关于springboot:SpringBootWeb应用安全策略实现

45次阅读

共计 11343 个字符，预计需要花费 29 分钟才能阅读完成。

背景

近期我的项目上线，甲方要求通过平安检测能力进行验收，故针对扫描后果对系统进行了一系列的平安加固，本文对一些常见的平安问题及防护策略进行介绍，提供对应的解决方案

跨站脚本攻打

XSS 常产生于论坛评论等零碎，当初富文本编辑器已对 XSS 进行了防护，然而咱们任须要在后端接口进行数据过滤,

常见防护策略是通过过滤器将歹意提交的脚本进行过滤与替换 

public class XSSFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException { }

    @Override
    public void destroy() {}

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {//System.out.println("XSSFilter");
        String contentType = request.getContentType();
        if (StringUtils.isNotBlank(contentType) && contentType.contains("application/json")) {XSSBodyRequestWrapper xssBodyRequestWrapper = new XSSBodyRequestWrapper((HttpServletRequest) request);
            chain.doFilter(xssBodyRequestWrapper, response);
        } else {chain.doFilter(request, response);
        }
    }
}
public class XSSBodyRequestWrapper extends HttpServletRequestWrapper {

    private String body;

    public XSSBodyRequestWrapper(HttpServletRequest request) {super(request);
        try{body = XSSScriptUtil.handleString(CommonUtil.getBodyString(request));
        }catch (Exception e){e.printStackTrace();
        }
    }

    @Override
    public BufferedReader getReader() throws IOException {return new BufferedReader(new InputStreamReader(getInputStream()));
    }

    @Override
    public ServletInputStream getInputStream() throws IOException {final ByteArrayInputStream bais = new ByteArrayInputStream(body.getBytes(Charset.forName("UTF-8")));

        return new ServletInputStream() {

            @Override
            public int read() throws IOException {return bais.read();
            }

            @Override
            public boolean isFinished() {return false;}

            @Override
            public boolean isReady() {return false;}

            @Override
            public void setReadListener(ReadListener readListener) {}};
    }

}
public class XSSScriptUtil {public static String handleString(String value) {if (value != null) {Pattern scriptPattern = Pattern.compile("<script>(\\s*.*?)</script>",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("-");
            scriptPattern = Pattern.compile("</script(\\s*.*?)>",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("-");
            scriptPattern = Pattern.compile("<script(\\s*.*?)>",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("-");
            scriptPattern = Pattern.compile("eval\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("-");
            scriptPattern = Pattern.compile("e­xpression\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("-");
            scriptPattern = Pattern.compile("javascript:",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("-");
            scriptPattern = Pattern.compile("vbscript:",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("-");
            scriptPattern = Pattern.compile("onload(.*?)=",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("-");


            scriptPattern = Pattern.compile("<+.*(oncontrolselect|oncopy|oncut|ondataavailable|ondatasetchanged|ondatasetcomplete|ondblclick|ondeactivate|ondrag|ondragend|ondragenter|ondragleave|ondragover|ondragstart|ondrop|onerror|onerroupdate|onfilterchange|onfinish|onfocus|onfocusin|onfocusout|onhelp|onkeydown|onkeypress|onkeyup|onlayoutcomplete|onload|onlosecapture|onmousedown|onmouseenter|onmouseleave|onmousemove|onmousout|onmouseover|onmouseup|onmousewheel|onmove|onmoveend|onmovestart|onabort|onactivate|onafterprint|onafterupdate|onbefore|onbeforeactivate|onbeforecopy|onbeforecut|onbeforedeactivate|onbeforeeditocus|onbeforepaste|onbeforeprint|onbeforeunload|onbeforeupdate|onblur|onbounce|oncellchange|onchange|onclick|oncontextmenu|onpaste|onpropertychange|onreadystatechange|onreset|onresize|onresizend|onresizestart|onrowenter|onrowexit|onrowsdelete|onrowsinserted|onscroll|onselect|onselectionchange|onselectstart|onstart|onstop|onsubmit|onunload)+.*=+",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("-");



