危险字符过滤的类

usingSystem;
usingSystem.IO;
usingSystem.Text;
usingSystem.Text.RegularExpressions;
usingSystem.Runtime.Remoting;
usingSystem.Runtime.Remoting.Proxies;
usingSystem.Runtime.Remoting.Messaging;
usingSystem.Reflection;

namespaceFilterRealProxy
{
/**////<summary>
///FilterRealProxy类：一个真实代理,拦截它所代理对象中方法的返回值，并对需要过滤的返回值进行过滤。
///</summary>
publicclassFilterRealProxy:RealProxy
{
privateMarshalByRefObjecttarget;
publicFilterRealProxy(MarshalByRefObjecttarget):base(target.GetType())
{
this.target=target;
}
publicoverrideIMessageInvoke(IMessagemsg)
{
IMethodCallMessagecallMsg=msgasIMethodCallMessage;
IMethodReturnMessagereturnMsg=RemotingServices.ExecuteMessage(target,callMsg);
//检查返回值是否为String,如果不是String,就没必要进行过滤
if(this.IsMatchType(returnMsg.ReturnValue))
{
stringreturnValue=this.Filter(returnMsg.ReturnValue.ToString(),returnMsg.MethodName);
returnnewReturnMessage(returnValue,null,0,null,callMsg);
}
returnreturnMsg;
　　　　}
protectedstringFilter(stringReturnValue,stringMethodName)
{
MethodInfomethodInfo=target.GetType().GetMethod(MethodName);
object[]attributes=methodInfo.GetCustomAttributes(typeof(StringFilter),true);
foreach(objectattribinattributes)
{
returnFilterHandler.Process(((StringFilter)attrib).FilterType,ReturnValue);
}
returnReturnValue;
}
protectedboolIsMatchType(objectobj)
{
returnobjisSystem.String;
}
}

/**////<summary>
///StringFilter类：自定义属性类,定义目标元素的过滤类型
///</summary>
publicclassStringFilter:Attribute
{
protectedFilterType_filterType;

publicStringFilter(FilterTypefilterType)
{
this._filterType=filterType;
}
publicFilterTypeFilterType
{
get
{
return_filterType;
}
}
}

/**////<summary>
///枚举类：用于指定过滤类型，例如：对script过滤还是对html进行过滤？
///</summary>
[Flags()]
publicenumFilterType
{
Script=1,
Html=2,
Object=3,
AHrefScript=4,
Iframe=5,
Frameset=6,
Src=7,
BadWords=8,
//Include=9,
All=16
}

/**////<summary>
///过滤处理类：根据过滤类型，调用相应的过滤处理方法。
///</summary>

publicclassFilterHandler
{
privateFilterHandler()
{
}
publicstaticstringProcess(FilterTypefilterType,stringfilterContent)
{
switch(filterType)
{
caseFilterType.Script:
filterContent=FilterScript(filterContent);
break;
caseFilterType.Html:
filterContent=FilterHtml(filterContent);
break;
caseFilterType.Object:
filterContent=FilterObject(filterContent);
break;
caseFilterType.AHrefScript:
filterContent=FilterAHrefScript(filterContent);
break;
caseFilterType.Iframe:
filterContent=FilterIframe(filterContent);
break;
caseFilterType.Frameset:
filterContent=FilterFrameset(filterContent);
break;
caseFilterType.Src:
filterContent=FilterSrc(filterContent);
break;
//caseFilterType.Include:
//filterContent=FilterInclude(filterContent);
//break;
caseFilterType.BadWords:
filterContent=FilterBadWords(filterContent);
break;
caseFilterType.All:
filterContent=FilterAll(filterContent);
break;
default:
//donothing
break;
}
returnfilterContent;
}

publicstaticstringFilterScript(stringcontent)
{
stringcommentPattern=@"(?'comment'<!--.*?--[/n/r]*>)";
stringembeddedScriptComments=@"(///*.*?/*//|////.*?[/n/r])";
stringscriptPattern=String.Format(@"(?'script'<[/n/r]*script[^>]*>(.*?{0}?)*<[/n/r]*/script[^>]*>)",embeddedScriptComments);
//包含注释和Script语句
stringpattern=String.Format(@"(?s)({0}|{1})",commentPattern,scriptPattern);

returnStripScriptAttributesFromTags(Regex.Replace(content,pattern,string.Empty,RegexOptions.IgnoreCase));
}

privatestaticstringStripScriptAttributesFromTags(stringcontent)
{
stringeventAttribs=@"on(blur|c(hange|lick)|dblclick|focus|keypress|(key|mouse)(down|up)|(un)?load
|mouse(move|o(ut|ver))|reset|s(elect|ubmit))";

