SpringMVC处理脚本,SQL注入问题

时间：2022-12-25 14:28:17

SpringMVC处理脚本,SQL注入问题(写的不好勿喷，互相学习)

使用 Filter 来过滤浏览器发出的请求，对每个URI参数请求过滤些关键字，替换成安全的字符。所有请求的 getParameter 会被替换，如果参数里面含有敏感词会被替换掉。

对于类似：>"<script>alert('XSS');</script>



一、过滤些敏感的脚本






1、编写XssHttpServletRequestWrapper


import javax. servlet. http. HttpServletRequest;

import javax. servlet. http. HttpServletRequestWrapper;

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {

    public XssHttpServletRequestWrapper (HttpServletRequest servletRequest) {

        super(servletRequest);

    }

    public String [] getParameterValues (String parameter) {

        String [] values = super. getParameterValues(parameter);

        if (values == null) {

            return null;

        }

        int count = values. length;

        String [] encodedValues = new String[count];

        for (int i = 0; i < count; i++) {

            encodedValues[i] = cleanXSS(values[i]);

        }

       return encodedValues;

    }

    public String getParameter (String parameter) {

        String value = super. getParameter(parameter);

        if (value == null) {

            return null;

        }

        return cleanXSS(value);

    }

    public String getHeader (String name) {

        String value = super. getHeader(name);

        if (value == null)

            return null;

        return cleanXSS(value);

    }

    private String cleanXSS (String value) {

    value = value. replaceAll ("<", "& lt;"). replaceAll (">", "& gt;");

    value = value. replaceAll ("\\ (", "& #40;"). replaceAll ("\\)", "& #41;");

    value = value. replaceAll ("'", "& #39;");

    value = value. replaceAll ("eval\\ ((. *)\\)", "");

    value = value. replaceAll ("[\\\"\\\’] [\\s] *javascript:(. *)[\\\"\\\']", "\"\"");

        value = value. replaceAll ("script", "");

        return value;


2、添加一个过滤器 XssFilter




import java.io.IOException;




import javax. servlet.Filter;




import javax. servlet.FilterChain;




import javax. servlet.FilterConfig;




import javax. servlet.ServletException;




import javax. servlet.ServletRequest;




import javax. servlet.ServletResponse;




import javax. servlet. http. HttpServletRequest;




publicclass XSSFilter implements Filter {




FilterConfig filterConfig = null;




publicvoid init (FilterConfig filterConfig) throws ServletException {




this. filterConfig = filterConfig;




}




publicvoid destroys () {




this. filterConfig = null;




}




publicvoid doFilter (ServletRequest request, ServletResponse response, FilterChain chain)




throws IOException, ServletException {




chain. doFilter (new

XssHttpServletRequestWrapper((HttpServletRequest) request), response);




}




}




3、在web中配置




<filter>




    <filter-name>XssSqlFilter</filter-name>




    <filter-class>com. Controller.XSSFilter</filter-class>




</filter>




<filter-mapping>




    <filter-name>XssSqlFilter</filter-name>




    <url-pattern>/*</url-pattern>




    <dispatcher>REQUEST</dispatcher>




</filter-mapping>




4、基于springMVC的配置使用




编写SqlInjectInterceptor




import org.springframework.web. servlet.HandlerInterceptor;




import org.springframework.web. servlet.ModelAndView;




import javax. servlet. http. HttpServletRequest;




import javax. servlet. http. HttpServletResponse;




import java. util. Enumeration;




/** * 防止SQL注入的拦截器  */




publicclass SqlInjectInterceptor implements HandlerInterceptor {




publicboolean preHandle(HttpServletRequest request,HttpServletResponse response, Object o) throws Exception {




Enumeration names = request.getParameterNames ();




while (names. hasMoreElements()) {




String name = (String) names.nextElement();




String[] values = request.getParameterValues(name);




for (String value: values) {




value = clearXss(value);




}




}




returntrue;




}




publicvoid postHandle(HttpServletRequest request,HttpServletResponse response, Object o, ModelAndView modelAndView) throws Exception {






}




publicvoidafterCompletion(HttpServletRequest request,HttpServletResponse response, Object o, Exception e)




throws Exception {




}




/** * 处理字符转义 * * @param value * @return */




private String clearXss (String value) {




if (value == null || "".equals(value)) {




returnvalue;




