Java Servlet Filter: Blocking Unapproved Scripts

G5 Cyber Security

1 month ago

TL;DR

Yes, a Java servlet filter can effectively block scripts that aren’t on an approved whitelist. This guide shows you how to create and configure such a filter.

Steps

Create the Whitelist: First, define a list of allowed script sources (URLs or paths). This is your ‘whitelist’. You can store this in a file, database, or directly within your code. For simplicity, we’ll use an array in our example.
```
String[] whitelist = {"https://trusted-cdn.example.com/", "/static/js/"};
```
Create the Filter Class: Create a Java class that extends javax.servlet.Filter and implements the necessary methods.
```
public class ScriptBlockerFilter implements Filter {
```

Implement `doFilter` Method: This is where the core logic resides. Inside this method, you’ll examine the request headers (specifically looking for script tags in HTML responses) and block requests containing unapproved scripts.

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    // Get the original request URI.
    String requestURI = ((HttpServletRequest) request).getRequestURI();

    // Check if the request is for a script resource (e.g., .js file).
    if (requestURI.endsWith(".js")) {
        boolean allowed = false;
        for (String whitelistedPath : whitelist) {
            if (requestURI.startsWith(whitelistedPath)) {
                allowed = true;
                break;
            }
        }

        if (!allowed) {
            // Block the request.
            response.getWriter().println("Script access denied!");
            return;
        }
    }

    chain.doFilter(request, response);
}

Implement `init` Method: This method is called when the filter is initialized. You can use it to load your whitelist from a configuration file or database.
```
@Override
public void init(FilterConfig config) throws ServletException {
    // Load whitelist here if needed.
}
```

Configure the Filter in `web.xml` (or equivalent): Add a filter declaration to your web application’s deployment descriptor (`web.xml`). This tells the servlet container which URLs the filter should intercept.

<filter>
    <filter-name>ScriptBlockerFilter</filter-name>
    <filter-class>com.example.ScriptBlockerFilter</filter-class>
</filter>

<filter-mapping>
    <filter-name>ScriptBlockerFilter</filter-name>
    <url-pattern>*.js</url-pattern>
</filter-mapping>

Test the Filter: Deploy your web application and test that requests for unapproved scripts are blocked, while requests for approved scripts are allowed. Try accessing a script from a trusted CDN and one from an untrusted source.
Important Considerations
- HTML Responses: This example focuses on blocking direct .js file requests. To block inline scripts within HTML pages, you’ll need to parse the HTML response body *before* it’s sent to the client and remove or modify unapproved script tags. This is more complex and requires an HTML parser library (e.g., Jsoup).
- Performance: Parsing HTML responses can be resource-intensive. Consider caching parsed results if possible.
- False Positives/Negatives: Ensure your whitelist is comprehensive to avoid blocking legitimate scripts or allowing malicious ones.
- cyber security Best Practices: This filter is one layer of cyber security. Implement other measures like Content Security Policy (CSP) for robust protection.

TL;DR

Steps

Important Considerations