我如何防止盲XSS在javaSpring引导在@quiestBody

Question

目前，api看起来像：-

@Autowired
private EmployeeService empService;

@ApiOperation(value = "adds a new Employee")
@PostMapping(value = /add)
public EmployeeDetails employeeDetails(@RequestBody @Valid @NotNull EmployeeDetails empDetails) {
        empservice.addNewEmployee(empDetails);
    }

员工详情：-

import lombok.Data;

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
@Entity
@Data
public class EmployeeDetails {
    
    private Long id;

    private String firstName;

    private String lastName;

    @Override
    public String toString() {
        return "EmployeeDetails{" +
                "id=" + id +
                ", firstName='" + firstName + '\'' +
                ", lastName='" + lastName + '\'' +
                '}';
    }
}

所以问题是要避免xss攻击

例如，如果它是这段代码

或

如果我们在ID的情况下给1.2，那么响应是200

我该怎么解决




Answer 1

您可以使用Hibernate validator中的@SafeHtml注释

@Entity
@Data
@SafeHtml //this do the trick
public class EmployeeDetails {
    
    private Long id;

    private String firstName;

    private String lastName;

    @Override
    public String toString() {
        return "EmployeeDetails{" +
                "id=" + id +
                ", firstName='" + firstName + '\'' +
                ", lastName='" + lastName + '\'' +
                '}';
    }
}

请参见以下示例：https://www.javatips.net/blog/anti-cross-site-scripting-xss-for-java-web-application

此外，还可以实现自定义过滤器来转义html的字符。参见此处：XSS保护请求正文中的Spring Boot转义字符