背景
近期我的项目上线，甲方要求通过平安检测能力进行验收，故针对扫描后果对系统进行了一系列的平安加固，本文对一些常见的平安问题及防护策略进行介绍，提供对应的解决方案
跨站脚本攻打
XSS常产生于论坛评论等零碎，当初富文本编辑器已对XSS进行了防护，然而咱们任须要在后端接口进行数据过滤,
常见防护策略是通过过滤器将歹意提交的脚本进行过滤与替换
public class XSSFilter implements Filter { @Override public void init(FilterConfig filterConfig) throws ServletException { } @Override public void destroy() { } @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { //System.out.println("XSSFilter"); String contentType = request.getContentType(); if (StringUtils.isNotBlank(contentType) && contentType.contains("application/json")) { XSSBodyRequestWrapper xssBodyRequestWrapper = new XSSBodyRequestWrapper((HttpServletRequest) request); chain.doFilter(xssBodyRequestWrapper, response); } else { chain.doFilter(request, response); } }}public class XSSBodyRequestWrapper extends HttpServletRequestWrapper { private String body; public XSSBodyRequestWrapper(HttpServletRequest request) { super(request); try{ body = XSSScriptUtil.handleString(CommonUtil.getBodyString(request)); }catch (Exception e){ e.printStackTrace(); } } @Override public BufferedReader getReader() throws IOException { return new BufferedReader(new InputStreamReader(getInputStream())); } @Override public ServletInputStream getInputStream() throws IOException { final ByteArrayInputStream bais = new ByteArrayInputStream(body.getBytes(Charset.forName("UTF-8"))); return new ServletInputStream() { @Override public int read() throws IOException { return bais.read(); } @Override public boolean isFinished() { return false; } @Override public boolean isReady() { return false; } @Override public void setReadListener(ReadListener readListener) { } }; }}public class XSSScriptUtil { public static String handleString(String value) { if (value != null) { Pattern scriptPattern = Pattern.compile("<script>(\\s*.*?)</script>", Pattern.CASE_INSENSITIVE); value = scriptPattern.matcher(value).replaceAll("-"); scriptPattern = Pattern.compile("</script(\\s*.*?)>", Pattern.CASE_INSENSITIVE); value = scriptPattern.matcher(value).replaceAll("-"); scriptPattern = Pattern.compile("<script(\\s*.*?)>", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); value = scriptPattern.matcher(value).replaceAll("-"); scriptPattern = Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); value = scriptPattern.matcher(value).replaceAll("-"); scriptPattern = Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); value = scriptPattern.matcher(value).replaceAll("-"); scriptPattern = Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE); value = scriptPattern.matcher(value).replaceAll("-"); scriptPattern = Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE); value = scriptPattern.matcher(value).replaceAll("-"); scriptPattern = Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); value = scriptPattern.matcher(value).replaceAll("-"); scriptPattern = Pattern.compile("<+.*(oncontrolselect|oncopy|oncut|ondataavailable|ondatasetchanged|ondatasetcomplete|ondblclick|ondeactivate|ondrag|ondragend|ondragenter|ondragleave|ondragover|ondragstart|ondrop|onerror|onerroupdate|onfilterchange|onfinish|onfocus|onfocusin|onfocusout|onhelp|onkeydown|onkeypress|onkeyup|onlayoutcomplete|onload|onlosecapture|onmousedown|onmouseenter|onmouseleave|onmousemove|onmousout|onmouseover|onmouseup|onmousewheel|onmove|onmoveend|onmovestart|onabort|onactivate|onafterprint|onafterupdate|onbefore|onbeforeactivate|onbeforecopy|onbeforecut|onbeforedeactivate|onbeforeeditocus|onbeforepaste|onbeforeprint|onbeforeunload|onbeforeupdate|onblur|onbounce|oncellchange|onchange|onclick|oncontextmenu|onpaste|onpropertychange|onreadystatechange|onreset|onresize|onresizend|onresizestart|onrowenter|onrowexit|onrowsdelete|onrowsinserted|onscroll|onselect|onselectionchange|onselectstart|onstart|onstop|onsubmit|onunload)+.*=+", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); value = scriptPattern.matcher(value).replaceAll("-"); // 过滤emoji表情 scriptPattern = Pattern .compile( "[\ud83c\udc00-\ud83c\udfff]|[\ud83d\udc00-\ud83d\udfff]|[\u2600-\u27ff]", Pattern.UNICODE_CASE | Pattern.CASE_INSENSITIVE); value = scriptPattern.matcher(value).replaceAll("-"); } return value; }}SQL注入
