Package de.hybris.platform.servicelayer.web

Class XSSFilter

java.lang.Object

de.hybris.platform.servicelayer.web.XSSFilter

All Implemented Interfaces:

javax.servlet.Filter

public class XSSFilter
extends java.lang.Object
implements javax.servlet.Filter

Filter that wraps requests to XSSRequestWrapper to sanitize inputs for XSS.

Utilizes HttpServletRequestWrapper that sanitize requests inputs to mitigate risks of XSS scripts being passed over. This code is based on free and non-restricted code found at: http://ricardozuasti.com/2012/stronger-anti-cross-site-scripting-xss-filter-for-java-web-apps/

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static interface	XSSFilter.XSSFilterConfig	Interface to inject configuration parameters into XSSFilter without exposing the actual implementation of how these parameters are obtained.
static interface	XSSFilter.XSSValueTranslator	Interface to encapsulate the actual processing of parameter and header values.

Field Summary

Fields

Modifier and Type	Field	Description
static java.lang.String	CONFIG_ACTION
static java.lang.String	CONFIG_ENABLED
protected static java.lang.String	CONFIG_HEADER_PREFIX
static java.lang.String	CONFIG_HEADER_PREFIX_REGEXP
static java.lang.String	CONFIG_PARAM_PREFIX
static java.lang.String	CONFIG_RULE_PREFIX_REGEXP
static java.lang.String	CONFIG_SORT
static java.lang.String	HOST_HEADER_WHITE_LIST_PREFIX
protected static org.apache.log4j.Logger	LOG
protected static java.lang.String	REJECTED_REQUEST_RESP_CONTENT

Constructor Summary

Constructors

Constructor	Description
XSSFilter()

Method Summary

Modifier and Type	Method	Description
protected java.util.List<java.util.regex.Pattern>	compilePatterns(java.util.Map<java.lang.String,java.lang.String> rules)
void	destroy()
void	doFilter(javax.servlet.ServletRequest servletRequest, javax.servlet.ServletResponse servletResponse, javax.servlet.FilterChain filterChain)
protected java.lang.String	getSetupInfo()
void	init(javax.servlet.FilterConfig filterConfig)
protected void	initFromConfig(XSSFilter.XSSFilterConfig config)
protected void	initPatternsAndHeaders(boolean enabled, java.util.Map<java.lang.String,java.lang.String> patternDefinitions, java.util.Map<java.lang.String,java.lang.String> headers)
protected void	processPatternsAndDoFilter(javax.servlet.ServletRequest servletRequest, javax.servlet.ServletResponse servletResponse, javax.servlet.FilterChain filterChain)
void	reloadOnConfigChange()
protected void	setRejectResponseCodes(javax.servlet.http.HttpServletResponse httpResponse)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

LOG

protected static org.apache.log4j.Logger LOG

CONFIG_PARAM_PREFIX

public static final java.lang.String CONFIG_PARAM_PREFIX

See Also:

Constant Field Values

CONFIG_RULE_PREFIX_REGEXP

public static final java.lang.String CONFIG_RULE_PREFIX_REGEXP

See Also:

Constant Field Values

CONFIG_HEADER_PREFIX_REGEXP

public static final java.lang.String CONFIG_HEADER_PREFIX_REGEXP

See Also:

Constant Field Values

CONFIG_HEADER_PREFIX

protected static final java.lang.String CONFIG_HEADER_PREFIX

See Also:

Constant Field Values

CONFIG_ENABLED

public static final java.lang.String CONFIG_ENABLED

See Also:

Constant Field Values

CONFIG_SORT

public static final java.lang.String CONFIG_SORT

See Also:

Constant Field Values

CONFIG_ACTION

public static final java.lang.String CONFIG_ACTION

See Also:

Constant Field Values

HOST_HEADER_WHITE_LIST_PREFIX

public static final java.lang.String HOST_HEADER_WHITE_LIST_PREFIX

See Also:

Constant Field Values

REJECTED_REQUEST_RESP_CONTENT

protected static final java.lang.String REJECTED_REQUEST_RESP_CONTENT

See Also:

Constant Field Values

Constructor Detail

XSSFilter

public XSSFilter()

Method Detail

init

public void init(javax.servlet.FilterConfig filterConfig)
          throws javax.servlet.ServletException

Specified by:

init in interface javax.servlet.Filter

Throws:

javax.servlet.ServletException

initFromConfig

protected void initFromConfig(XSSFilter.XSSFilterConfig config)

initPatternsAndHeaders

protected void initPatternsAndHeaders(boolean enabled,
                                      java.util.Map<java.lang.String,java.lang.String> patternDefinitions,
                                      java.util.Map<java.lang.String,java.lang.String> headers)

reloadOnConfigChange

public void reloadOnConfigChange()

compilePatterns

protected java.util.List<java.util.regex.Pattern> compilePatterns(java.util.Map<java.lang.String,java.lang.String> rules)

getSetupInfo

protected java.lang.String getSetupInfo()

doFilter

public void doFilter(javax.servlet.ServletRequest servletRequest,
                     javax.servlet.ServletResponse servletResponse,
                     javax.servlet.FilterChain filterChain)
              throws java.io.IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

java.io.IOException

javax.servlet.ServletException

processPatternsAndDoFilter

protected void processPatternsAndDoFilter(javax.servlet.ServletRequest servletRequest,
                                          javax.servlet.ServletResponse servletResponse,
                                          javax.servlet.FilterChain filterChain)
                                   throws java.io.IOException,
                                          javax.servlet.ServletException

Throws:

java.io.IOException

javax.servlet.ServletException

setRejectResponseCodes

protected void setRejectResponseCodes(javax.servlet.http.HttpServletResponse httpResponse)
                               throws java.io.IOException

Throws:

java.io.IOException

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter