跨站脚本攻击(Cross Site Scripting)，为不和层叠样式表(Cascading Style Sheets, CSS)的缩写混淆，故将跨站脚本攻击缩写为XSS。恶意攻击者往Web页面里插入恶意Script代码，当用户浏览该页之时，嵌入其中Web里面的Script代码会被执行，从而达到恶意攻击用户的特殊目的。
很多时候，我们并不需要屏蔽所有的HTML标签，或者，我们需要设置某些属性支持的HTML标签字符串。还好，框架中封装了相关的特性，以便你直接拿来使用。
命名空间：Magicodes.WeiChat.Infrastructure.MvcExtension.Filters
类名：AntiXssAttribute
Demo：
[AntiXss] public string Name { get; set; } [AntiXss(allowedStrings: "<br />,<p>")] public string Description { get; set; } [AntiXss(allowedStrings: "<br />", disallowedStrings:"/, #")] public string NoSlashesOrHashes { get; set; } [AntiXss(errorMessage: "This is a custom error message")] public string CustomError { get; set; } [AntiXss(errorMessageResourceName:"TestMessage", errorMessageResourceType: typeof(TestResources))] public string ResourceCustomError { get; set; }
具体代码如下所示：
/// <summary> /// AntiXss验证特性，防止XSS攻击 /// </summary> [AttributeUsage(AttributeTargets.Property, AllowMultiple = false, Inherited = true)] public class AntiXssAttribute : ValidationAttribute { const string DefaultValidationMessageFormat = "字段 {0} XSS验证失败，请检查输入的字符串中是否含有非法字符。"; private readonly string errorMessage; private readonly string errorMessageResourceName; private readonly Type errorMessageResourceType; private readonly string allowedStrings; private readonly string disallowedStrings; private readonly Dictionary<string, string> allowedStringsDictionary; /// <summary> /// 初始化 <see cref="AntiXssAttribute"/> 的新实例. /// </summary> /// <param name="errorMessage">错误消息</param> /// <param name="errorMessageResourceName">获取或设置错误消息资源的名称，在验证失败的情况下，要使用该名称来查找 ErrorMessageResourceType 属性值</param> /// <param name="errorMessageResourceType">获取或设置在验证失败的情况下用于查找错误消息的资源类型。</param> /// <param name="allowedStrings">以逗号分隔的允许的字符串。</param> /// <param name="disallowedStrings">以逗号分隔的字符串不允许的字符或单词</param> public AntiXssAttribute( string errorMessage = null, string errorMessageResourceName = null, Type errorMessageResourceType = null, string allowedStrings = null, string disallowedStrings = null) { this.errorMessage = errorMessage; this.errorMessageResourceName = errorMessageResourceName; this.errorMessageResourceType = errorMessageResourceType; this.allowedStrings = allowedStrings; this.disallowedStrings = disallowedStrings; allowedStringsDictionary = new Dictionary<string, string>(); } /// <summary> /// 确定对象的指定值是否有效。 /// </summary> /// <param name="value"></param> /// <returns></returns> public override bool IsValid(object value) { return true; } /// <summary> /// 确定对象的指定值是否有效。 /// </summary> /// <param name="value"></param> /// <param name="validationContext"></param> /// <returns></returns> protected override ValidationResult IsValid(object value, ValidationContext validationContext) { if (value == null) { return base.IsValid(null, validationContext); } var encodedValue = EncoderHelper.HtmlEncode(value.ToString(), false); if (EncodedStringAndValueAreDifferent(value, encodedValue)) { SetupAllowedStringsDictionary(); foreach (var allowedString in allowedStringsDictionary) { encodedValue = encodedValue.Replace(allowedString.Value, allowedString.Key); } if (EncodedStringAndValueAreDifferent(value, encodedValue)) { return new ValidationResult(SetErrorMessage(validationContext)); } } if (!string.IsNullOrWhiteSpace(disallowedStrings) && disallowedStrings.Split(',').Select(x => x.Trim()).Any(x => value.ToString().Contains(x))) { return new ValidationResult(SetErrorMessage(validationContext)); } return base.IsValid(value, validationContext); } private static bool EncodedStringAndValueAreDifferent(object value, string encodedValue) { return !value.ToString().Equals(encodedValue); } private void SetupAllowedStringsDictionary() { if (string.IsNullOrWhiteSpace(allowedStrings)) { return; } foreach (var allowedString in allowedStrings.Split(',').Select(x => x.Trim()) .Where(allowedString => !allowedStringsDictionary.ContainsKey(allowedString))) { allowedStringsDictionary.Add(allowedString, EncoderHelper.HtmlEncode(allowedString, false)); } } /// <summary> /// 设置错误消息 /// </summary> /// <param name="validationContext"></param> /// <returns></returns> private string SetErrorMessage(ValidationContext validationContext) { if (IsResourceErrorMessage()) { var resourceManager = new ResourceManager(errorMessageResourceType); return resourceManager.GetString(errorMessageResourceName, CultureInfo.CurrentCulture); } if (!string.IsNullOrEmpty(errorMessage)) { return errorMessage; } return string.Format(DefaultValidationMessageFormat, validationContext.DisplayName); } private bool IsResourceErrorMessage() { return !string.IsNullOrEmpty(errorMessageResourceName) && errorMessageResourceType != null; } }