            // 过滤 emoji 表情
            scriptPattern = Pattern
                    .compile("[\ud83c\udc00-\ud83c\udfff]|[\ud83d\udc00-\ud83d\udfff]|[\u2600-\u27ff]",
                            Pattern.UNICODE_CASE | Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("-");
        }
        return value;
    }
}

SQL 注入

sql 注入是零碎最常见的平安问题之一，会导致登陆平安，数据拜访权限平安等，常见策略除了对 sql 语句放弃参数化编写外，咱们也须要应用拦截器对与提交参数进行检测，呈现敏感字符进行谬误提醒 

@Component
public class SQLInjectInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {//System.out.println("SQLInjectInterceptor");
        boolean isvalid = true;
        String contentType = request.getContentType();
        if (StringUtils.isNotBlank(contentType) && contentType.contains("application/json")) {String body = CommonUtil.getBodyString(request);
            try {Object object = JSON.parse(body);
                if (object instanceof JSONObject) {JSONObject jsonObject = JSONObject.parseObject(body);
                    for (Map.Entry<String, Object> item : jsonObject.entrySet()) {String value = ConvertOp.convert2String(item.getValue());
                        if (SQLInjectUtil.checkSQLInject(value)) {
                            isvalid = false;
                            break;
                        }
                    }
                }
            } catch (Exception e) {e.printStackTrace();
            }
        }
        if (!isvalid) {response.sendRedirect(request.getContextPath() + "/frame/error/sqlInjectionError");
        }
        return isvalid;
    }

}
public class SQLInjectUtil {
    public static String keyWord = "select|update|delete|insert|truncate|declare|cast|xp_cmdshell|count|char|length|sleep|master|mid|and|or";

    public static boolean checkSQLInject(String value) {
        boolean flag = false;
        value = ConvertOp.convert2String(value).toLowerCase().trim();
        if (!StringUtil.isEmpty(value) && !StringUtil.checkIsOnlyContainCharAndNum(value)) {List<String> keyWordList = Arrays.asList(keyWord.split("\\|"));
            for (String ss : keyWordList) {if (value.contains(ss)) {if (StringUtil.checkFlowChar(value, ss, " ", true) ||
                            StringUtil.checkFlowChar(value, ss, "(", true) ||
                            StringUtil.checkFlowChar(value, ss, CommonUtil.getNewLine(), true)) {
                        flag = true;
                        break;
                    }
                }
            }
        }
        return flag;
    }
}

HTTP 申请办法限度

咱们应该只保留零碎须要的申请办法，其它办法例如 DELETE，PUT，TRACE 等会造成零碎数据泄露或毁坏，个别在运行容器中配置即可，针对 jar 包运行的我的项目，因为应用了内置的 tomcat，所以须要独自的配置文件代码进行管制 

@Configuration
public class TomcatConfig {
    @Bean
    public TomcatServletWebServerFactory servletContainer() {TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory() {
            @Override
            protected void postProcessContext(Context context) {SecurityConstraint constraint = new SecurityConstraint();
                SecurityCollection collection = new SecurityCollection();
                //http 办法
                List<String> forbiddenList = Arrays.asList("PUT|DELETE|HEAD|TRACE".split("\\|"));
                for (String method:forbiddenList) {collection.addMethod(method);
                }
                //url 匹配表达式
                collection.addPattern("/*");
                constraint.addCollection(collection);
                constraint.setAuthConstraint(true);
                context.addConstraint(constraint);
                // 设置应用 httpOnly
                context.setUseHttpOnly(true);
            }
        };
        tomcatServletContainerFactory.addConnectorCustomizers(connector -> {connector.setAllowTrace(true);
        });
        return tomcatServletContainerFactory;
    }

