|
跨站腳本就是在url上帶上惡意的js關(guān)鍵字然后腳本注入了，跨站偽造用戶請(qǐng)求就是沒(méi)有經(jīng)過(guò)登陸，用超鏈接或者直接url上敲地址進(jìn)入系統(tǒng)，類似于sql注入這些都是安全漏洞。
1、參數(shù)化查詢預(yù)處理，如java使用PreparedStatement()處理變量。
一般性建議：轉(zhuǎn)義或過(guò)濾客戶端提交的危險(xiǎn)字符，客戶端提交方式包含GET、POST、COOKIE、User-Agent、Referer、Accept-Language等，其中危險(xiǎn)字符如下： 開(kāi)發(fā)語(yǔ)言的建議：
方案一、存在漏洞的頁(yè)面加驗(yàn)證碼或手機(jī)短信驗(yàn)證 request.getSession().invalidate() ; //清空session
if (request.getCookies()!=null) {
Cookie cookie = request.getCookies()[0]; // 獲取cookie
cookie.setMaxAge(0); // 讓cookie過(guò)期
}"
[1]嚴(yán)格判斷上傳文件的類型，設(shè)置上傳文件白名單，只允許上傳指定類型的文件。
"升級(jí)Jquery到1.7版本以上，或在js中修改如下行，quickExpr = /^(?:[^<]*(<[\w\W]+>)[^>]*$|#([\w\-]+)$)/
修改web.xml,增加如下配置 <login-config>
<!-- Authorization setting for SSL -->
<auth-method>CLIENT-CERT</auth-method>
<realm-name>Client Cert Users-only Area</realm-name>
<auth-method>BASIC</auth-method>
</login-config>
<security-constraint>
<!-- Authorization setting for SSL -->
<web-resource-collection>
<web-resource-name>SSL</web-resource-name>
<url-pattern>/oa/login.jsp</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<!-- 禁止不安全的http方法 -->
<security-constraint>
<web-resource-collection>
<web-resource-name>fortune</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>PUT</http-method>
<http-method>DELETE</http-method>
<http-method>HEAD</http-method>
<http-method>OPTIONS</http-method>
<http-method>TRACE</http-method>
</web-resource-collection>
<auth-constraint></auth-constraint>
</security-constraint>
對(duì)每個(gè)錯(cuò)誤的登錄嘗試發(fā)出相同的錯(cuò)誤消息，不管是哪個(gè)字段發(fā)生錯(cuò)誤，特別是用戶名或密碼字段錯(cuò)誤。
以下是我自己寫(xiě)的一份攔截器，里面可以實(shí)現(xiàn)對(duì)http請(qǐng)求的參數(shù)攔截，解決跨站腳本注入： package com.asiainfo.aiga.common.filter;
import java.io.IOException;
import java.util.Enumeration;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang3.StringUtils;
public class XSSCheckFilter implements Filter
{
private FilterConfig config;
private static String errorPath;//出錯(cuò)跳轉(zhuǎn)的目的地
private static String[] excludePaths;//不進(jìn)行攔截的url
private static String[] safeless = { "<script", //需要攔截的JS字符關(guān)鍵字
"</script", "<iframe", "</iframe", "<frame", "</frame", "set-cookie", "%3cscript", "%3c/script", "%3ciframe", "%3c/iframe", "%3cframe", "%3c/frame", "src=\"javascript:", "<body", "</body", "%3cbody", "%3c/body", "alert", "script", "document", "document.title", "document.write", "eval", "prompt", "onreadystatechange", "javascript", "msgbox"
//"<",
//">",
//"</",
//"/>",
//"%3c",
//"%3e",
//"%3c/",
//"/%3e"
};
public void doFilter(ServletRequest req, ServletResponse resp, FilterChain filterChain) throws IOException, ServletException
{
Enumeration params = req.getParameterNames();
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) resp;
boolean isSafe = true;
String requestUrl = request.getRequestURI();
if (isSafe(requestUrl))
{
requestUrl = requestUrl.substring(requestUrl.indexOf("/"));
if (!excludeUrl(requestUrl))
{
while (params.hasMoreElements())
{
String cache = req.getParameter((String) params.nextElement());
if (StringUtils.isNotBlank(cache))
{
if (!isSafe(cache))
{
isSafe = false;
break;
}
}
}
}
}
else
{
isSafe = false;
}
if (!isSafe)
{
request.setAttribute("msg", "There is some illegal characters in paramters.");
request.getRequestDispatcher(errorPath).forward(request, response);
return;
}
else
{
String referer = request.getHeader("referer");
if (!("/index.jsp".equals(request.getServletPath()) || "/refresh.jsp".equals(request.getServletPath())))
{
if(request.getServletPath()!=null&&request.getServletPath().endsWith(".action")){
}else if (referer == null || !referer.contains(request.getServerName()))
{
System.out.println("跨站請(qǐng)求偽造");
//轉(zhuǎn)到一個(gè)錯(cuò)誤的圖片
request.getRequestDispatcher(errorPath).forward(request, response);
}
}
}
filterChain.doFilter(req, resp);
}
private static boolean isSafe(String str)
{
if (StringUtils.isNotBlank(str))
{
for (String s : safeless)
{
String[] strs = str.split("/");
for (String urlStr : strs)
{
if (s.equals(urlStr.toLowerCase()))
{
return false;
}
}
}
}
return true;
}
private boolean excludeUrl(String url)
{
if (excludePaths != null && excludePaths.length > 0)
{
for (String path : excludePaths)
{
if (url.toLowerCase().equals(path))
{
return true;
}
}
}
return false;
}
public void destroy()
{
}
public void init(FilterConfig config) throws ServletException
{
this.config = config;
errorPath = config.getInitParameter("errorPath");
String excludePath = config.getInitParameter("excludePaths");
if (StringUtils.isNotBlank(excludePath))
{
excludePaths = excludePath.split(",");
}
}
}
|
|
|
來(lái)自： 三十的狼 > 《系統(tǒng)安全漏洞》
