 如果有错误消息，则打印错误消息 -->
  57.             <% String e = (String) request.getAttribute("ErrorMessage");
  58.                 if (e != null) {
  59.                     out.print(e);
  60.                 }
  61.             %>
  63.         </form>
  64.         <%
  65.             } else {
  67.                 request.setAttribute("ErrorMessage", "您已经登录。");
  68.                 RequestDispatcher dispatcher = request.getRequestDispatcher("welcome.jsp");
  69.                 dispatcher.forward(request, response);                    
  70.             }
  71.         %>
  72.     </div>
  73. </body>
  74. </html>
  76. Authenticate.java
  78. /*
  79.  * 若要更改此许可标题，请在项目属性中选择许可标题。
  80.  * 若要更改此模板文件，请选择工具 | 模板
  81.  * 并打开模板在编辑器中进行编辑。
  82.  */
  83. package SDEV425_HW4;
  85. import java.io.IOException;
  86. import java.io.PrintWriter;
  87. import java.sql.Connection;
  88. import java.sql.ResultSet;
  89. import java.sql.PreparedStatement;
  90. import javax.servlet.RequestDispatcher;
  91. import javax.servlet.ServletException;
  92. import javax.servlet.http.HttpServlet;
  93. import javax.servlet.http.HttpServletRequest;
  94. import javax.servlet.http.HttpServletResponse;
  95. import javax.servlet.http.HttpSession;
  96. import org.apache.derby.jdbc.ClientDataSource;
  98. /**
  99.  *
  100.  * 作者：吉姆
  101.  */
  102. public class Authenticate extends HttpServlet {
  104.     // 变量    
  105.     private String username;
  106.     private String pword;
  107.     private Boolean isValid;
  108.     private int user_id;
  109.     private HttpSession session;
  111.     /**
  112.      * 处理HTTP GET 和 POST 方法的请求。
  113.      *
  114.      * @param request servlet 请求
  115.      * @param response servlet 响应
  116.      * @throws ServletException 如果发生 Servlet 特定错误
  117.      * @throws IOException 如果发生 I/O 错误
  118.      */
  119.     protected void processRequest(HttpServletRequest request, HttpServletResponse response)
  120.             throws ServletException, IOException {
  121.         response.setContentType("text/html;charset=UTF-8");
  122.         try (PrintWriter out = response.getWriter()) {
  123.             /* 输出页面内容。您可以使用以下示例代码。 */
  124.             out.println("<!DOCTYPE html>");
  125.             out.println("<html>");
  126.             out.println("<head>");
  127.             out.println("<title>Servlet Authenticate</title>");
  128.             out.println("</head>");
  129.             out.println("<body>");
  130.             out.println("<h1>在 " + request.getContextPath() + " 的 Servlet Authenticate</h1>");
  132.             out.println("</body>");
  133.             out.println("</html>");
  134.         }
  135.     }
  137.     // <editor-fold defaultstate="collapsed" desc="HttpServlet methods. 点击左侧的 + 号以编辑代码。">
  138.     /**
  139.      * 处理 HTTP GET 方法。
  140.      *
  141.      * @param request servlet 请求
  142.      * @param response servlet 响应
  143.      * @throws ServletException 如果发生 Servlet 特定错误
  144.      * @throws IOException 如果发生 I/O 错误
  145.      */
  146.     @Override
  147.     protected void doGet(HttpServletRequest request, HttpServletResponse response)
  148.             throws ServletException, IOException {
  149.         processRequest(request, response);
  150.     }
  152.     /**
  153.      * 处理 HTTP POST 方法。
  154.      *
  155.      * @param request servlet 请求
  156.      * @param response servlet 响应
  157.      * @throws ServletException 如果发生 Servlet 特定错误
  158.      * @throws IOException 如果发生 I/O 错误
  159.      */
  160.     @Override
  161.     protected void doPost(HttpServletRequest request, HttpServletResponse response)
  162.             throws ServletException, IOException {
  164.         // 获取POST 输入 
  165.         this.username = request.getParameter("emailAddress");
  166.         this.pword = request.getParameter("pfield");
  167.         this.isValid = validate(this.username, this.pword);
  168.         response.setContentType("text/html;charset=UTF-8");
  169.         // 设置会话变量
  170.         if (isValid) {
  171.             // 如果尚未创建会话对象，请创建一个会话对象。
  172.             session = request.getSession(true);
  173.             session.setAttribute("UMUCUserEmail", username);         
  174.             session.setAttribute("UMUCUserID", user_id);
  176.             // 发送到欢迎 JSP 页面              
  178.             RequestDispatcher dispatcher = request.getRequestDispatcher("welcome.jsp");
  179.             dispatcher.forward(request, response);
  181.         } else {
  182.             // 不是有效的登录
  183.             // 将他们引导回登录界面
  185.             request.setAttribute("ErrorMessage", "无效的用户名或密码。请重试或联系吉姆。");
  186.             RequestDispatcher dispatcher = request.getRequestDispatcher("login.jsp");
  187.             dispatcher.forward(request, response);
  188.         }
  189.     }
  191.     /**
  192.      * 返回 servlet 的简短描述。
  195. <details>
  196. <summary>英文:</summary>
  198. Just a note, this is for class. I would go to the class material, but it doesn&#39;t address this(the school is kinda garbage). And when i ask the teacher, he says to google it. I&#39;ve tried googling it, but my understanding is not good enough yet sadly.