}

用户权限

明码加密

针对用户明码须要进行密文存储，保障数据安全，罕用 MD5 算法，因为 MD5 的加密后果的固定性，咱们须要在加密时退出盐来保障每个明码密文的唯一性，咱们采纳的是 MD5（明码 +“|”+ 登录名）的形式，同时针对加密内容存在中文的状况下欠缺解决，防止前后端 MD5 加密后果不统一的状况 

public class EncryptUtil {public static String encryptByMD5(String str) throws NoSuchAlgorithmException, UnsupportedEncodingException {
        // 生成 md5 加密算法
        MessageDigest md5 = MessageDigest.getInstance("MD5");
        md5.update(str.getBytes("UTF-8"));
        byte b[] = md5.digest();
        int i;
        StringBuffer buf = new StringBuffer("");
        for (int j = 0; j < b.length; j++) {i = b[j];
            if (i < 0)
                i += 256;
            if (i < 16)
                buf.append("0");
            buf.append(Integer.toHexString(i));
        }
        String md5_32 = buf.toString();        //32 位加密   与 mysql 的 MD5 函数后果统一。//        String md5_16 = buf.toString().substring(8, 24);    //16 位加密
        return md5_32;
    }
}

登陆验证码

登陆验证码咱们是基于 redis 来实现的，传统 session 实现形式会在 chrome 高版本跨域状况下有所限度

验证码实现形式就是生成随机字符，依据随机字符生成对应 Base64 图片，将图片返回给前端，字符存储 Redis 中并设置过期工夫 

@Component
public class ValidateCodeUtil {private static Random random = new Random();
    private int width = 165; // 验证码的宽
    private int height = 45; // 验证码的高
    private int lineSize = 30; // 验证码中夹杂的烦扰线数量
    private int randomStrNum = 4; // 验证码字符个数

    private String randomString = "0123456789";
    private final String sessionKey = "ValidateCode";

    private int validDBIndex = 2;
    @Autowired
    RedisUtil redisUtil;

    @Autowired
    private FrameConfig frameConfig;

    public String getBase64ValidateImage(String key) {ServletRequestAttributes requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
        // BufferedImage 类是具备缓冲区的 Image 类,Image 类是用于形容图像信息的类
        BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_BGR);
        Graphics g = image.getGraphics();
        g.fillRect(0, 0, width, height);
        g.setColor(getRandomColor(105, 189));
        g.setFont(getFont());
        // 烦扰线
        for (int i = 0; i < lineSize; i++) {drawLine(g);
        }

        // 随机字符
        String randomStr = "";
        for (int i = 0; i < randomStrNum; i++) {randomStr = drawString(g, randomStr, i);
        }
        g.dispose();
        redisUtil.redisTemplateSetForList(key,sessionKey,randomStr,validDBIndex);
        redisUtil.setExpire(key, frameConfig.getValidatecode_expireseconds(),TimeUnit.SECONDS,validDBIndex);
        String base64String = "";
        try {
            //  间接返回图片
            //  ImageIO.write(image, "PNG", response.getOutputStream());
            // 返回 base64
            ByteArrayOutputStream bos = new ByteArrayOutputStream();
            ImageIO.write(image, "PNG", bos);
            byte[] bytes = bos.toByteArray();
            Base64.Encoder encoder = Base64.getEncoder();
            base64String = encoder.encodeToString(bytes);

        } catch (Exception e) {e.printStackTrace();
        }

        return base64String;
    }

    public String checkValidate(String key,String code){
        String errorMessage = "";
        if(redisUtil.isValid(key,validDBIndex)){String sessionCode = ConvertOp.convert2String(redisUtil.redisTemplateGetForList(key,sessionKey,validDBIndex));
            if(!code.toLowerCase().equals(sessionCode)){errorMessage = "验证码不正确";}
        }else{errorMessage = "验证码已过期";}
        return errorMessage;
    }