sql注入是零碎最常见的平安问题之一，会导致登陆平安，数据拜访权限平安等，常见策略除了对sql语句放弃参数化编写外，咱们也须要应用拦截器对与提交参数进行检测，呈现敏感字符进行谬误提醒
@Componentpublic class SQLInjectInterceptor implements HandlerInterceptor { @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { //System.out.println("SQLInjectInterceptor"); boolean isvalid = true; String contentType = request.getContentType(); if (StringUtils.isNotBlank(contentType) && contentType.contains("application/json")) { String body = CommonUtil.getBodyString(request); try { Object object = JSON.parse(body); if (object instanceof JSONObject) { JSONObject jsonObject = JSONObject.parseObject(body); for (Map.Entry<String, Object> item : jsonObject.entrySet()) { String value = ConvertOp.convert2String(item.getValue()); if (SQLInjectUtil.checkSQLInject(value)) { isvalid = false; break; } } } } catch (Exception e) { e.printStackTrace(); } } if (!isvalid) { response.sendRedirect(request.getContextPath() + "/frame/error/sqlInjectionError"); } return isvalid; }}public class SQLInjectUtil { public static String keyWord = "select|update|delete|insert|truncate|declare|cast|xp_cmdshell|count|char|length|sleep|master|mid|and|or"; public static boolean checkSQLInject(String value) { boolean flag = false; value = ConvertOp.convert2String(value).toLowerCase().trim(); if (!StringUtil.isEmpty(value) && !StringUtil.checkIsOnlyContainCharAndNum(value)) { List<String> keyWordList = Arrays.asList(keyWord.split("\\|")); for (String ss : keyWordList) { if (value.contains(ss)) { if (StringUtil.checkFlowChar(value, ss, " ", true) || StringUtil.checkFlowChar(value, ss, "(", true) || StringUtil.checkFlowChar(value, ss, CommonUtil.getNewLine(), true)) { flag = true; break; } } } } return flag; }}HTTP申请办法限度
咱们应该只保留零碎须要的申请办法，其它办法例如DELETE，PUT，TRACE等会造成零碎数据泄露或毁坏，个别在运行容器中配置即可，针对jar包运行的我的项目，因为应用了内置的tomcat，所以须要独自的配置文件代码进行管制
@Configurationpublic class TomcatConfig { @Bean public TomcatServletWebServerFactory servletContainer() { TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory() { @Override protected void postProcessContext(Context context) { SecurityConstraint constraint = new SecurityConstraint(); SecurityCollection collection = new SecurityCollection(); //http办法 List<String> forbiddenList = Arrays.asList("PUT|DELETE|HEAD|TRACE".split("\\|")); for (String method:forbiddenList) { collection.addMethod(method); } //url匹配表达式 collection.addPattern("/*"); constraint.addCollection(collection); constraint.setAuthConstraint(true); context.addConstraint(constraint ); //设置应用httpOnly context.setUseHttpOnly(true); } }; tomcatServletContainerFactory.addConnectorCustomizers(connector -> { connector.setAllowTrace(true); }); return tomcatServletContainerFactory; }}用户权限
明码加密
针对用户明码须要进行密文存储，保障数据安全，罕用MD5算法，因为MD5的加密后果的固定性，咱们须要在加密时退出盐来保障每个明码密文的唯一性，咱们采纳的是MD5（明码+“|”+登录名）的形式，同时针对加密内容存在中文的状况下欠缺解决，防止前后端MD5加密后果不统一的状况
public class EncryptUtil { public static String encryptByMD5(String str) throws NoSuchAlgorithmException, UnsupportedEncodingException { //生成md5加密算法 MessageDigest md5 = MessageDigest.getInstance("MD5"); md5.update(str.getBytes("UTF-8")); byte b[] = md5.digest(); int i; StringBuffer buf = new StringBuffer(""); for (int j = 0; j < b.length; j++) { i = b[j]; if (i < 0) i += 256; if (i < 16) buf.append("0"); buf.append(Integer.toHexString(i)); } String md5_32 = buf.toString(); //32位加密 与mysql的MD5函数后果统一。// String md5_16 = buf.toString().substring(8, 24); //16位加密 return md5_32; }}登陆验证码
登陆验证码咱们是基于redis来实现的，传统session实现形式会在chrome高版本跨域状况下有所限度
验证码实现形式就是生成随机字符，依据随机字符生成对应Base64图片，将图片返回给前端，字符存储Redis中并设置过期工夫
