目标URL存在跨站漏洞和目标URL存在http host頭攻擊漏洞處理方案
package com.iss.itim.console.common;
import java.io.IOException;
import java.util.Iterator;
import java.util.Map;
import java.io.IOException;
import java.util.Iterator;
import java.util.Map;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.apache.commons.lang.StringUtils;
public class SessionFilter implements Filter
{
public void destroy()
{
}
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
throws IOException, ServletException
{
HttpServletRequest request = (HttpServletRequest)servletRequest;
throws IOException, ServletException
{
HttpServletRequest request = (HttpServletRequest)servletRequest;
HttpServletResponse response = (HttpServletResponse)servletResponse;
String requestStr = getRequestString(request);
System.out.println("requestStr： ======================== " + requestStr);
System.out.println("完整的地址是===="+request.getRequestURL().toString());
System.out.println("提交的方式是========"+request.getMethod());
if("bingo".equals(guolv2(requestStr))||"bingo".equals(guolv2(request.getRequestURL().toString()))){
System.out.println("======訪問地址發現非法字符，已攔截======");
response.sendRedirect(request.getContextPath() + "/login.jsp");
return;
}
//主機ip和端口 或 域名和端口
String myhosts = request.getHeader("host");
if(!StringUtils.equals(myhosts, "xx.xx.xxx.xxx:xxxx") && !StringUtils.equals(myhosts, "xx.xx.xxx.xxx:xxxx")
&& !StringUtils.equals(myhosts, "xx.xx.xxx.xxx:xxxx")&&!StringUtils.equals(myhosts, "xx.xx.xxx.xxx")
&& !StringUtils.equals(myhosts, "xx.xx.xxx.xxx") && !StringUtils.equals(myhosts, "xx.xx.xxx.xxx") ){
System.out.println("======訪問host非法，已攔截======");
response.sendRedirect(request.getContextPath() + "/login.jsp");
return;
}
String currentURL = request.getRequestURI();
//add by wangsk 過濾請求特殊字符，掃描跨站式漏洞
Map parameters = request.getParameterMap();
if (parameters != null && parameters.size() > 0) {
for (Iterator iter = parameters.keySet().iterator(); iter.hasNext();) {
String key = (String) iter.next();
String[] values = (String[]) parameters.get(key);
for (int i = 0; i < values.length; i++) {
values[i]=guolv(values[i]);
System.out.println(values[i]);
}
}
}
String requestStr = getRequestString(request);
System.out.println("requestStr： ======================== " + requestStr);
System.out.println("完整的地址是===="+request.getRequestURL().toString());
System.out.println("提交的方式是========"+request.getMethod());
if("bingo".equals(guolv2(requestStr))||"bingo".equals(guolv2(request.getRequestURL().toString()))){
System.out.println("======訪問地址發現非法字符，已攔截======");
response.sendRedirect(request.getContextPath() + "/login.jsp");
return;
}
//主機ip和端口 或 域名和端口
String myhosts = request.getHeader("host");
if(!StringUtils.equals(myhosts, "xx.xx.xxx.xxx:xxxx") && !StringUtils.equals(myhosts, "xx.xx.xxx.xxx:xxxx")
&& !StringUtils.equals(myhosts, "xx.xx.xxx.xxx:xxxx")&&!StringUtils.equals(myhosts, "xx.xx.xxx.xxx")
&& !StringUtils.equals(myhosts, "xx.xx.xxx.xxx") && !StringUtils.equals(myhosts, "xx.xx.xxx.xxx") ){
System.out.println("======訪問host非法，已攔截======");
response.sendRedirect(request.getContextPath() + "/login.jsp");
return;
}
String currentURL = request.getRequestURI();
//add by wangsk 過濾請求特殊字符，掃描跨站式漏洞
Map parameters = request.getParameterMap();
