XSS 防护（CSP/转义）#

import org.springframework.web.util.HtmlUtils;
import java.nio.charset.StandardCharsets;
import java.net.URLEncoder;

public class EncodingUtils {
    
    /**
     * HTML 上下文编码：防止 XSS
     */
    public static String htmlEncode(String input) {
        if (input == null) {
            return null;
        }
        return HtmlUtils.htmlEscape(input);
    }
    
    /**
     * HTML 属性上下文编码
     * 注意：属性值必须用双引号包裹
     */
    public static String htmlAttributeEncode(String input) {
        if (input == null) {
            return null;
        }
        // 双引号必须编码，防止属性逃逸
        return input
            .replace("&", "&")
            .replace("<", "&lt;")
            .replace(">", "&gt;")
            .replace("\"", "&quot;")
            .replace("'", "&#x27;");  // 单引号也需要编码
    }
    
    /**
     * JavaScript 上下文编码
     */
    public static String javaScriptEncode(String input) {
        if (input == null) {
            return null;
        }
        StringBuilder sb = new StringBuilder();
        for (char c : input.toCharArray()) {
            switch (c) {
                case '\'':
                    sb.append("\\x27");
                    break;
                case '"':
                    sb.append("\\x22");
                    break;
                case '&':
                    sb.append("\\x26");
                    break;
                case '<':
                    sb.append("\\x3C");
                    break;
                case '>':
                    sb.append("\\x3E");
                    break;
                case '\\':
                    sb.append("\\\\");
                    break;
                default:
                    if (c < 0x20 || c > 0x7E) {
                        // 非 ASCII 字符使用 Unicode 转义
                        sb.append(String.format("\\u%04x", (int) c));
                    } else {
                        sb.append(c);
                    }
            }
        }
        return sb.toString();
    }
    
    /**
     * URL 上下文编码
     */
    public static String urlEncode(String input) {
        if (input == null) {
            return null;
        }
        try {
            return URLEncoder.encode(input, StandardCharsets.UTF_8.toString());
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
    
    /**
     * CSS 上下文编码
     * CSS 转义使用反斜杠 + 十六进制
     */
    public static String cssEncode(String input) {
        if (input == null) {
            return null;
        }
        StringBuilder sb = new StringBuilder();
        for (char c : input.toCharArray()) {
            if (c < 0x21 || c > 0x7E || "\"<>".indexOf(c) >= 0) {
                sb.append(String.format("\\%06x", (int) c));
            } else {
                sb.append(c);
            }
        }
        return sb.toString();
    }
}

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.IOException;

public class XssFilter implements Filter {
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                         FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        chain.doFilter(new XssRequestWrapper(httpRequest), response);
    }
}

import org.apache.commons.text.StringEscapeUtils;

public class XssRequestWrapper extends HttpServletRequestWrapper {
    
    public XssRequestWrapper(HttpServletRequest request) {
        super(request);
    }
    
    @Override
    public String getParameter(String name) {
        String value = super.getParameter(name);
        return sanitize(value);
    }
    
    @Override
    public String[] getParameterValues(String name) {
        String[] values = super.getParameterValues(name);
        if (values == null) {
            return null;
        }
        return Arrays.stream(values)
            .map(this::sanitize)
            .toArray(String[]::new);
    }
    
    @Override
    public String getHeader(String name) {
        String value = super.getHeader(name);
        return sanitize(value);
    }
    
    private String sanitize(String input) {
        if (input == null) {
            return null;
        }
        // HTML 实体编码
        return StringEscapeUtils.escapeHtml4(input);
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // XSS 防护 Header
            .headers(headers -> headers
                // 启用 XSS 过滤（浏览器会自动阻止）
                .xssProtection(xss -> xss
                    .enable(true)
                    .block(true))  // 阻止而非清理
                
                // 防止 MIME 类型嗅探
                .contentTypeOptions(contentType -> contentType.disable())
                
                // 禁用页面框架嵌入（防止点击劫持）
                .frameOptions(frame -> frame.deny())
                