stringpattern=String.Format(@"(?inx)
/<(/w+)/s+
(
(?'attribute'
(?'attributeName'{0})/s*=/s*
(?'delim'['""]?)
(?'attributeValue'[^'"">]+)
(/3)
)
|
(?'attribute'
(?'attributeName'href)/s*=/s*
(?'delim'['""]?)
(?'attributeValue'javascript[^'"">]+)
(/3)
)
|
[^>]
)*
/>",eventAttribs);
Regexre=newRegex(pattern);
//使用MatchEvaluator的委托
returnre.Replace(content,newMatchEvaluator(StripAttributesHandler));
}

privatestaticstringStripAttributesHandler(Matchm)
{
if(m.Groups["attribute"].Success)
{
returnm.Value.Replace(m.Groups["attribute"].Value,"");
}
else
{
returnm.Value;
}
}

publicstaticstringFilterAHrefScript(stringcontent)
{
stringnewstr=FilterScript(content);
stringregexstr=@"href[^=]*=*[/s/S]*script*:";
returnRegex.Replace(newstr,regexstr,string.Empty,RegexOptions.IgnoreCase);
}

publicstaticstringFilterSrc(stringcontent)
{
stringnewstr=FilterScript(content);
stringregexstr=@"src*=*['""]?[^/.]+/.(js|vbs|asp|aspx|php|jsp)['""]";
returnRegex.Replace(newstr,regexstr,@"",RegexOptions.IgnoreCase);
}
/**//*
publicstaticstringFilterInclude(stringcontent)
{
stringnewstr=FilterScript(content);
stringregexstr=@"<[/s/S]*include*(file|virtual)*=*[/s/S]*/.(js|vbs|asp|aspx|php|jsp)[^>]*>";
returnRegex.Replace(newstr,regexstr,string.Empty,RegexOptions.IgnoreCase);
}
*/
publicstaticstringFilterHtml(stringcontent)
{
stringnewstr=FilterScript(content);
stringregexstr=@"<[^>]*>";
returnRegex.Replace(newstr,regexstr,string.Empty,RegexOptions.IgnoreCase);
}

publicstaticstringFilterObject(stringcontent)
{
stringregexstr=@"(?i)<Object([^>])*>(/w|/W)*</Object([^>])*>";
returnRegex.Replace(content,regexstr,string.Empty,RegexOptions.IgnoreCase);
}

publicstaticstringFilterIframe(stringcontent)
{
stringregexstr=@"(?i)<Iframe([^>])*>(/w|/W)*</Iframe([^>])*>";
returnRegex.Replace(content,regexstr,string.Empty,RegexOptions.IgnoreCase);
}

publicstaticstringFilterFrameset(stringcontent)
{
stringregexstr=@"(?i)<Frameset([^>])*>(/w|/W)*</Frameset([^>])*>";
returnRegex.Replace(content,regexstr,string.Empty,RegexOptions.IgnoreCase);
}

//移除非法或不友好字符
privatestaticstringFilterBadWords(stringchkStr)
{
//这里的非法和不友好字符由你任意加，用“|”分隔，支持正则表达式,由于本Blog禁止贴非法和不友好字符，所以这里无法加上。
stringBadWords=@"";
if(chkStr=="")
{
return"";
}

string[]bwords=BadWords.Split('#');
inti,j;
stringstr;
StringBuildersb=newStringBuilder();
for(i=0;i<bwords.Length;i++)
{
str=bwords[i].ToString().Trim();
stringregStr,toStr;
regStr=str;
Regexr=newRegex(regStr,RegexOptions.IgnoreCase|RegexOptions.Singleline|RegexOptions.Multiline);
Matchm=r.Match(chkStr);
if(m.Success)
{
j=m.Value.Length;
sb.Insert(0,"*",j);
toStr=sb.ToString();
chkStr=Regex.Replace(chkStr,regStr,toStr,RegexOptions.IgnoreCase|RegexOptions.Singleline|RegexOptions.Multiline);
}
sb.Remove(0,sb.Length);
}
returnchkStr;
}

publicstaticstringFilterAll(stringcontent)
{
content=FilterHtml(content);
content=FilterScript(content);
content=FilterAHrefScript(content);
content=FilterObject(content);
content=FilterIframe(content);
content=FilterFrameset(content);
content=FilterSrc(content);
content=FilterBadWords(content);
//content=FilterInclude(content);
returncontent;
}
}
}