XSS 与 CSRF 防御实战

// ❌ 危险的 DOM 操作
const hash = window.location.hash.substring(1);
document.write(hash);  // #<img src=x onerror=alert(1)>

// ❌ innerHTML 直接插入用户输入
document.getElementById('output').innerHTML = userInput;

// ✅ 使用 textContent
const div = document.getElementById('output');
div.textContent = userInput;  // 自动转义 HTML

// ✅ URL 片段安全处理
const urlParams = new URLSearchParams(window.location.search);
const name = urlParams.get('name');
// 不要直接插入 DOM，必须经过转义或安全处理

// OWASP Java Encoder
import org.owasp.encoder.Encode;

public class XssUtil {
    public static String forHtml(String input) {
        return Encode.forHtml(input);
        // < → &lt;   > → &gt;   " → &quot;   ' → &#x27;   & → &amp;
    }
    
    public static String forJavaScript(String input) {
        return Encode.forJavaScript(input);
    }
    
    public static String forHtmlAttribute(String input) {
        return Encode.forHtmlAttribute(input);
    }
    
    public static String forCssString(String input) {
        return Encode.forCssString(input);
    }
    
    public static String forUriComponent(String input) {
        return Encode.forUriComponent(input);
    }
}

@Pattern(regexp = "[a-zA-Z0-9_]{3,20}", message = "用户名格式错误")
private String username;

@SafeHtml(whitelistType = SafeHtml.WhiteListType.NONE)
private String comment;

// 在控制器层统一处理
@InitBinder
public void initBinder(WebDataBinder binder) {
    StringTrimmerEditor editor = new StringTrimmerEditor(false);
    binder.registerCustomEditor(String.class, editor);
}

Content-Security-Policy: 
  default-src 'self';
  script-src 'self' https://cdn.example.com 'nonce-abc123';
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: https:;
  connect-src 'self' https://api.example.com;
  font-src 'self' https://fonts.googleapis.com;
  frame-ancestors 'none';
  base-uri 'self';
  form-action 'self';

// 后端生成随机 nonce
String nonce = UUID.randomUUID().toString();
response.setHeader("Content-Security-Policy", 
    "script-src 'self' 'nonce-" + nonce + "'");
model.addAttribute("cspNonce", nonce);

<!-- Thymeleaf 模板 -->
<script th:nonce="${cspNonce}">
  // 合法的内联脚本
</script>

# HttpOnly Cookie（XSS 无法读取 Cookie）
Set-Cookie: sessionid=xxx; HttpOnly; Secure; SameSite=Strict

# X-XSS-Protection（浏览器内置，现代浏览器已弃用，依赖 CSP 即可）
X-XSS-Protection: 0

// Spring Security 自动配置
@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()));
        return http.build();
    }
}

// HTML 表单中嵌入 Token
<form method="post" action="/transfer">
    <input type="hidden" name="_csrf" value="${_csrf.token}"/>
    <!-- 或使用请求头（AJAX） -->
</form>

// AJAX 请求自动携带
fetch('/api/transfer', {
    method: 'POST',
    headers: {
        'X-CSRF-TOKEN': getCsrfTokenFromCookie()  // 从 Cookie 读取
    }
});

// 服务端验证：请求中的 Token 必须与 Session/Cookie 中的匹配

Set-Cookie: sessionid=xxx; SameSite=Strict; Secure

// Spring Boot 配置
server.servlet.session.cookie.same-site=lax

// 自定义 Double Cookie 过滤器
public class DoubleCookieCsrfFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest req, 
                                     HttpServletResponse res, 
                                     FilterChain chain) {
        if ("POST".equals(req.getMethod())) {
            String cookieToken = getCookieValue(req, "csrf_token");
            String headerToken = req.getHeader("X-CSRF-Token");
            
            if (cookieToken == null || !cookieToken.equals(headerToken)) {
                res.setStatus(HttpServletResponse.SC_FORBIDDEN);
                return;
            }
        }
        chain.doFilter(req, res);
    }
}

// 检查请求来源
String origin = request.getHeader("Origin");
String referer = request.getHeader("Referer");

if (origin == null || !origin.equals("https://example.com")) {
    throw new CsrfException();
}