您的位置：首页 > 编程语言 > ASP

过滤危险字符的类（asp.net2.0）

2007-03-28 23:32 239 查看

^_^,是我从1.1复制到2.0的！
FilterRealProxy.cs文件

using System;
using System.IO;
using System.Text;
using System.Text.RegularExpressions;
using System.Runtime.Remoting;
using System.Runtime.Remoting.Proxies;
using System.Runtime.Remoting.Messaging;
using System.Reflection;

/// <summary>
/// FilterRealProxy 的摘要说明一个真实代理, 拦截它所代理对象中方法的返回值，并对需要过滤的返回值进行过滤。
///

/// </summary>
public class FilterRealProxy:RealProxy
{
private MarshalByRefObject target;
public FilterRealProxy()
{
//
// TODO: 在此处添加构造函数逻辑
//
}

public FilterRealProxy(MarshalByRefObject target)
: base(target.GetType())
{
this.target = target;
}

public override IMessage Invoke(IMessage msg)
{
IMethodCallMessage callMsg = msg as IMethodCallMessage;
IMethodReturnMessage returnMsg = RemotingServices.ExecuteMessage(target, callMsg);
//检查返回值是否为String,如果不是String,就没必要进行过滤
if (this.IsMatchType(returnMsg.ReturnValue))
{
string returnValue = this.Filter(returnMsg.ReturnValue.ToString(), returnMsg.MethodName);
return new ReturnMessage(returnValue, null, 0, null, callMsg);
}
return returnMsg;
}

protected string Filter(string ReturnValue, string MethodName)
{
MethodInfo methodInfo = target.GetType().GetMethod(MethodName);
object[] attributes = methodInfo.GetCustomAttributes(typeof(StringFilter), true);
foreach (object attrib in attributes)
{
return FilterHandler.Process(((StringFilter)attrib).FilterType, ReturnValue);
}
return ReturnValue;
}
protected bool IsMatchType(object obj)
{
return obj is System.String;
}

}

StringFilter.cs文件

FilterType.cs 文件

FilterHandler.cs文件

using System;
using System.IO;
using System.Text;
using System.Text.RegularExpressions;
using System.Runtime.Remoting;
using System.Runtime.Remoting.Proxies;
using System.Runtime.Remoting.Messaging;
using System.Reflection;

///<summary>
/// 过滤处理类：根据过滤类型，调用相应的过滤处理方法。
///</summary>

public class FilterHandler
{
private FilterHandler()
{
}
public static string Process(FilterType filterType, string filterContent)
{
switch (filterType)
{
case FilterType.Script:
filterContent = FilterScript(filterContent);
break;
case FilterType.Html:
filterContent = FilterHtml(filterContent);
break;
case FilterType.Object:
filterContent = FilterObject(filterContent);
break;
case FilterType.AHrefScript:
filterContent = FilterAHrefScript(filterContent);
break;
case FilterType.Iframe:
filterContent = FilterIframe(filterContent);
break;
case FilterType.Frameset:
filterContent = FilterFrameset(filterContent);
break;
case FilterType.Src:
filterContent = FilterSrc(filterContent);
break;
//case FilterType.Include:
// filterContent=FilterInclude(filterContent);
// break;
case FilterType.BadWords:
filterContent = FilterBadWords(filterContent);
break;
case FilterType.All:
filterContent = FilterAll(filterContent);
break;
default:
//do nothing
break;
}
return filterContent;
}

public static string FilterScript(string content)
{
string commentPattern = @"(?'comment'<!--.*?--[ /n/r]*>)";
string embeddedScriptComments = @"(///*.*?/*//|////.*?[/n/r])";
string scriptPattern = String.Format(@"(?'script'<[ /n/r]*script[^>]*>(.*?{0}?)*<[ /n/r]*/script[^>]*>)", embeddedScriptComments);
// 包含注释和Script语句
string pattern = String.Format(@"(?s)({0}|{1})", commentPattern, scriptPattern);

return StripScriptAttributesFromTags(Regex.Replace(content, pattern, string.Empty, RegexOptions.IgnoreCase));
}

private static string StripScriptAttributesFromTags(string content)
{
string eventAttribs = @"on(blur|c(hange|lick)|dblclick|focus|keypress|(key|mouse)(down|up)|(un)?load
|mouse(move|o(ut|ver))|reset|s(elect|ubmit))";

string pattern = String.Format(@"(?inx)
/<(/w+)/s+
(
(?'attribute'
(?'attributeName'{0})/s*=/s*
(?'delim'['""]?)
(?'attributeValue'[^'"">]+)
(/3)
)
|
(?'attribute'
(?'attributeName'href)/s*=/s*
(?'delim'['""]?)
(?'attributeValue'javascript[^'"">]+)
(/3)
)
|
[^>]
)*
/>", eventAttribs);
Regex re = new Regex(pattern);
// 使用MatchEvaluator的委托
return re.Replace(content, new MatchEvaluator(StripAttributesHandler));
}