                // CSP 策略
                .contentSecurityPolicy(csp -> csp
                    .policyDirectives("default-src 'self'; script-src 'self'; object-src 'none'")));
        
        return http.build();
    }
}

@Configuration
public class CspConfig {
    
    @Bean
    public FilterRegistrationBean<CspHeaderFilter> cspHeaderFilter() {
        FilterRegistrationBean<CspHeaderFilter> bean = new FilterRegistrationBean<>();
        bean.setFilter(new CspHeaderFilter());
        bean.addUrlPatterns("/*");
        return bean;
    }
}

public class CspHeaderFilter implements Filter {
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                         FilterChain chain) throws IOException, ServletException {
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        
        String csp = buildCspPolicy();
        httpResponse.setHeader("Content-Security-Policy", csp);
        
        // 同时启用 Report-Only 模式测试
        String cspReportOnly = buildCspPolicy() + "; report-uri /csp-report";
        httpResponse.setHeader("Content-Security-Policy-Report-Only", cspReportOnly);
        
        chain.doFilter(request, response);
    }
    
    private String buildCspPolicy() {
        return String.join("; ",
            "default-src 'self'",
            "script-src 'self' 'nonce-{random}'",  // 使用 nonce
            "style-src 'self' 'nonce-{random}'",
            "img-src 'self' data: https://cdn.example.com",
            "connect-src 'self' https://api.example.com",
            "font-src 'self' https://fonts.gstatic.com",
            "object-src 'none'",
            "frame-ancestors 'none'",
            "base-uri 'self'",
            "form-action 'self'",
            "upgrade-insecure-requests"
        );
    }
}

public class NonceFilter implements Filter {
    
    public static final String NONCE_KEY = "csp-nonce";
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                        FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        
        // 生成一次性 nonce
        String nonce = generateNonce();
        httpResponse.setHeader("Content-Security-Policy", 
            "script-src 'self' 'nonce-" + nonce + "'");
        
        // 将 nonce 存入 request attribute，供模板使用
        httpRequest.setAttribute(NONCE_KEY, nonce);
        
        chain.doFilter(httpRequest, httpResponse);
    }
}

@RestController
public class CspReportController {
    
    private static final Logger logger = LoggerFactory.getLogger(CspReportController.class);
    
    @PostMapping("/csp-report")
    public void reportCspViolation(@RequestBody CspReport report) {
        // 记录违规日志
        logger.warn("CSP Violation: {}", report);
        
        // 告警通知（可选）
        if (report.isSerious()) {
            alertSecurityTeam(report);
        }
    }
}

@Data
public class CspReport {
    private String documentUri;
    private String violatedDirective;
    private String originalPolicy;
    private String blockedUri;
    private String referrer;
    // ...
}

@Configuration
public class CookieConfig {
    
    @Bean
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
        
        // 启用 HttpOnly
        serializer.setUseHttpOnlyCookie(true);
        
        // 安全传输（HTTPS）
        serializer.setUseSecureCookie(true);
        
        // SameSite 属性
        serializer.setSameSite("Strict");
        
        return serializer;
    }
}

// Spring Security 配置 SameSite
http.securityMatcher("/api/**")
    .csrf(csrf -> csrf
        .cookie(cookie -> cookie
            .sameSite("Lax")));

// 直接设置
response.setHeader("Set-Cookie", 
    "sessionId=abc123; Path=/; SameSite=Lax; HttpOnly; Secure");

import org.owasp.html.PolicyFactory;
import org.owasp.html.Sanitizers;

public class HtmlSanitizer {
    
    /**
     * 定义安全的 HTML 策略
     */
    private static final PolicyFactory POLICY = new HtmlPolicyBuilder()
        // 允许的文本标签
        .allowElements("p", "br", "strong", "em", "b", "i", "u", "s",
                       "h1", "h2", "h3", "h4", "h5", "h6")
        
        // 允许的列表标签
        .allowElements("ul", "ol", "li")
        
        // 允许的代码标签
        .allowElements("code", "pre", "blockquote")
        
        // 允许链接（限制协议和属性）
        .allowAttributes("href").matching("^(https?|mailto):").onElements("a")
        .allowAttributes("target").onElements("a")
        .allowAttributes("rel").onElements("a")
        
        // 允许图片（限制来源）
        .allowAttributes("src").matching("^(https|data):").onElements("img")
        .allowAttributes("alt", "title", "width", "height").onElements("img")
        
        // 允许常见属性
        .allowAttributes("class", "id").onElements("*")
        
        // 禁止事件处理器
        .toFactory();
    
    /**
     * 净化用户输入的 HTML
     */
    public static String sanitize(String html) {
        if (html == null || html.isEmpty()) {
            return "";
        }
        return POLICY.sanitize(html);
    }
}