  200. My setup is as follows. Its a web application that uses DerbyDB, Glassfish 5, Java and javascript servlets.
  202. I know this is answered 100000 times on here, but being as dense as i am... i am not getting it.
  203. i have a java web application (without maven). The login uses login.jsp and authenticates through authenticate.java
  204. of course there is no escaping so its vulnerable to xss.
  205. I am just not sure how to implement this. If someone could guide me there. If there is a library or something to load and if so how to use it.
  207. login.jsp
  209.     &lt;%-- 
  210.         Document   : login
  211.         Created on : Aug 10, 2015, 7:53:14 PM
  212.         Author     : jim
  213.     --%&gt;
  214.     
  215.     &lt;%@page contentType=&quot;text/html&quot; pageEncoding=&quot;UTF-8&quot;%&gt;
  216.     &lt;!DOCTYPE html&gt;
  217.     &lt;html&gt;
  218.         &lt;head&gt;
  219.             &lt;title&gt;SDEV425 Login&lt;/title&gt;
  220.             &lt;meta charset=&quot;UTF-8&quot;&gt;
  221.             &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width, initial-scale=1.0&quot;&gt;
  222.             &lt;link href=&quot;styles.css&quot; rel=&quot;stylesheet&quot; type=&quot;text/css&quot;&gt;
  223.         &lt;/head&gt;
  224.         &lt;body&gt;
  225.             &lt;div id=&quot;main&quot;&gt;
  226.                 &lt;%@include file=&quot;WEB-INF/jspf/menus.jspf&quot; %&gt;
  227.                 &lt;p&gt;&lt;/p&gt;
  228.                 &lt;p&gt;&lt;/p&gt;
  229.                 &lt;h2&gt;Login&lt;/h2&gt;
  230.     
  231.                 &lt;% if (session.getAttribute(&quot;UMUCUserEmail&quot;) == null) {
  232.                 %&gt;
  233.     
  234.     
  235.     
  236.                 &lt;form action=&quot;Authenticate&quot; method=&quot;post&quot;&gt;
  237.                     &lt;table class=&quot;center&quot;&gt;
  238.                         &lt;tr&gt;
  239.                         &lt;td&gt;Email: &lt;/td&gt;&lt;td&gt;&lt;input type=&quot;text&quot;  name=&quot;emailAddress&quot;  size=&quot;50&quot; autofocus&gt; &lt;/td&gt;
  240.                         &lt;/tr&gt;
  241.                         &lt;tr&gt;
  242.                             &lt;td&gt;
  243.                                 Password: &lt;/td&gt;&lt;td&gt;&lt;input type=&quot;password&quot; name=&quot;pfield&quot; size=&quot;50&quot; autocomplete=&quot;off&quot;&gt;&lt;/td&gt;
  244.                         &lt;/tr&gt;
  245.                         &lt;tr&gt;
  246.                             &lt;td&gt;
  247.                                 &amp;nbsp;
  248.                             &lt;/td&gt;
  249.                             &lt;td&gt;
  250.                                 &lt;input type=&quot;submit&quot; name=&quot;SignIn&quot; value=&quot;Sign In&quot;&gt;
  251.                             &lt;/td&gt;
  252.                         &lt;/tr&gt;
  253.                     &lt;/table&gt;
  254.                     &lt;p&gt;&lt;/p&gt;
  255.                     &lt;!-- Print Error Message if any --&gt;
  256.                     &lt;% String e = (String) request.getAttribute(&quot;ErrorMessage&quot;);
  257.                         if (e != null) {
  258.                             out.print(e);
  259.                         }
  260.                     %&gt;
  261.     
  262.                 &lt;/form&gt;
  263.                 &lt;%
  264.                     } else {
  265.     
  266.                         request.setAttribute(&quot;ErrorMessage&quot;, &quot;You are already logged in.&quot;);
  267.                         RequestDispatcher dispatcher = request.getRequestDispatcher(&quot;welcome.jsp&quot;);
  268.                         dispatcher.forward(request, response);                    
  269.                     }
  270.                 %&gt;
  271.             &lt;/div&gt;
  272.         &lt;/body&gt;
  273.     &lt;/html&gt;
  275. Authenticate.java
  277.     /*
  278.      * To change this license header, choose License Headers in Project Properties.