}




System.err.println("=========>:处理字符转义");




value = value. replaceAll ("<", "<"). replaceAll (">", ">");




value = value.replaceAll("\\(", "(").replace("\\)", ")");




value = value. replaceAll ("'", "'");




value = value.replaceAll("eval\\((.*)\\)", "");




value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");




value = value.replace("script", "");




returnvalue;




}




}




二、对含有敏感的脚本,直接处理掉。




1、编写SX_Filter




import java.io.IOException;




import java. util.Enumeration;




import javax. servlet.Filter;




import javax. servlet.FilterChain;




import javax. servlet.FilterConfig;




import javax. servlet.ServletException;




import javax. servlet.ServletRequest;




import javax. servlet.ServletResponse;




import javax. servlet.http. HttpServletRequest;




import javax. servlet. http. HttpServletResponse;




publicclass SX_Filterimplements Filter {




private FilterConfig config;




privatestatic String errorPath;// 出错跳转的目的地




privatestatic String[] excludePaths;// 不进行拦截的url




privatestatic String [] safeless = { // 需要拦截的字符关键字、url编码




"<script",




"</script",




"<iframe",




"</iframe",




"<frame",




"</frame",




"set-cookie",




"%3cscript",




"%3c/script",




"%3ciframe",




"%3c/iframe",




"%3cframe",




"%3c/frame",




"src=\"javascript:",




"<body",




　　　　　　　　"</body",




"%3cbody",




"%3c/body",




"<", ">","</","/>","%3c","%3e","%3c/","/%3e"};




publicvoid doFilter(ServletRequest req, ServletResponse resp, FilterChain filterChain)




throws IOException, ServletException {




Enumeration params = req. getParameterNames ();




HttpServletRequest request = (HttpServletRequest) req;




HttpServletResponse response = (HttpServletResponse)resp;




booleanisSafe = true;




String requestUrl = request. getRequestURI ();




if (isSafe(requestUrl)) {




requestUrl = requestUrl.substring(requestUrl.indexOf("/"));




if (! excludeUrl(requestUrl)) {




while (params. hasMoreElements ()) {




String cache = req.getParameter((String) params.nextElement());




if (null != cache && cache.length() > 0) {




if (!isSafe(cache)) {




isSafe = false;




break;




}




}




}




}




}else{




isSafe = false;




}




if (! isSafe) {




request.setAttribute("error", "您输入的参数有非法字符！");




response. sendRedirect ("http://... ");




return;




}




filterChain.doFilter(req, resp);




}




privatestaticboolean isSafe (String str) {




if (null! = str && str. length () > 0) {




for (String s: safeless) {




if (str. toLowerCase ().contains(s)) {




returnfalse;




}




}




}




returntrue;




}




privateboolean excludeUrl (String url) {




if (excludePaths != null && excludePaths.length > 0) {




for (String path : excludePaths) {




if (url. toLowerCase (). equals(path)) {




returntrue;




}




}




}




returnfalse;




}




publicvoid destroy() {




}




publicvoid init(FilterConfig config) throws ServletException {




this.config = config;




errorPath = config. getInitParameter("errorPath");




String excludePath = config.getInitParameter("excludePaths");




if (null != excludePath && excludePath.length() > 0) {




excludePaths = excludePath.split(",");




}




}




}




2、在web中配置




<filter>




    <filter-name>XssSqlFilter</filter-name>




    <filter-class>com. Controller. SX_Filter </filter-class>




</filter>




<filter-mapping>




    <filter-name>XssSqlFilter</filter-name>




    <url-pattern>/*</url-pattern>




    <dispatcher>REQUEST</dispatcher>




</filter-mapping>








Spring MVC处理脚本和SQL注入


使用 Filter 来过滤浏览器发出的请求，对每个URI参数请求过滤些关键字，替换成安全的字符。所有请求的 getParameter 会被替换，如果参数里面含有敏感词会被替换掉。


对于类似：>"<script>alert('XSS');</script>


一、过滤些敏感的脚本


1、编写XssHttpServletRequestWrapper


import javax. servlet. http. HttpServletRequest;


import javax. servlet. http. HttpServletRequestWrapper;


publicclassXssHttpServletRequestWrapper extendsHttpServletRequestWrapper{


public XssHttpServletRequestWrapper (HttpServletRequest servletRequest) {


super(servletRequest);


}


public String [] getParameterValues (String parameter) {


String [] values = super. getParameterValues(parameter);


if (values == null) {


returnnull;


