devbox
羊村懒王
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

XSS安全漏洞修复解决方案_xss修复建议

作者：羊村懒王 | 2024-03-30 02:09:16

赞

踩

xss修复建议

背景：等保测评公司针对我系统进行了一次渗透测试，并发现存在XSS漏洞，现记录修复过程。

框架：SSM。

全站XSS：

漏洞风险等级：中危

涉及页面：全站存在内容输入处

漏洞描述：所有模块可以修改内容处存在XSS，填入恶意代码后触发。 

修复建议：过滤所有输入内容。（防止恶意弹窗/跨站脚本/过滤敏感字符/违法信息等）

 

 

解决方案

列举方案1：写个DispatcherServlet

  1. import javax.servlet.http.HttpServletRequest;
  2.  
  3. import org.springframework.stereotype.Controller;
  4. import org.springframework.web.method.HandlerMethod;
  5. import org.springframework.web.servlet.DispatcherServlet;
  6. import org.springframework.web.servlet.HandlerExecutionChain;
  7.  
  8. @SuppressWarnings("serial")
  9. public class DispatcherServletWrapper extends DispatcherServlet {
  10. 	
  11. 	@Override
  12. 	protected HandlerExecutionChain getHandler(HttpServletRequest request) throws Exception {
  13. 		HandlerExecutionChain chain = super.getHandler(request);
  14. 		Object handler = chain.getHandler();
  15.         if (!(handler instanceof HandlerMethod)) {
  16.             return chain;
  17.         }
  18. 		
  19.         HandlerMethod hm = (HandlerMethod)handler;
  20.         if (!hm.getBeanType().isAnnotationPresent(Controller.class)) {
  21.         	return chain;
  22.         }
  23.         
  24.         //仅处理@Controller注解的Bean
  25. 		return new HandlerExecutionChainWrapper(chain,request,getWebApplicationContext());
  26. 	}
  27. 	
  28. }