  279.      * To change this template file, choose Tools | Templates
  280.      * and open the template in the editor.
  281.      */
  282.     package SDEV425_HW4;
  283.     
  284.     import java.io.IOException;
  285.     import java.io.PrintWriter;
  286.     import java.sql.Connection;
  287.     import java.sql.ResultSet;
  288.     import java.sql.PreparedStatement;
  289.     import javax.servlet.RequestDispatcher;
  290.     import javax.servlet.ServletException;
  291.     import javax.servlet.http.HttpServlet;
  292.     import javax.servlet.http.HttpServletRequest;
  293.     import javax.servlet.http.HttpServletResponse;
  294.     import javax.servlet.http.HttpSession;
  295.     import org.apache.derby.jdbc.ClientDataSource;
  296.     
  297.     
  298.     
  299.     /**
  300.      *
  301.      * @author jim
  302.      */
  303.     public class Authenticate extends HttpServlet {
  304.     
  305.         // variables    
  306.         private String username;
  307.         private String pword;
  308.         private Boolean isValid;
  309.         private int user_id;
  310.         private HttpSession session;
  311.     
  312.         
  313.         /**
  314.          * Processes requests for both HTTP &lt;code&gt;GET&lt;/code&gt; and &lt;code&gt;POST&lt;/code&gt;
  315.          * methods.
  316.          *
  317.          * @param request servlet request
  318.          * @param response servlet response
  319.          * @throws ServletException if a servlet-specific error occurs
  320.          * @throws IOException if an I/O error occurs
  321.          */
  322.         protected void processRequest(HttpServletRequest request, HttpServletResponse response)
  323.                 throws ServletException, IOException {
  324.             response.setContentType(&quot;text/html;charset=UTF-8&quot;);
  325.             try (PrintWriter out = response.getWriter()) {
  326.                 /* TODO output your page here. You may use following sample code. */
  327.                 out.println(&quot;&lt;!DOCTYPE html&gt;&quot;);
  328.                 out.println(&quot;&lt;html&gt;&quot;);
  329.                 out.println(&quot;&lt;head&gt;&quot;);
  330.                 out.println(&quot;&lt;title&gt;Servlet Authenticate&lt;/title&gt;&quot;);
  331.                 out.println(&quot;&lt;/head&gt;&quot;);
  332.                 out.println(&quot;&lt;body&gt;&quot;);
  333.                 out.println(&quot;&lt;h1&gt;Servlet Authenticate at &quot; + request.getContextPath() + &quot;&lt;/h1&gt;&quot;);
  334.                 
  335.                 out.println(&quot;&lt;/body&gt;&quot;);
  336.                 out.println(&quot;&lt;/html&gt;&quot;);
  337.             }
  338.         }
  339.     
  340.         // &lt;editor-fold defaultstate=&quot;collapsed&quot; desc=&quot;HttpServlet methods. Click on the + sign on the left to edit the code.&quot;&gt;
  341.         /**
  342.          * Handles the HTTP &lt;code&gt;GET&lt;/code&gt; method.
  343.          *
  344.          * @param request servlet request
  345.          * @param response servlet response
  346.          * @throws ServletException if a servlet-specific error occurs
  347.          * @throws IOException if an I/O error occurs
  348.          */
  349.         @Override
  350.         protected void doGet(HttpServletRequest request, HttpServletResponse response)
  351.                 throws ServletException, IOException {
  352.             processRequest(request, response);
  353.         }
  354.     
  355.         /**
  356.          * Handles the HTTP &lt;code&gt;POST&lt;/code&gt; method.
  357.          *
  358.          * @param request servlet request
  359.          * @param response servlet response
  360.          * @throws ServletException if a servlet-specific error occurs
  361.          * @throws IOException if an I/O error occurs
  362.          */
  363.         @Override
  364.         protected void doPost(HttpServletRequest request, HttpServletResponse response)
  365.                 throws ServletException, IOException {
  366.     
  367.             // Get the post input 
  368.             this.username = request.getParameter(&quot;emailAddress&quot;);
  369.             this.pword = request.getParameter(&quot;pfield&quot;);
  370.             this.isValid = validate(this.username, this.pword);
  371.              response.setContentType(&quot;text/html;charset=UTF-8&quot;);
  372.             // Set the session variable
  373.             if (isValid) {
  374.                 // Create a session object if it is already not  created.
  375.                 session = request.getSession(true);
  376.                 session.setAttribute(&quot;UMUCUserEmail&quot;, username);         
  377.                 session.setAttribute(&quot;UMUCUserID&quot;, user_id);
  378.     
