AppScan安全扫描记录遇到的一些问题

sql注入&跨站点脚本编制&通过框架钓鱼

&链接注入（便于跨站请求伪造）

————————————————
版权声明：下文为CSDN博主「风轻云淡」的原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/qq_16855077/article/details/100156100

XssFilter

package com.cloudtech.web.filter;
 
import java.io.IOException;
 
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
 
/**
 *
 * 拦截防止sql注入、xss注入 
 */
public class XssFilter implements Filter {
   
 
    /* (non-Javadoc)
     * @see javax.servlet.Filter#doFilter(javax.servlet.ServletRequest, javax.servlet.ServletResponse, javax.servlet.FilterChain)
     */
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)throws IOException,ServletException {
   
 
        XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(
            (HttpServletRequest) request);
        filterChain.doFilter(xssRequest, response);
 
    }
 
    @Override
    public void destroy() {
   
 
    }
 
    @Override
    public void init(FilterConfig arg0) throws ServletException {
   
 
    }
 
}

XssHttpServletRequestWrapper

package com.cloudtech.web.filter;
 
 
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.util.StringUtils;
 
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
 
/**
 * 防止sql注入,xss攻击
 * 前端可以对输入信息做预处理，后端也可以做处理。
 */
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
   
    private final Logger log = LoggerFactory.getLogger(getClass());
    private static String key = "and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|;|or|-|+|'|%27|%3B";
    private static Set<String> notAllowedKeyWords = new HashSet<String>(0);
    private static String replacedString="INVALID";
    static {
   
        String keyStr[] = key.split("\\|");
        for (String str : keyStr) {
   
            notAllowedKeyWords.add(str);
        }
    }
 
    private String currentUrl;
 
    public XssHttpServletRequestWrapper(HttpServletRequest servletRequest) {
   
        super(servletRequest);
        currentUrl = servletRequest.