}


intcount = values. length;


String [] encodedValues = new String[count];


for (inti = 0; i < count; i++) {


encodedValues[i] = cleanXSS(values[i]);


}


returnencodedValues;


}


public String getParameter (String parameter) {


String value = super. getParameter(parameter);


if (value == null) {


returnnull;


}


return cleanXSS(value);


}


public String getHeader (String name) {


String value = super. getHeader(name);


if (value == null)


returnnull;


return cleanXSS(value);


}


private String cleanXSS (String value) {


value = value. replaceAll ("<", "& lt;"). replaceAll (">", "& gt;");


value = value. replaceAll ("\\ (", "& #40;"). replaceAll ("\\)", "& #41;");


value = value. replaceAll ("'", "& #39;");


value = value. replaceAll ("eval\\ ((. *)\\)", "");


value = value. replaceAll ("[\\\"\\\’] [\\s] *javascript:(. *)[\\\"\\\']", "\"\"");


value = value. replaceAll ("script", "");


returnvalue;


}


}


2、添加一个过滤器 XssFilter


import java.io. IOException;


import javax. servlet. Filter;


import javax. servlet. FilterChain;


import javax. servlet. FilterConfig;


import javax. servlet. ServletException;


import javax. servlet. ServletRequest;


import javax. servlet. ServletResponse;


import javax. servlet. http. HttpServletRequest;


publicclass XSSFilter implements Filter {


FilterConfig filterConfig = null;


publicvoid init (FilterConfig filterConfig) throws ServletException {


this. filterConfig = filterConfig;


}


publicvoid destroys () {


this. filterConfig = null;


}


publicvoid doFilter (ServletRequest request, ServletResponse response, FilterChain chain)


throws IOException, ServletException {


chain. doFilter (new XssHttpServletRequestWrapper((HttpServletRequest) request), response);


}


}


3、在web中配置


<filter>


    <filter-name>XssSqlFilter</filter-name>


    <filter-class>com. Controller.XSSFilter</filter-class>


</filter>


<filter-mapping>


    <filter-name>XssSqlFilter</filter-name>


    <url-pattern>/*</url-pattern>


    <dispatcher>REQUEST</dispatcher>


</filter-mapping>


 


 


4、基于springMVC的配置使用


编写SqlInjectInterceptor


import org.springframework.web. servlet. HandlerInterceptor;


import org.springframework.web. servlet. ModelAndView;


import javax. servlet. http. HttpServletRequest;


import javax. servlet. http. HttpServletResponse;


import java. util. Enumeration;


/** * 防止SQL注入的拦截器  */


publicclass SqlInjectInterceptor implements HandlerInterceptor {


publicboolean preHandle(HttpServletRequest request, HttpServletResponse response, Object o) throws Exception {


Enumeration names = request. getParameterNames ();


while (names. hasMoreElements ()) {


String name = (String) names.nextElement();


String[] values = request.getParameterValues(name);


for (String value: values) {


value = clearXss(value);


}


}


returntrue;


}


publicvoid postHandle(HttpServletRequest request, HttpServletResponse response, Object o,


ModelAndView modelAndView) throws Exception {


}


publicvoid afterCompletion(HttpServletRequest request, HttpServletResponse response, Object o, Exception e)


throws Exception {


}


/** * 处理字符转义 * * @param value * @return */


private String clearXss (String value) {


if (value == null || "".equals(value)) {


returnvalue;


}


System.err.println("=========>:处理字符转义");


value = value. replaceAll ("<", "<"). replaceAll (">", ">");


value = value.replaceAll("\\(", "(").replace("\\)", ")");


value = value. replaceAll ("'", "'");


value = value.replaceAll("eval\\((.*)\\)", "");


value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");


value = value.replace("script", "");


returnvalue;


}


}


在springMVC.xml文件中配置SqlInjectInterceptor


<! -- 拦截器：SQL注入拦截 -->


<mvc: interceptors>


        <mvc: interceptor>


             <mvc: mapping path="/**" />


             <bean class="com. Controller.SqlInjectInterceptor"></bean>


        </mvc: interceptor>


    </mvc: interceptors>


 


