springboot清除字符串前后空格与防xss攻击方法

protected ConfigurableWebBindingInitializer getConfigurableWebBindingInitializer() {

     try {

         //从容器中获取

         return (ConfigurableWebBindingInitializer) this .beanFactory.getBean(ConfigurableWebBindingInitializer. class );

     } catch (NoSuchBeanDefinitionException ex) {

       return super .getConfigurableWebBindingInitializer();

     }

/**

      *

      * @description 与spring mvc的@InitBinder结合 用于防止XSS攻击

      */

      class StringEscapeEditor extends PropertyEditorSupport {

         /** 转义HTML */

         private boolean escapeHTML;

         /** 转义javascript */

         private boolean escapeJavaScript;

         /** 是否将空字符串转换为null */

         private final boolean emptyAsNull;

         /** 是否去掉前后空格 */

         private final boolean trimmed;

         public StringEscapeEditor() {

             this ( true , true , false , true );

         }

         public StringEscapeEditor( boolean escapeHTML, boolean escapeJavaScript) {

             this ( true , true ,escapeHTML,escapeJavaScript);

         }

         public StringEscapeEditor( boolean emptyAsNull, boolean trimmed, boolean escapeHTML, boolean escapeJavaScript) {

             super ();

             this .emptyAsNull = emptyAsNull;

             this .trimmed = trimmed;

             this .escapeHTML = escapeHTML;

             this .escapeJavaScript = escapeJavaScript;

         }

         @Override

         public String getAsText() {

             Object value = getValue();

             if (Objects.nonNull(value))

             {

                 return value.toString();

             }

             return value != null ? value.toString() : null ;

         }

         @Override

         public void setAsText(String text) throws IllegalArgumentException {

             String value = text;

             if (value == null || emptyAsNull && text.isEmpty()) {

                 //do nothing

             } else if (trimmed) {

                 //去字符传参数前后空格

                 value = value.trim();

             }

             if (escapeHTML) {

                 //HTML转义（防止XSS攻击）

                 //HtmlUtils.htmlEscape 默认的是ISO-8859-1编码格式，会将中文的某些符号进行转义。

                 //如果不想让中文符号进行转义请使用UTF-8的编码格式。例如：HtmlUtils.htmlEscape(text, "UTF-8")

                 value = HtmlUtils.htmlEscape(value, "UTF-8" );

             }

             if (escapeJavaScript) {

                 //javascript转义（防止XSS攻击）

                 value = JavaScriptUtils.javaScriptEscape(value);

             }

             setValue(value);

         }

     }

@Configuration

public class WebBindingInitializerConfiguration {

     @Bean

     public ConfigurableWebBindingInitializer getConfigurableWebBindingInitializer() {

         ConfigurableWebBindingInitializer initializer = new ConfigurableWebBindingInitializer();

         FormattingConversionService conversionService = new DefaultFormattingConversionService();

         //we can add our custom converters and formatters

         //conversionService.addConverter(...);

         //conversionService.addFormatter(...);

         initializer.setConversionService(conversionService);

         //we can set our custom validator

         //initializer.setValidator(....);

         //here we are setting a custom PropertyEditor

         initializer.setPropertyEditorRegistrar(propertyEditorRegistry -> {

             propertyEditorRegistry.registerCustomEditor(String. class ,

                     new StringEscapeEditor());

         });

         return initializer;

     }

}

@Component

@WebFilter (urlPatterns = "/**" , filterName = "ParamsFilter" , dispatcherTypes = DispatcherType.REQUEST)

public class ParamsFilter implements Filter {

     @Override

     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)

             throws IOException, ServletException {

         ParameterRequestWrapper parmsRequest = new ParameterRequestWrapper((HttpServletRequest) request);

         chain.doFilter(parmsRequest, response);

     }

     @Override

     public void init(FilterConfig filterConfig) throws ServletException {

     }

     @Override

     public void destroy() {

     }

}

import java.io.ByteArrayInputStream;

import java.io.IOException;

import java.util.ArrayList;

import java.util.HashMap;

import java.util.Iterator;

import java.util.List;

import java.util.Map;

import java.util.Set;

import javax.servlet.ReadListener;

import javax.servlet.ServletInputStream;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;

import com.alibaba.fastjson.JSONArray;

import com.alibaba.fastjson.JSONObject;

import org.apache.commons.io.IOUtils;

import org.apache.commons.lang3.StringUtils;

import org.springframework.http.HttpHeaders;

import org.springframework.http.MediaType;

import com.alibaba.fastjson.JSON;

/**

  * @author :

  * @description

  * @date : 2021/4/22

  */

public class ParameterRequestWrapper extends HttpServletRequestWrapper {

     private Map<String , String[]> params = new HashMap<>();

     public ParameterRequestWrapper(HttpServletRequest request) {

         super (request);

         Map<String, String[]> requestMap=request.getParameterMap();

         this .params.putAll(requestMap);

         this .modifyParameterValues();

     }

     @Override

     public ServletInputStream getInputStream() throws IOException {

         if (! super .getHeader(HttpHeaders.CONTENT_TYPE).equalsIgnoreCase(MediaType.APPLICATION_JSON_VALUE)){

             return super .getInputStream();

         }

         String json = IOUtils.toString( super .getInputStream(), "utf-8" );

         if (StringUtils.isEmpty(json)) {

             return super .getInputStream();

         }

         Map<String,Object> map= jsonStringToMap(json);

         ByteArrayInputStream bis = new ByteArrayInputStream(JSON.toJSONString(map).getBytes( "utf-8" ));

         return new MyServletInputStream(bis);

     }

     public void modifyParameterValues(){

         Set<String> set = params.keySet();

         Iterator<String> it = set.iterator();

         while (it.hasNext()){

             String key= it.next();

             String[] values = params.get(key);

             values[ 0 ] = values[ 0 ].trim();

             params.put(key, values);

         }

     }

     @Override

     public String getParameter(String name) {

         String[]values = params.get(name);

         if (values == null || values.length == 0 ) {

             return null ;

         }

         return values[ 0 ];

     }

     @Override

     public String[] getParameterValues(String name) {

         return params.get(name);

     }

     class MyServletInputStream extends ServletInputStream {

         private ByteArrayInputStream bis;

         public MyServletInputStream(ByteArrayInputStream bis){

             this .bis=bis;

         }

         @Override

         public boolean isFinished() {

             return true ;

         }

         @Override

         public boolean isReady() {

             return true ;

         }

         @Override

         public void setReadListener(ReadListener listener) {

         }

         @Override

         public int read(){

             return bis.read();

         }

     }

     public static Map<String, Object> jsonStringToMap(String jsonString) {

         Map<String, Object> map = new HashMap<>();

         JSONObject jsonObject = JSONObject.parseObject(jsonString);

         for (Object k : jsonObject.keySet()) {

             Object o = jsonObject.get(k);

             if (o instanceof JSONArray) {

                 List<Map<String, Object>> list = new ArrayList<>();

                 Iterator<Object> it = ((JSONArray) o).iterator();

                 while (it.hasNext()) {

                     Object obj = it.next();

                     list.add(jsonStringToMap(obj.toString()));

                 }

                 map.put(k.toString(), list);

             } else if (o instanceof JSONObject) {

                 map.put(k.toString(), jsonStringToMap(o.toString()));

             } else {

                 if (o instanceof String) {

                     map.put(k.toString(), o.toString().trim());

                 } else {

                     map.put(k.toString(), o);

                 }

             }

         }

         return map;

     }

}