三、根据XSS攻击的效果可以分为几种类型

XSS反射型攻击：恶意代码并没有保存在目标网站，通过引诱用户点击一个链接到目标网站的恶意链接来实施攻击的。

XSS存储型攻击：恶意代码被保存到目标网站的服务器中，这种攻击具有较强的稳定性和持久性，比较常见场景是在博客，论坛等社交网站上，但OA系统，和CRM系统上也能看到它身影，比如：某CRM系统的客户投诉功能上存在XSS存储型漏洞，黑客提交了恶意攻击代码，当系统管理员查看投诉信息时恶意代码执行，窃取了客户的资料，然而管理员毫不知情，这就是典型的XSS存储型攻击。

四、XSS攻击能做些什么

1.窃取cookies,读取目标网站的cookie发送到黑客的服务器上

 2.读取用户未公开的资料，如果：邮件列表或者内容、系统的客户资料。联系人列表等等

1. 可以窃取 Cookie 信息。恶意 JavaScript 可以通过“document.cookie”获取 Cookie 信息，然后通过 XMLHttpRequest 或者 Fetch 加上 CORS 功能将数据发送给恶意服务器；恶意服务器拿到用户的 Cookie 信息之后，就可以在其他电脑上模拟用户的登录，然后进行转账等操 作。
2. 可以监听用户行为。恶意 JavaScript 可以使用“addEventListener”接口来监听键盘事件，比如可以获取用户输入的信用卡等信息，将其发送 到恶意服务器。黑客掌握了这些信息之后，又可以做很多违法的事情。
3. 可以通过修改 DOM伪造假的登录窗口，用来欺骗用户输入用户名和密码等信息。
4. 还可以在页面内生成浮窗广告，这些广告会严重地影响用户体验。

五、解决办法

<filter>  <filter-name>XssEscape</filter-name>  <filter-class>XssFilter</filter-class>  </filter>  <filter-mapping>  <filter-name>XssEscape</filter-name>  <url-pattern>/*</url-pattern>  </filter-mapping>

 5.1.2 XssFilter实现：

public class XssFilter implements Filter {@Overridepublic void init(FilterConfig filterConfig) throws ServletException {}@Overridepublic void doFilter(ServletRequest request, ServletResponse response,FilterChain chain) throws IOException, ServletException {chain.doFilter(new XssHttpServletRequestWrapper((HttpServletRequest) request), response);}@Overridepublic void destroy() {}  
}

5.1.3 　XssHttpServletRequestWrapper实现：

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {public XssHttpServletRequestWrapper(HttpServletRequest request) {super(request);}@SuppressWarnings("rawtypes")public Map<String,String[]> getParameterMap(){Map<String,String[]> request_map = super.getParameterMap();Iterator iterator = request_map.entrySet().iterator();while(iterator.hasNext()){Map.Entry me = (Map.Entry)iterator.next();String[] values = (String[])me.getValue();for(int i = 0 ; i < values.length ; i++){values[i] = xssClean(values[i]);}}return request_map;}public String[] getParameterValues(String paramString){String[] arrayOfString1 = super.getParameterValues(paramString);if (arrayOfString1 == null)return null;int i = arrayOfString1.length;String[] arrayOfString2 = new String[i];for (int j = 0; j < i; j++){arrayOfString2[j] = xssClean(arrayOfString1[j]);}return arrayOfString2;}public String getParameter(String paramString){String str = super.getParameter(paramString);if (str == null)return null;return xssClean(str);}public String getHeader(String paramString){String str = super.getHeader(paramString);if (str == null)return null;str = str.replaceAll("\r|\n", "");return xssClean(str);}private String xssClean(String value) {//ClassLoaderUtils.getResourceAsStream("classpath:antisamy-slashdot.xml", XssHttpServletRequestWrapper.class)if (value != null) {// NOTE: It's highly recommended to use the ESAPI library and// uncomment the following line to// avoid encoded attacks.// value = encoder.canonicalize(value);value = value.replaceAll("\0", "");// Avoid anything between script tagsPattern scriptPattern = Pattern.compile("<script>(.*?)</script>",Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid anything in a src='...' type of expressionscriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE| Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid anything in a href='...' type of expressionscriptPattern = Pattern.compile("href[\r\n]*=[\r\n]*\\\"(.*?)\\\"",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE| Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome </script> tagscriptPattern = Pattern.compile("</script>",Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Remove any lonesome <script ...> tagscriptPattern = Pattern.compile("<script(.*?)>",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE| Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid eval(...) expressionsscriptPattern = Pattern.compile("eval\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE| Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid expression(...) expressionsscriptPattern = Pattern.compile("expression\\((.*?)\\)",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE| Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");// Avoid javascript:... expressionsscriptPattern = Pattern.compile("javascript:",Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid vbscript:... expressionsscriptPattern = Pattern.compile("vbscript:",Pattern.CASE_INSENSITIVE);value = scriptPattern.matcher(value).replaceAll("");// Avoid οnlοad= expressionsscriptPattern = Pattern.compile("onload(.*?)=",Pattern.CASE_INSENSITIVE | Pattern.MULTILINE| Pattern.DOTALL);value = scriptPattern.matcher(value).replaceAll("");}  return value; }
}