二、对含有敏感的脚本,直接处理掉。


1、编写SX_Filter


import java.io. IOException;


import java. util. Enumeration;


import javax. servlet. Filter;


import javax. servlet. FilterChain;


import javax. servlet. FilterConfig;


import javax. servlet. ServletException;


import javax. servlet. ServletRequest;


import javax. servlet. ServletResponse;


import javax. servlet. http. HttpServletRequest;


import javax. servlet. http. HttpServletResponse;


publicclass SX_Filter implements Filter {


private FilterConfig config;


privatestatic String errorPath;// 出错跳转的目的地


privatestatic String[] excludePaths;// 不进行拦截的url


privatestatic String [] safeless = { // 需要拦截的字符关键字、url编码


"<script",


"</script",


"<iframe",


"</iframe",


"<frame",


"</frame",


"set-cookie",


"%3cscript",


"%3c/script",


"%3ciframe",


"%3c/iframe",


"%3cframe",


"%3c/frame",


"src=\"javascript:",


"<body", "</body",


"%3cbody",


"%3c/body",


"<", ">","</","/>","%3c","%3e","%3c/","/%3e"};


publicvoid doFilter(ServletRequest req, ServletResponse resp, FilterChain filterChain)


throws IOException, ServletException {


Enumeration params = req. getParameterNames ();


HttpServletRequest request = (HttpServletRequest) req;


HttpServletResponse response = (HttpServletResponse) resp;


booleanisSafe = true;


String requestUrl = request. getRequestURI ();


if (isSafe(requestUrl)) {


requestUrl = requestUrl.substring(requestUrl.indexOf("/"));


if (! excludeUrl(requestUrl)) {


while (params. hasMoreElements ()) {


String cache = req.getParameter((String) params.nextElement());


if (null != cache && cache.length() > 0) {


if (!isSafe(cache)) {


isSafe = false;


break;


}


}


}


}


} else {


isSafe = false;


}


if (! isSafe) {


request.setAttribute("error", "您输入的参数有非法字符！");


response. sendRedirect ("http://... ");


return;


}


filterChain.doFilter(req, resp);


}


privatestaticboolean isSafe (String str) {


if (null! = str && str. length () > 0) {


for (String s: safeless) {


if (str. toLowerCase (). contains(s)) {


returnfalse;


}


}


}


returntrue;


}


privateboolean excludeUrl (String url) {


if (excludePaths != null && excludePaths.length > 0) {


for (String path : excludePaths) {


if (url. toLowerCase (). equals(path)) {


returntrue;


}


}


}


returnfalse;


}


publicvoid destroy() {


}


publicvoid init(FilterConfig config) throws ServletException {


this.config = config;


errorPath = config. getInitParameter("errorPath");


String excludePath = config.getInitParameter("excludePaths");


if (null != excludePath && excludePath.length() > 0) {


excludePaths = excludePath.split(",");


}


}


}


2、在web中配置


<filter>


    <filter-name>XssSqlFilter</filter-name>


    <filter-class>com. Controller. SX_Filter </filter-class>


</filter>


<filter-mapping>


    <filter-name>XssSqlFilter</filter-name>


    <url-pattern>/*</url-pattern>


    <dispatcher>REQUEST</dispatcher>


</filter-mapping>
														
		
SpringMVC处理脚本,SQL注入问题的更多相关文章
	

    

  1. 
网站跨站点脚本，Sql注入等攻击的处理
		
    从360安全论坛里找到的一段代码,经过整理封装,直接在站点Global.asax文件或写一个HttpModule来拦截恶意请求即可: http://bbs.webscan.360.cn/forum.p ...
    
		
    2. 
						
  2. 
&lbrack;原&rsqb;网站跨站点脚本，Sql注入等攻击的处理
		
    从360安全论坛里找到的一段代码,经过整理封装,直接在站点Global.asax文件或写一个HttpModule来拦截恶意请求即可: http://bbs.webscan.360.cn/forum.p ...
    
		
    3. 
						
  3. 
使用过滤器解决SQL注入和跨站点脚本编制
		
    1 SQL注入.盲注 1.1 SQL注入.盲注概述 Web 应用程序通常在后端使用数据库,以与企业数据仓库交互.查询数据库事实上的标准语言是 SQL(各大数据库供应商都有自己的不同版本).Web 应用 ...
    
		
    4. 
						
  4. 
zabbix&lpar;sql注入判断脚本&rpar;
		
    zabbix(sql注入判断脚本) #-*-coding:utf-8-*- # code by anyun.org import urllib import re def getHtml(url):  ...
    
		
    5. 
						