在getHandler中返回HandlerExecutionChainWrapper

  1. import java.lang.reflect.Field;
  2. import java.lang.reflect.Method;
  3. import java.util.ArrayList;
  4. import java.util.List;
  5.  
  6. import javax.servlet.http.HttpServletRequest;
  7.  
  8. import org.springframework.beans.factory.BeanFactory;
  9. import org.springframework.cglib.proxy.Enhancer;
  10. import org.springframework.cglib.proxy.MethodInterceptor;
  11. import org.springframework.cglib.proxy.MethodProxy;
  12. import org.springframework.util.ReflectionUtils;
  13. import org.springframework.util.ReflectionUtils.FieldCallback;
  14. import org.springframework.util.ReflectionUtils.FieldFilter;
  15. import org.springframework.web.method.HandlerMethod;
  16. import org.springframework.web.servlet.HandlerExecutionChain;
  17. import org.springframework.web.util.HtmlUtils;
  18.  
  19. public class HandlerExecutionChainWrapper extends HandlerExecutionChain {
  20. 	 
  21. 	private BeanFactory beanFactory;
  22. 	private HttpServletRequest request;
  23. 	private HandlerMethod handlerWrapper;
  24. 	private byte[] lock = new byte[0];
  25. 	
  26. 	public HandlerExecutionChainWrapper(HandlerExecutionChain chain,
  27. 			HttpServletRequest request,
  28. 			BeanFactory beanFactory) {
  29. 		super(chain.getHandler(),chain.getInterceptors());
  30. 		this.request = request;
  31. 		this.beanFactory = beanFactory;
  32. 	}
  33.  
  34. 	@Override
  35. 	public Object getHandler() {
  36. 		if (handlerWrapper != null) {
  37. 			return handlerWrapper;
  38. 		}
  39. 		
  40. 		synchronized (lock) {
  41. 			if (handlerWrapper != null) {
  42. 				return handlerWrapper;
  43. 			}
  44. 			HandlerMethod superMethodHandler = (HandlerMethod)super.getHandler();
  45. 			Object proxyBean = createProxyBean(superMethodHandler);
  46. 			handlerWrapper = new HandlerMethod(proxyBean,superMethodHandler.getMethod());
  47. 			return handlerWrapper;
  48. 		}
  49. 		
  50. 	}
  51. 	
  52. 	/**
  53. 	 * 为Controller Bean创建一个代理实例,以便用于 实现调用真实Controller Bean前的切面拦截
  54. 	 * 用以过滤方法参数中可能的XSS注入
  55. 	 * @param handler
  56. 	 * @return
  57. 	 */
  58. 	private Object createProxyBean(HandlerMethod handler) {
  59. 		try {
  60. 			Enhancer enhancer = new Enhancer();
  61. 			enhancer.setSuperclass(handler.getBeanType());
  62. 			Object bean = handler.getBean();
  63. 			if (bean instanceof String) {
  64. 				bean = beanFactory.getBean((String)bean);
  65. 			}
  66. 			ControllerXssInterceptor xss = new ControllerXssInterceptor(bean);
  67. 			xss.setRequest(this.request);
  68. 			enhancer.setCallback(xss);
  69. 			return enhancer.create();
  70. 		}catch(Exception e) {
  71. 			throw new IllegalStateException("为Controller创建代理失败:"+e.getMessage(), e);
  72. 		}
  73. 	}
  74. 	
  75. 	
  76. 	public static class ControllerXssInterceptor implements MethodInterceptor {
  77.  
  78. 		private Object target;
  79. 		private HttpServletRequest request;
  80. 		private List<String> objectMatchPackages;
  81. 		
  82. 		public ControllerXssInterceptor(Object target) {
  83. 			this.target = target;
  84. 			this.objectMatchPackages = new ArrayList<String>();
  85. 			this.objectMatchPackages.add("com.jwell");
  86. 		}
  87. 		
  88. 		public void setRequest(HttpServletRequest request) {
  89. 			this.request = request;
  90. 		}
  91.  
  92.  
  93. 		@Override
  94. 		public Object intercept(Object obj, Method method, Object[] args, 
  95. 				MethodProxy proxy) 
  96. 				throws Throwable {
  97. 			
  98. 			//对Controller的方法参数进行调用前处理
  99. 			//过滤String类型参数中可能存在的XSS注入
  100. 			if (args != null) {
  101. 				for (int i=0;i<args.length;i++) {
  102. 					if (args[i]==null)
  103. 						continue;
  104. 					
  105. 					if (args[i] instanceof String) {
  106. 						args[i] = stringXssReplace((String)args[i]);
  107. 						continue;
  108. 					}
  109. 					
  110. 					for(String pk:objectMatchPackages) {
  111. 						if (args[i].getClass().getName().startsWith(pk)) {
  112. 							objectXssReplace(args[i]);
  113. 							break;
  114. 						}
  115. 					}
  116. 				}
  117. 			}
  118. 			return method.invoke(target, args);
  119. 		}
  120. 		
  121. 		private String stringXssReplace(String argument) {
  122. 			return HtmlUtils.htmlEscape(argument);
  123. 		}
  124. 		
  125. 		private void objectXssReplace(final Object argument) {
  126. 			if (argument == null)
  127. 				return;
  128. 			
  129. 			ReflectionUtils.doWithFields(argument.getClass(), new FieldCallback(){
  130.  
  131. 				@Override
  132. 				public void doWith(Field field) throws IllegalArgumentException, IllegalAccessException {
  133. 					ReflectionUtils.makeAccessible(field);
  134. 					String fv = (String)field.get(argument);
  135. 					if (fv != null) {
  136. 						String nv = HtmlUtils.htmlEscape(fv);
  137. 						field.set(argument, nv);	
  138. 					}
  139. 				}
  140. 				
  141. 			}, new FieldFilter(){
  142.  
  143. 				@Override
  144. 				public boolean matches(Field field) {
  145. 					boolean typeMatch = String.class.equals(field.getType());
  146. 					
  147. 					if (request!=null && "GET".equals(request.getMethod())) {
  148. 						boolean requMatch = request.getParameterMap().containsKey(field.getName());
  149. 						return typeMatch && requMatch;	
  150. 					}
  151. 					
  152. 					return typeMatch;
  153. 				}
  154. 				
  155. 			});
  156. 		}
  157. 	}

web.xml 替换DispatcherServlet

  1. <!--将org.springframework.web.servlet.DispatcherServlet替换成自己的DispatcherServletWrapper -->
  2. <servlet>
  3.     <servlet-name>SpringMVC</servlet-name>
  4.     <!--安全测试  -->
  5.     <!-- <servlet-class>com.xx.xx.bmms.web.filter.DispatcherServletWrapper</servlet-class> -->
  6.      <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> 
  7.     <init-param>
  8.       <param-name>contextConfigLocation</param-name>
  9.       <param-value>classpath:spring-mvc-bpbj.xml</param-value>
  10.     </init-param>
  11.     <load-on-startup>1</load-on-startup>
  12.     <async-supported>true</async-supported>
  13.   </servlet>