  379.                 // Send to the Welcome JSP page              
  380.                 
  381.                 RequestDispatcher dispatcher = request.getRequestDispatcher(&quot;welcome.jsp&quot;);
  382.                 dispatcher.forward(request, response);
  383.     
  384.             } else {
  385.                 // Not a valid login
  386.                 // refer them back to the Login screen
  387.     
  388.                 request.setAttribute(&quot;ErrorMessage&quot;, &quot;Invalid Username or Password. Try again or contact Jim.&quot;);
  389.                 RequestDispatcher dispatcher = request.getRequestDispatcher(&quot;login.jsp&quot;);
  390.                 dispatcher.forward(request, response);
  391.             }
  392.         }
  393.     
  394.         /**
  395.          * Returns a short description of the servlet.
  396.          *
  397.          * @return a String containing servlet description
  398.          */
  399.         @Override
  400.         public String getServletInfo() {
  401.             return &quot;Short description&quot;;
  402.         }// &lt;/editor-fold&gt;
  403.     
  404.         // Method to Authenticate
  405.         public boolean validate(String name, String pass) {
  406.             boolean status = false;
  407.             int hitcnt=0;
  408.     
  409.             try {
  410.                 ClientDataSource ds = new ClientDataSource();
  411.                 ds.setDatabaseName(&quot;SDEV425&quot;);
  412.                 ds.setServerName(&quot;localhost&quot;);
  413.                 ds.setPortNumber(1527);
  414.                 ds.setUser(&quot;sdev425&quot;);
  415.                 ds.setPassword(&quot;sdev425&quot;);
  416.                 ds.setDataSourceName(&quot;jdbc:derby&quot;);
  417.     
  418.                 Connection conn = ds.getConnection();
  419.     
  420.                
  421.                 
  422.                 String sql = &quot;select user_id from sdev_users  where EMAIL = ?&quot;;
  423.                 PreparedStatement stmt = conn.prepareStatement(sql);
  424.                 stmt.setString(1, this.username); 
  425.                 
  426.                 
  427.                 ResultSet rs = stmt.executeQuery();
  428.                 
  429.                 while (rs.next()) {
  430.                     user_id = rs.getInt(1);
  431.                 }
  432.                 if (user_id&gt; 0) {                
  433.                     
  434.                     String sql2 = &quot;select user_id from user_info where user_id = &quot; + user_id + &quot;and password = ?&quot;;
  435.     
  436.                     
  437.                     PreparedStatement stmt2 = conn.prepareStatement(sql2);
  438.                     stmt2.setString(1, this.pword);
  439.                     
  440.                     ResultSet rs2 = stmt2.executeQuery();
  441.                     
  442.                     while (rs2.next()) {
  443.                         hitcnt++;
  444.                     }   
  445.                     // Set to true if userid/password match
  446.                    if(hitcnt&gt;0){
  447.                        status=true;
  448.                    }
  449.                 }
  450.     
  451.             } catch (Exception e) {
  452.                 System.out.println(e);
  453.             }
  454.             return status;
  455.         }
  456.     
  457.     }
  461. </details>
  464. # 答案1
  465. **得分**: 2
  467. 可以使用StringEscapeUtils.escapeHtml4()方法。
  469. ```java
  470. import org.apache.commons.text.StringEscapeUtils;
  472. public class HTMLEscapeExample 
  473. {
  474.     public static void main(String[] args) 
  475.     {
  476.         String unEscapedString = "&quot;&lt;html&gt;some-random-text&lt;/html&gt;&quot;";
  477.          
  478.         String escapedHTML = StringEscapeUtils.escapeHtml4(unEscapedString);
  479.          
  480.         System.out.println(escapedHTML);    //浏览器现在可以解析并打印
  481.     }
  482. }

//输出：

  1. &amp;lt;html&amp;gt;some-random-text&amp;lt;/html&amp;gt;
英文:

You can use StringEscapeUtils.escapeHtml4() method.

  1. import org.apache.commons.text.StringEscapeUtils;
  2. public class HTMLEscapeExample 
  3. {
  4. public static void main(String[] args) 
  5. {
  6. String unEscapedString = &quot;&lt;html&gt;some-random-text&lt;/html&gt;&quot;;
  7. String escapedHTML = StringEscapeUtils.escapeHtml4(unEscapedString);
  8. System.out.println(escapedHTML);    //Browser can now parse this and print
  9. }
  10. }
  11. //Output:
  12. &amp;lt;html&amp;gt;some-random-text&amp;lt;/html&amp;gt;

huangapple
  • 本文由 发表于 2020年8月12日 04:58:55
  • 转载请务必保留本文链接：https://go.coder-hub.com/63366287.html
  • derby
  • glassfish
  • java
  • javascript
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定