private static string StripAttributesHandler(Match m)
{
if (m.Groups["attribute"].Success)
{
return m.Value.Replace(m.Groups["attribute"].Value, "");
}
else
{
return m.Value;
}
}

public static string FilterAHrefScript(string content)
{
string newstr = FilterScript(content);
string regexstr = @" href[ ^=]*= *[/s/S]*script *:";
return Regex.Replace(newstr, regexstr, string.Empty, RegexOptions.IgnoreCase);
}

public static string FilterSrc(string content)
{
string newstr = FilterScript(content);
string regexstr = @" src *= *['""]?[^/.]+/.(js|vbs|asp|aspx|php|jsp)['""]";
return Regex.Replace(newstr, regexstr, @"", RegexOptions.IgnoreCase);
}
/**/
/*
public static string FilterInclude(string content)
{
string newstr=FilterScript(content);
string *include]regexstr=@"<[/s/S]*include *(file|virtual) *= *[/s/S]*/.(js|vbs|asp|aspx|php|jsp)[^>]*>";
return Regex.Replace(newstr,regexstr,string.Empty,RegexOptions.IgnoreCase);
}
*/
public static string FilterHtml(string content)
{
string newstr = FilterScript(content);
string regexstr = @"<[^>]*>";
return Regex.Replace(newstr, regexstr, string.Empty, RegexOptions.IgnoreCase);
}

public static string FilterObject(string content)
{
string regexstr = @"(?i)<Object([^>])*>(/w|/W)*</Object([^>])*>";
return Regex.Replace(content, regexstr, string.Empty, RegexOptions.IgnoreCase);
}

public static string FilterIframe(string content)
{
string regexstr = @"(?i)<Iframe([^>])*>(/w|/W)*</Iframe([^>])*>";
return Regex.Replace(content, regexstr, string.Empty, RegexOptions.IgnoreCase);
}

public static string FilterFrameset(string content)
{
string regexstr = @"(?i)<Frameset([^>])*>(/w|/W)*</Frameset([^>])*>";
return Regex.Replace(content, regexstr, string.Empty, RegexOptions.IgnoreCase);
}

//移除非法或不友好字符
private static string FilterBadWords(string chkStr)
{
//这里的非法和不友好字符由你任意加，用“|”分隔，支持正则表达式,由于本Blog禁止贴非法和不友好字符，所以这里无法加上。
string BadWords = @"";
if (chkStr == "")
{
return "";
}

string[] bwords = BadWords.Split('#');
int i, j;
string str;
StringBuilder sb = new StringBuilder();
for (i = 0; i < bwords.Length; i++)
{
str = bwords[i].ToString().Trim();
string regStr, toStr;
regStr = str;
Regex r = new Regex(regStr, RegexOptions.IgnoreCase | RegexOptions.Singleline | RegexOptions.Multiline);
Match m = r.Match(chkStr);
if (m.Success)
{
j = m.Value.Length;
sb.Insert(0, "*", j);
toStr = sb.ToString();
chkStr = Regex.Replace(chkStr, regStr, toStr, RegexOptions.IgnoreCase | RegexOptions.Singleline | RegexOptions.Multiline);
}
sb.Remove(0, sb.Length);
}
return chkStr;
}

public static string FilterAll(string content)
{
content = FilterHtml(content);
content = FilterScript(content);
content = FilterAHrefScript(content);
content = FilterObject(content);
content = FilterIframe(content);
content = FilterFrameset(content);
content = FilterSrc(content);
content = FilterBadWords(content);
//content = FilterInclude(content);
return content;
}
}

花了不少时间找，花了不少时间复制。编译通过后，在页面中添加了个文本框输入几个html字符测试一下，弹出这么错误：
应用程序中的服务器错误。

从客户端(TextBox1="<html>women</html>")中检测到有潜在危险的 Request.Form 值。

说明: 请求验证过程检测到有潜在危险的客户端输入值，对请求的处理已经中止。该值可能指示危及应用程序安全的尝试，如跨站点的脚本攻击。通过在 Page 指令或

配置节中设置 validateRequest=false 可以禁用请求验证。但是，在这种情况下，强烈建议应用程序显式检查所有输入。

异常详细信息: System.Web.HttpRequestValidationException: 从客户端(TextBox1="<html>women</html>")中检测到有潜在危险的 Request.Form 值。

悲呼哉！我仅想生成xml文件的时候不允许输入html标记而已！忘了.net文本框本身就可以验证一下了……

不过这也是个好东西（虽然看不（大）懂）……这次也要用，配置成validateRequest=false 我也要用！呵呵……

内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理

标签：

相关文章推荐

新的分享

章节导航