找了幾個(gè)java后臺(tái)攔截xss的代碼，大致都是下面這樣

package com.ibm.web.beans;



import java.util.Enumeration;



import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;



public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {  

    public XssHttpServletRequestWrapper(HttpServletRequest servletRequest) {

        super(servletRequest);

    }

    public String[] getParameterValues(String parameter) {

      String[] values = super.getParameterValues(parameter);

      if (values==null)  {

                  return null;

          }

      int count = values.length;

      String[] encodedValues = new String[count];

      for (int i = 0; i < count; i++) {

                 encodedValues[i] = cleanXSS(values[i]);

       }

      return encodedValues;

    }

    public String getParameter(String parameter) {

          String value = super.getParameter(parameter);

          if (value == null) {

                 return null;

                  }

          return cleanXSS(value);

    }

    public String getHeader(String name) {

        String value = super.getHeader(name);

        if (value == null)

            return null;

        return cleanXSS(value);

    }

    private String cleanXSS(String value) {

                //You'll need to remove the spaces from the html entities below

        value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");

        value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;");

        value = value.replaceAll("'", "& #39;");

        value = value.replaceAll("eval\\((.*)\\)", "");

        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");

        value = value.replaceAll("script", "");

        return value;

    }



}

這里只對(duì)param做了轉(zhuǎn)義，請(qǐng)問(wèn)如何對(duì)ajax的json請(qǐng)求進(jìn)行轉(zhuǎn)義？

前臺(tái)代碼

$.ajaxSetup({
    contentType: 'application/json'
});

var obj = {"name" : "'", "code" : "<script>"}
$.post("/submit", JSON.stringify(obj), function (result, status) {
    alert('ok');
}, "json");

后臺(tái)代碼

@RequestMapping(value = "/submit", method = RequestMethod.POST)
public void submit(@RequestBody Student student) {
    System.out.println(student.getName());
    System.out.println(student.getCode());
}

這里對(duì)ajax提交的json代碼就沒(méi)有做轉(zhuǎn)義，我用的是spring，請(qǐng)問(wèn)該如何對(duì)ajax請(qǐng)求轉(zhuǎn)義，是使用aop對(duì)set方法攔截，還是修改HttpMessageConverter在json轉(zhuǎn)為java對(duì)象時(shí)轉(zhuǎn)義，還是其他方式？