if (parameters != null && parameters.size() > 0) {
for (Iterator iter = parameters.keySet().iterator(); iter.hasNext();) {
String key = (String) iter.next();
String[] values = (String[]) parameters.get(key);
for (int i = 0; i < values.length; i++) {
values[i]=guolv(values[i]);
System.out.println(values[i]);
}
}
}
public void init(FilterConfig filterConfig)
throws ServletException
{
}
public static String guolv(String a){
a = a.replaceAll("%22","");
a = a.replaceAll("%27","");
a = a.replaceAll("%3E","");
a = a.replaceAll("%3e","");
a = a.replaceAll("%3C","");
a = a.replaceAll("%3c","");
a = a.replaceAll("<","");
a = a.replaceAll(">","");
a = a.replaceAll("\"","");
a = a.replaceAll("'","");
a = a.replaceAll("\\+","");
a = a.replaceAll("\\(","");
a = a.replaceAll("\\)","");
a = a.replaceAll(" and ","");
a = a.replaceAll(" or ","");
a = a.replaceAll(" 1=1 ","");
return a;
}
private String getRequestString(HttpServletRequest req) {
String requestPath = req.getServletPath().toString();
String queryString = req.getQueryString();
if (queryString != null)
return requestPath + "?" + queryString;
else
return requestPath;
}
public String guolv2(String a){
if(StringUtils.isNotEmpty(a)){
if(a.contains("%22") || a.contains("%3E") || a.contains("%3e") || a.contains("%3C") || a.contains("%3c") ||
a.contains("<") || a.contains(">") || a.contains("\"") || a.contains("'") || a.contains("+") || /*a.contains("%27") ||*/
a.contains(" and ") || a.contains(" or ") || a.contains("1=1") ||
a.contains("(") || a.contains(")") ){
return "bingo";
}
}
return a;
}
}
throws ServletException
{
}
public static String guolv(String a){
a = a.replaceAll("%22","");
a = a.replaceAll("%27","");
a = a.replaceAll("%3E","");
a = a.replaceAll("%3e","");
a = a.replaceAll("%3C","");
a = a.replaceAll("%3c","");
a = a.replaceAll("<","");
a = a.replaceAll(">","");
a = a.replaceAll("\"","");
a = a.replaceAll("'","");
a = a.replaceAll("\\+","");
a = a.replaceAll("\\(","");
a = a.replaceAll("\\)","");
a = a.replaceAll(" and ","");
a = a.replaceAll(" or ","");
a = a.replaceAll(" 1=1 ","");
return a;
}
private String getRequestString(HttpServletRequest req) {
String requestPath = req.getServletPath().toString();
String queryString = req.getQueryString();
if (queryString != null)
return requestPath + "?" + queryString;
else
return requestPath;
}
public String guolv2(String a){
if(StringUtils.isNotEmpty(a)){
if(a.contains("%22") || a.contains("%3E") || a.contains("%3e") || a.contains("%3C") || a.contains("%3c") ||
a.contains("<") || a.contains(">") || a.contains("\"") || a.contains("'") || a.contains("+") || /*a.contains("%27") ||*/
a.contains(" and ") || a.contains(" or ") || a.contains("1=1") ||
a.contains("(") || a.contains(")") ){
return "bingo";
}
}
return a;
}
}
你可能想看：
上一篇
治療打鼾（打呼噜）方
最新文章
-
“豫西中醫界之泰鬥喬保均”治療疑難病60年經驗賞析
7小時前 -
回憶、健忘和灑脫
7小時前 -
弘一法師：“真的不忍心告訴你，這個世界隻是一個夢。你一輩子執
8小時前 -
心理學，準的讓你驚叫
8小時前 -
人生，成大器者有四識，知識、見識、膽識、遠識
8小時前 -
俞和：被遺忘的書法家，以古為師，創新在手！
8小時前 -
2024屆新高考II卷語文真題答案及解析
8小時前 -
生前隻是小人物，死後震驚史學界
9小時前
熱門文章
-
每日一誦傷寒論第241條
1周前 -
老張老李侃門球之140篇
2天前 -
這個穴位可以治療多種胃痛腹痛，還可以減肥
5天前 -
為什麼五點鐘要起床答案讓人吃驚！（現在知道還不晚）
1周前 -
治療坐骨神經痛藥酒５方
1周前 -
診餘雜記（師傳經驗）
4天前 -
美麗中國-2870：中國最大的内陸河，塔裡木河
2天前 -
二十四山開門放水作竈真訣開門放水作竈直訣——子山
2天前
有話要說...