安全漏洞問(wèn)題整改整理

1、1請(qǐng)求越權(quán)問(wèn)題出現(xiàn)原因:不同用戶權(quán)限不同，訪問(wèn)不具備權(quán)限的頁(yè)面或者功能時(shí)出現(xiàn)解決方案油于訪問(wèn)機(jī)制的特殊性，工程訪問(wèn)通過(guò)直接訪問(wèn)路徑下的htmljspjspngss以及 requestMapping映射的訪問(wèn)后臺(tái)都被當(dāng)做請(qǐng)求，而工程最初的訪問(wèn)攔截器定義為攔截所有請(qǐng) 求，所以需要在攔截器中單獨(dú)做一些符合業(yè)務(wù)邏輯的請(qǐng)求判斷作相應(yīng)的處理。.判斷session是否為空，是否含有用戶信息。如果含有，判斷該用戶是否是第一次登陸， 判斷含有的用戶信息是否合法。if (session != null) if (session.getAttribute(user) != null) Session ssNow =

2、 session;Map mapUser = (Map) session.getAttribute(user);String userid = (String) m叩UserMap tempMap = l/Sf/?_SESSIO/V. get (userid);if (tempMap != null & tempMap.size() 0) if (tempMap.get(ssNow.getld() != null) if (tempMap.get(ssNow.getld().equals(0) / 無(wú)效需要跳轉(zhuǎn)到登錄界面tempMap.remove(ssNow.getld();USER_SES

3、SION. put (userid, tempM叩)；String xmlHeader = x-requested-with;if ( Request.getHeader(xmlHeader) != null & Request.getHeader(xmlHeader).equalsIgnoreCase(XMLI Response.setHeader(sessionstatetimeout);/跳轉(zhuǎn)到登錄界面？ ？ Response . setHeader ( redirectur 1, /c lient/index . j sp); 臨時(shí)跳轉(zhuǎn)到前臺(tái)苜頁(yè)一 增加登錄頁(yè)？)ssNow.remov

4、eAttribute(user);return;) else (Iterator iterator = tempMap.keyset().iterator();int a = 0;while (iterator.hasNext() String ssld = iterator.next。；tempMap.put(ssld, 0); / 將之前的session注銷 a+) )tempMap.put(ssNow.getId(), 1)；/ 當(dāng)前賬號(hào)登錄系統(tǒng)USER_SESSION. put (userid, tempM叩)；/ else /當(dāng)前賬號(hào)第一次登錄系統(tǒng)tempMap = new Hash

5、MapString, String);tempMap.put(ssNow.getId(), 1);/ 當(dāng)前賬號(hào)登錄系統(tǒng)USER_SESSION.put(userId, tempMap);/ ).如果不含有session,或者getPathlnfo()路徑存在于白名單不作處理。if (userObj = null | | !filterRequest(rurl? uri) 會(huì)話session不存在或者白名單路徑時(shí)不處理 chain.doFilter( Request? Response); else /越權(quán)訪問(wèn)過(guò)法.如果用戶信息存在且訪問(wèn)路徑不存在于白名單，經(jīng)過(guò)越權(quán)過(guò)濾，根據(jù)用戶信息判斷用戶 是

6、否擁有訪問(wèn)權(quán)限，擁有菜單權(quán)限即可擁有菜單下訪問(wèn)所有頁(yè)面權(quán)限。沒(méi)有權(quán)限的時(shí)候，當(dāng) 日志記錄開(kāi)啟的時(shí)候，記錄越權(quán)日志。并且重定向到越權(quán)驗(yàn)證錯(cuò)誤頁(yè)面。（凍結(jié)賬號(hào)功能暫 時(shí)不實(shí)現(xiàn)）String render = Request.getHeader(Referer);/if (hasPermitURL(session? rurl) if (hasPermitURL(session, rurl)| (rurl.indexOf(/rest/) = 0 & rurl.indexOf(.jsp) Request,rurl, appName, Request.getRemoteAddr();)/)/越權(quán)跳轉(zhuǎn)到登錄

7、界面String redirectUrl = Request.getContextPath() + /zgsw_ghgl3/error/validte.jsp;if (! Response.isCommitted() Response.sendRedirect(redirectUrl);參數(shù)特殊字符后臺(tái)校驗(yàn)。出現(xiàn)原因:用戶蓄意或無(wú)意輸入解決方案:前臺(tái)驗(yàn)證特殊字符，后臺(tái)驗(yàn)證參數(shù)值是否包含特殊字符.配置一個(gè)參數(shù)請(qǐng)求的攔截器RequestParamterFiltercom.hoperun mon.RequestParamterFilter/*.Filter中獲取請(qǐng)求中的參數(shù)包括鍵和值，3),遍歷請(qǐng)求

8、參數(shù)是否包含像script一類的數(shù)據(jù)，對(duì)其中一些不合條件的字符進(jìn)行替換，換行 空格替換之后形成新的uri地址，請(qǐng)求到新的重定向地址。(后續(xù)結(jié)合在xss在一個(gè)攔截器里 面處理，不需要配置單獨(dú)的攔截器)Cross-Site Scripting: Reflected(xss 漏洞檢測(cè))出現(xiàn)原因：向web瀏覽器發(fā)送未經(jīng)驗(yàn)證的數(shù)據(jù)導(dǎo)致瀏覽器執(zhí)行惡意代碼解決方法：在適當(dāng)?shù)奈恢抿?yàn)證，檢驗(yàn)屬性.配置一個(gè)訪問(wèn)攔截器xssFiltermodule:filter-cla mons.filter.Xssfilter/*.配置一個(gè)攔截器開(kāi)關(guān)，默認(rèn)翻開(kāi).根據(jù)getRequestURI。判斷白名單，不需要進(jìn)行過(guò)濾.獲取所有