@Componentpublic class ValidateCodeUtil { private static Random random = new Random(); private int width = 165; //验证码的宽 private int height = 45; //验证码的高 private int lineSize = 30; //验证码中夹杂的烦扰线数量 private int randomStrNum = 4; //验证码字符个数 private String randomString = "0123456789"; private final String sessionKey = "ValidateCode"; private int validDBIndex = 2; @Autowired RedisUtil redisUtil; @Autowired private FrameConfig frameConfig; public String getBase64ValidateImage(String key) { ServletRequestAttributes requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes(); // BufferedImage类是具备缓冲区的Image类,Image类是用于形容图像信息的类 BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_BGR); Graphics g = image.getGraphics(); g.fillRect(0, 0, width, height); g.setColor(getRandomColor(105, 189)); g.setFont(getFont()); //烦扰线 for (int i = 0; i < lineSize; i++) { drawLine(g); } //随机字符 String randomStr = ""; for (int i = 0; i < randomStrNum; i++) { randomStr = drawString(g, randomStr, i); } g.dispose(); redisUtil.redisTemplateSetForList(key,sessionKey,randomStr,validDBIndex); redisUtil.setExpire(key, frameConfig.getValidatecode_expireseconds(),TimeUnit.SECONDS,validDBIndex); String base64String = ""; try { // 间接返回图片 // ImageIO.write(image, "PNG", response.getOutputStream()); //返回 base64 ByteArrayOutputStream bos = new ByteArrayOutputStream(); ImageIO.write(image, "PNG", bos); byte[] bytes = bos.toByteArray(); Base64.Encoder encoder = Base64.getEncoder(); base64String = encoder.encodeToString(bytes); } catch (Exception e) { e.printStackTrace(); } return base64String; } public String checkValidate(String key,String code){ String errorMessage = ""; if(redisUtil.isValid(key,validDBIndex)){ String sessionCode = ConvertOp.convert2String(redisUtil.redisTemplateGetForList(key,sessionKey,validDBIndex)); if(!code.toLowerCase().equals(sessionCode)){ errorMessage = "验证码不正确"; } }else{ errorMessage = "验证码已过期"; } return errorMessage; } //色彩的设置 private Color getRandomColor(int fc, int bc) { fc = Math.min(fc, 255); bc = Math.min(bc, 255); int r = fc + random.nextInt(bc - fc - 16); int g = fc + random.nextInt(bc - fc - 14); int b = fc + random.nextInt(bc - fc - 12); return new Color(r, g, b); } //字体的设置 private Font getFont() { return new Font("Times New Roman", Font.ROMAN_BASELINE, 40); } //烦扰线的绘制 private void drawLine(Graphics g) { int x = random.nextInt(width); int y = random.nextInt(height); int xl = random.nextInt(20); int yl = random.nextInt(10); g.drawLine(x, y, x + xl, y + yl); } //随机字符的获取 private String getRandomString(int num){ num = num > 0 ? num : randomString.length(); return String.valueOf(randomString.charAt(random.nextInt(num))); } //字符串的绘制 private String drawString(Graphics g, String randomStr, int i) { g.setFont(getFont()); g.setColor(getRandomColor(108, 190)); //System.out.println(random.nextInt(randomString.length())); String rand = getRandomString(random.nextInt(randomString.length())); randomStr += rand; g.translate(random.nextInt(3), random.nextInt(6)); g.drawString(rand, 40 * i + 10, 25); return randomStr; }}踢人下线
此性能保障一个用户账号只能在同一个雷同类型的设施上登陆，不同设施反复登陆，则其余登陆机器主动下,所以咱们须要存储用户的登陆状况，表结构设计如下，LoginFrom标识登陆起源，比方电脑，挪动端，大屏机等等，主动下线操作能够采纳websoket监听告诉
CREATE TABLE `f_online` ( `UnitGuid` varchar(50) NOT NULL, `UserGuid` varchar(50) DEFAULT NULL, `UserName` varchar(100) DEFAULT NULL, `LoginFrom` varchar(50) DEFAULT NULL, `LoginDate` datetime DEFAULT NULL, `LoginToken` varchar(100) DEFAULT NULL, `ReserveA` varchar(100) DEFAULT NULL, `ReserveB` varchar(100) DEFAULT NULL, `ReserveC` varchar(100) DEFAULT NULL, `ReserveD` varchar(100) DEFAULT NULL, `SpareX` varchar(100) DEFAULT NULL, `SpareY` varchar(100) DEFAULT NULL, `SpareZ` varchar(100) DEFAULT NULL, PRIMARY KEY (`UnitGuid`)) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;登陆谬误锁定
为了防止歹意尝试明码登陆，咱们须要对在肯定工夫内登陆谬误的用户进行长期的锁定，咱们联合登陆日志，例如如果在1分钟内登陆失败超过5此，则进行账户锁定1分钟，将锁定的key依据用户名生成存入redis中，设置锁定工夫，在下次登陆时首先查看是否有对应的锁即可
Druid设置
零碎在集成Druid线程池时，会默认有监控页面裸露，咱们要做好登陆权限设置，防止数据库信息泄露
@Bean public ServletRegistrationBean druidServlet() { ServletRegistrationBean reg = new ServletRegistrationBean(); reg.setServlet(new StatViewServlet()); reg.addUrlMappings("/druid/*"); reg.addInitParameter("allow", ""); //白名单 reg.addInitParameter("loginUsername", "admin"); reg.addInitParameter("loginPassword", "11111"); return reg; }