    // 色彩的设置
    private  Color getRandomColor(int fc, int bc) {fc = Math.min(fc, 255);
        bc = Math.min(bc, 255);
        int r = fc + random.nextInt(bc - fc - 16);
        int g = fc + random.nextInt(bc - fc - 14);
        int b = fc + random.nextInt(bc - fc - 12);

        return new Color(r, g, b);
    }

    // 字体的设置
    private Font getFont() {return new Font("Times New Roman", Font.ROMAN_BASELINE, 40);
    }

    // 烦扰线的绘制
    private void drawLine(Graphics g) {int x = random.nextInt(width);
        int y = random.nextInt(height);
        int xl = random.nextInt(20);
        int yl = random.nextInt(10);
        g.drawLine(x, y, x + xl, y + yl);

    }
    // 随机字符的获取
    private  String getRandomString(int num){num = num > 0 ? num : randomString.length();
        return String.valueOf(randomString.charAt(random.nextInt(num)));
    }
    // 字符串的绘制
    private String drawString(Graphics g, String randomStr, int i) {g.setFont(getFont());
        g.setColor(getRandomColor(108, 190));
        //System.out.println(random.nextInt(randomString.length()));
        String rand = getRandomString(random.nextInt(randomString.length()));
        randomStr += rand;
        g.translate(random.nextInt(3), random.nextInt(6));
        g.drawString(rand, 40 * i + 10, 25);
        return randomStr;
    }
}

踢人下线

此性能保障一个用户账号只能在同一个雷同类型的设施上登陆，不同设施反复登陆，则其余登陆机器主动下, 所以咱们须要存储用户的登陆状况，表结构设计如下，LoginFrom 标识登陆起源，比方电脑，挪动端，大屏机等等，主动下线操作能够采纳 websoket 监听告诉 

CREATE TABLE `f_online` (`UnitGuid` varchar(50) NOT NULL,
  `UserGuid` varchar(50) DEFAULT NULL,
  `UserName` varchar(100) DEFAULT NULL,
  `LoginFrom` varchar(50) DEFAULT NULL,
  `LoginDate` datetime DEFAULT NULL,
  `LoginToken` varchar(100) DEFAULT NULL,
  `ReserveA` varchar(100) DEFAULT NULL,
  `ReserveB` varchar(100) DEFAULT NULL,
  `ReserveC` varchar(100) DEFAULT NULL,
  `ReserveD` varchar(100) DEFAULT NULL,
  `SpareX` varchar(100) DEFAULT NULL,
  `SpareY` varchar(100) DEFAULT NULL,
  `SpareZ` varchar(100) DEFAULT NULL,
  PRIMARY KEY (`UnitGuid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

登陆谬误锁定

为了防止歹意尝试明码登陆，咱们须要对在肯定工夫内登陆谬误的用户进行长期的锁定，咱们联合登陆日志，例如如果在 1 分钟内登陆失败超过 5 此，则进行账户锁定 1 分钟，将锁定的 key 依据用户名生成存入 redis 中，设置锁定工夫，在下次登陆时首先查看是否有对应的锁即可

Druid 设置

零碎在集成 Druid 线程池时，会默认有监控页面裸露，咱们要做好登陆权限设置，防止数据库信息泄露 

    @Bean
    public ServletRegistrationBean druidServlet() {ServletRegistrationBean reg = new ServletRegistrationBean();
        reg.setServlet(new StatViewServlet());
        reg.addUrlMappings("/druid/*");
        reg.addInitParameter("allow", ""); // 白名单
        reg.addInitParameter("loginUsername", "admin");
        reg.addInitParameter("loginPassword", "11111");
        return reg;
    }

正文完
springboot
发表至： springboot
2021-12-04
 0
关于springboot:SpringBoot成长记9onRefresh如何启动内嵌的Tomcat容器的
Intellij-创建基于springboot的maven父子结构
关于springboot:通过Docker启动DB2并在Spring-Boot整合DB2
关于springboot:笑小枫的SpringBoot系列六SpringBoot日志打印Logback详解