9、路徑參數(shù)驗(yàn)證是否符合要求，不符合提示返回private boolean xssGet(String paramsValue,String url) String param =boolean res = false;if (paramsValue != null) & (!.equals(paramsValue)& paramsValue.length0) param = (paramsValue.length = 1) ? paramsValue0 : Arrays.toString(paramsValue); / UAP特有解析參數(shù)的公共類適用于DATAGRID查詢 if (param,

10、contains (filter) | | param, contains (columns*) get 路徑傳參 try (Requestcondition condition = (Requestcondition) AuditUtil.readVaLue(param,Requestcondition.class); List filters = condition.getQueryFilter();/String columns = condition.getColumns().replaceAll(,if (!.equals(filters) & null != filters & !

11、null.equals(fliters) for (QueryFilter filter : filters) String filterParam = filter.getValue().toString(); if (!.equals(filterParam) & null != filterParam & !null.equals(filterParam) /filterParam = filter.getValue().toString().replaceAll(-,);/filterParam = filterParam.r叩laceAll(undefined,);/filterPa

12、ram = filterParam. replaceAll(,);/filterParam = filterParam.replaceAll(.,);) String eL=0-94-0-92; String eLl=0-94-0-92-0-92; String eL2=0-94-0-92-0-92 0-92:0-92:0-92; String eL3=0-94-0-92-0-94:0-92:0-92; Pattern p = Pattern piLe(eL);Pattern pl = Pattern.co/npite(eLI) ;| Pattern p2 = Pattern.co/npite

13、(eL2); Pattern p3 = Pattern.co/npife(eL3); Matcher m = p.matcher(filterParam); Matcher ml = pl.matcher(filterParam); Matcher m2 = p2.matcher(filterParam); Matcher m3 = p3.matcher(filterParam); if (m.matches() | |ml.matches() | |m2.matches() | |m3.matches() 時(shí)間字段放過(guò) filterParam = filterParam.replaceAll

14、(-, filterParam = filterParam.replaceAll( filterParam = filterParam.replaceAll(:)filterParam = filterParam.replaceAll(undefined? if (url. indexOf (audit/rest/pspecialmaintlogsl)=。)畝計(jì)功能放過(guò)表查詢 filterParam = filterParam.replaceAll( filterParam = filterParam.replaceAll(n.)if (this.xssFi(filterParam)| thi

15、s.hasSql(filterParam) System. out. print In (filter 路徑傳參 XSS 過(guò)濾器攔截+ filterParam);res = false;break; ) catch (Exception e) System.ou亡.printingfilter路徑傳參解析失??！”)；) else if (param.contains() & param.contains(M)& param.contains(: ) post路徑傳參 res = this.xssPost(param); else get非json格式數(shù)據(jù)傳拶 if (!.equals(para

16、m) & null != param & !null.equals(param) param = param.replaceAll( String eL=0-94-0-92;String eLl=H0-94-0-92-0-92;String eL2=0-94-0-92-0-92 0-92:0-92:0-92;String eL3=H0-94-0-92-0-94:0-92:0-92H;Pattern p = Pattern piLe(eL);Pattern pl = Pattern piLe(eLl);Pattern p2 = Pattern.co/wpite(eL2);Pattern p3 =

17、 Pattern piLe(eL3);Matcher m = p.matcher(param);Matcher ml = pl.matcher(param);Matcher m2 = p2.matcher(param);Matcher m3 = p3.matcher(param); if (m.matches() | |ml.matches() | |m2.matches() | |m3.matches() 時(shí)間字段放過(guò) param = param.replaceAll(-? ) ) param = param.replaceAll(,undefined?if (this.xssFi(para

18、m) | | this.hasSql(param) 過(guò)濾不過(guò)那么返回true Sy stem. out. println(路徑傳單變 XSS 過(guò)濾器攔截+ param);res = true;.根據(jù)request.getlnputStream。獲取post請(qǐng)求數(shù)據(jù)檢測(cè)，不符合提示返回private boolean xssPost(String ss) boolean res = false;try (ss = URLDecoder.decode(ss, UTF-8);if (ss != null& (ss.contains() & ss.contains() & ss.contains(:)

19、for (String value : AuditUtil.reqi/estUatue(ss) value = value.trim();if (this.xssFi(value) | | th|is.hasSql(value) System.out.println(POST傳參XSSjk截，被攔截值為：+value);res = true;break;) else res = true;) catch (Exception e) res = true;e printStackTrace();)return res;)其中，xssFi和hasSql判斷是否含有sql關(guān)鍵字等特殊字符4.Unre

20、leased Resource: Streams（可能無(wú)法成功釋放某項(xiàng)系統(tǒng)資源）常見(jiàn)原因：L錯(cuò)誤狀況，其他異常情況2 .未明確程序那一局部釋放資源解決方法：不要依賴finalize。回收資源，內(nèi)存過(guò)小時(shí)候才會(huì)使用。在finally代碼段中釋放資源 例：public void processFile(String fName) throws FileNotFoundExceptionf lOException Fileinputstream fis；try fis = new Fileinputstream(fName)；int sz；byte byteArray = new byteBLOCK

21、_SIZE；while (sz = fis.read(byteArray)!= -1) Fortify,Fortify,Fortify,processBytes(byteArray, sz)；Oct 23. 2018.0:42 AMFortify,C Copyright 2016 Hewlett Packard Enterprise Development LP)finally if (fis != null) safeClose(fis)；public static void safeClose(Fileinputstream fis) if (fis != null) try fis.close ()； catch