  5. 
SpringMVC利用拦截器防止SQL注入
		
    引言 随着互联网的发展,人们在享受互联网带来的便捷的服务的时候,也面临着个人的隐私泄漏的问题.小到一个拥有用户系统的小型论坛,大到各个大型的银行机构,互联网安全问题都显得格外重要.而这些网站的背后,则 ...
    
		
    6. 
						
  6. 
phpcms v9 sql注入脚本
		
    phpcms v9 SQL注入脚本 用法:python phpcms.py http://www.baidu.com import requests,sys,urllib url = sys.argv ...
    
		
    7. 
						
  7. 
Bypass 360主机卫士SQL注入防御（附tamper脚本）
		
    0x01 前言 在测试过程中,经常会遇到一些主机防护软件,对这方面做了一些尝试,可成功bypass了GET和POST的注入防御,分享一下姿势. 0x02 环境搭建 Windows Server 200 ...
    
		
    8. 
						
  8. 
动态调试&vert;Maccms SQL 注入分析&lpar;附注入盲注脚本&rpar;
		
    0x01 前言 已经有一周没发表文章了,一个朋友叫我研究maccms的代码审计,碰到这个注入的漏洞挺有趣的,就在此写一篇分析文. 0x02 环境 Web: phpstudySystem: Window ...
    
		
    9. 
						
  9. 
python 打造一个sql注入脚本 （一）
		
    0x00前言: 昨天刚刚看完小迪老师的sql注入篇的第一章 所以有了新的笔记. 0x01笔记: sql注入原理: 网站数据传输中,接受变量传递的值未进行过滤,导致直接带入数据库查询执行的操作. sql ...
    
		
    10. 
		


随机推荐
	

    

  1. 
Activity往另外一个Activity传值，Fragment获取另外一个Activity里面的值。
			
    在oneActivity中实现跳转到MainActivity //intent 用来跳转另外一个MainActivity,bundle传值到MainActivity         Intent Ma ...
    
			
    2. 
						
  2. 
PHP导出数据到CSV文件函数 csv&lowbar;export&lpar;&rpar;
			
    后台往往需要导出各种数据到 Excel文档中.通常我们是导出 .csv文件格式,PHP导出函数参考代码如下: /** * 导出数据到CSV文件 * * @param array $data 二维数组( ...
    
			
    3. 
						
  3. 
对WEB标准以及W3C的理解与认识
			
    按照习惯的理解,这两个概念似乎都是指的一个东西(就是咱们在这个版里讨论的这些个"高深理论“^_^).但我认为,事实上从技术的角度上讲,这两个事物几乎没有任何相关性.web标准简而言之就是将页 ...
    
			
    4. 
						
  4. 
nginx web加密访问
			
    有时我们会有这么一种需求,就是你的网站并不想提供一个公共的访问或者某些页面不希望公开, 我们希望的是某些特定的客户端可以访问.那么我们可以在访问时要求进行身份认证,就如给你自己的家门加一把锁,以拒绝那 ...
    
			
    5. 
						
  5. 
python-map的用法
			
    map()函数 map()是 Python 内置的高阶函数,它接收一个函数 f 和一个 list,并通过把函数 f 依次作用在 list 的每个元素上,得到一个新的 list 并返回. 1.当seq只 ...
    
			
    6. 
						
  6. 
【NodeJS】基础知识
			
    nodejs基础 nodejs允许自己封装模块,使得编写程序可以模块化,便于维护整理.在一个js文件中写完封装的函数或对象后,可以使用exports或module.exports来将模块中的函数暴露给 ...
    
			
    7. 
						
  7. 
urlconnection代码
			
    package com.yucheng.connection; import java.io.BufferedReader; import java.io.InputStream; import ja ...
    
			
    8. 
						
  8. 
linux使用framebuffer的代码
			
    #include <linux/fb.h> #include <sys/mman.h> #include <sys/ioctl.h> #include <st ...
    
			
    9. 
						
  9. 
&lbrack;leetcode&rsqb;股票题型123
			
    122. Best Time to Buy and Sell Stock II Say you have an array for which the ith element is the price ...
    
			
    10. 
						
  10. 
flutter 安装过程遇到的坑
			
    Flutter是一个移动应用程序的软件开发工具包(SDK),用一个代码库构建高性能.高保真的iOS和Android应用程序.目标是使开发人员能够为Android和iOS提供自然的高质量的应用,在滚动行 ...
    
			
    11. 
			
相关文章