再次测试，已解决，不过此方案本人不推荐，原因（会影响业务，谁用谁知道 哈哈~）

列举方案2：写个filter（推荐）

  1. import java.io.IOException;
  2.  
  3. import javax.servlet.Filter;
  4. import javax.servlet.FilterChain;
  5. import javax.servlet.FilterConfig;
  6. import javax.servlet.ServletException;
  7. import javax.servlet.ServletRequest;
  8. import javax.servlet.ServletResponse;
  9. import javax.servlet.http.HttpServletRequest;
  10.  
  11. public class XssFilter implements Filter{
  12.  
  13. 	FilterConfig filterConfig = null;
  14. 	
  15. 	@Override
  16. 	public void destroy() {
  17. 		// TODO Auto-generated method stub
  18. 		 this.filterConfig = null;
  19. 	}
  20.  
  21. 	@Override
  22. 	public void doFilter(ServletRequest request, ServletResponse response,
  23.             FilterChain chain) throws IOException, ServletException {
  24. 		// TODO Auto-generated method stub
  25. 		 chain.doFilter(new XssShellInterceptor( (HttpServletRequest) request), response);
  26. 	}
  27.  
  28. 	@Override
  29. 	public void init(FilterConfig filterConfig) throws ServletException {
  30. 		// TODO Auto-generated method stub
  31. 		 this.filterConfig = filterConfig;
  32. 	}

XssShellInterceptor类（HttpServletRequestWrapper）

  1. import javax.servlet.http.HttpServletRequest;
  2. import javax.servlet.http.HttpServletRequestWrapper;
  3.  
  4. public class XssShellInterceptor extends HttpServletRequestWrapper{
  5.  
  6. 	public XssShellInterceptor(HttpServletRequest request) {
  7. 		super(request);
  8. 	}
  9.  
  10. 	
  11. 	public String[] getParameterValues(String parameter) {
  12. 	      String[] values = super.getParameterValues(parameter);
  13. 	      if (values==null)  {
  14. 	                  return null;
  15. 	          }
  16. 	      int count = values.length;
  17. 	      String[] encodedValues = new String[count];
  18. 	      for (int i = 0; i < count; i++) {
  19. 	                 encodedValues[i] = cleanXSS(values[i]);
  20. 	       }
  21. 	      return encodedValues;
  22. 	    }
  23. 	    public String getParameter(String parameter) {
  24. 	          String value = super.getParameter(parameter);
  25. 	          if (value == null) {
  26. 	                 return null;
  27. 	                  }
  28. 	          return cleanXSS(value);
  29. 	    }
  30. 	    public String getHeader(String name) {
  31. 	        String value = super.getHeader(name);
  32. 	        if (value == null)
  33. 	            return null;
  34. 	        return cleanXSS(value);
  35. 	    }
  36. 	    
  37. 	    //过滤规则 目前我只配了过滤 script 
  38. 	    private String cleanXSS(String value) {
  39. 	        //value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;");
  40. 	        //value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41;");
  41. 	        //value = value.replaceAll("'", "& #39;");
  42. 	        //value = value.replaceAll("eval\\((.*)\\)", "");
  43. 	        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
  44. 	        value = value.replaceAll("script", "");
  45. 	        return value;
  46. 	    }
  47. 	
  48. }

web.xml 添加filter

  1. <filter>
  2.     	<filter-name>XssFilter</filter-name>
  3.      	<filter-class>com.xx.xx.bmms.web.filter.XssFilter</filter-class>
  4.   </filter>
  5.   <filter-mapping>
  6. 	   <filter-name>XssFilter</filter-name>
  7.        <url-pattern>/*</url-pattern>  
  8.   </filter-mapping>

再次测试，已解决。注意：如果web.xml中有多个filter 注意执行顺序。

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/羊村懒王/article/detail/338571
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号