跨脚本+host拦截

https://github.com/hd19940104
https://blog.csdn.net/qq_38873248
https://gitee.com/hd19940104
https://my.oschina.net/u/3855614
 

 

创建三个类

package com.security;

 
import java.io.IOException;
import java.util.LinkedHashMap;
import java.util.Map;
 
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
 
public class XSSFilter implements Filter {
 
    // XSS处理Map
    private static Map<String,String> xssMap = new LinkedHashMap<String,String>();
     
    public void init(FilterConfig filterConfig) throws ServletException {
        // 含有脚本： script
        xssMap.put("[s|S][c|C][r|R][i|C][p|P][t|T]", "");
        // 含有脚本 javascript
        xssMap.put("[\\\"\\\'][\\s]*[j|J][a|A][v|V][a|A][s|S][c|C][r|R][i|I][p|P][t|T]:(.*)[\\\"\\\']", "\"\"");
        // 含有函数： eval
        xssMap.put("[e|E][v|V][a|A][l|L]\\((.*)\\)", "");
        // 含有符号 <
        xssMap.put("<", "<");
        // 含有符号 >
        xssMap.put(">", ">");
        // 含有符号 (
        xssMap.put("\\(", "(");
        // 含有符号 )
        xssMap.put("\\)", ")");
        // 含有符号 '
        xssMap.put("'", "'");
        // 含有符号 "
        xssMap.put("\"", "\"");
    }
     
    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
        // 强制类型转换 HttpServletRequest
        HttpServletRequest httpReq = (HttpServletRequest)request;
        // 构造HttpRequestWrapper对象处理XSS
        HttpRequestWrapper httpReqWarp = new HttpRequestWrapper(httpReq,xssMap);
        //
        chain.doFilter(httpReqWarp, response);
 
    }
 
    public void destroy() {
         
    }

}

==================================================

package com.security;

import java.io.IOException;
import java.util.Iterator;
import java.util.Map;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.apache.commons.lang.StringUtils;

import com.thinkive.base.config.Configuration;

/**
 *
 * 描述：host拦截器+扫描跨站式漏洞
 * @since
 */
public class SessionFilter implements Filter {
    
    
    private static String NO_CHECK="modifyPwd.action";//修改密码白名单
    
    public void destroy() {
    }

    public void doFilter(ServletRequest servletRequest,
            ServletResponse servletResponse, FilterChain filterChain)
            throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        String requestStr = getRequestString(request);
        //System.out.println("requestStr： ======================== " + requestStr);
        //System.out.println("完整的地址是====" + request.getRequestURL().toString());
        //System.out.println("提交的方式是========" + request.getMethod());
        if ("bingo".equals(guolv2(requestStr))
                || "bingo".equals(guolv2(request.getRequestURL().toString()))) {
            //System.out.println("======访问地址发现非法字符，已拦截======");
            response.sendRedirect(request.getContextPath() + "/404.jsp");
            return;
        }
        // 主机ip和端口 或 域名和端口
        String myhosts = request.getHeader("host");
        System.out.println("myhosts="+myhosts);
        String temp=Configuration.getString("system.host");//获取合法的host
        if(!"".equals(temp)){
            String[] temps=temp.split(",");
            boolean isHost=false;
            for (String string_temp : temps) {
                if(!StringUtils.equals(myhosts,string_temp)){
                    isHost=true;
                }else{
                    isHost=false;
                    break;
                }
            }
            if(isHost){
                response.sendRedirect(request.getContextPath() + "/404.jsp");
                return;
            }
        }

        String currentURL = request.getRequestURI();
        if(currentURL.indexOf(NO_CHECK)>-1){
            filterChain.doFilter(request, response);
            System.out.println("白名单直接过滤");
            return;
        }
        //过滤请求特殊字符，扫描跨站式漏洞
        Map parameters = request.getParameterMap();
        if (parameters != null && parameters.size() > 0) {
            for (Iterator iter = parameters.keySet().iterator(); iter.hasNext();) {
                String key = (String) iter.next();
                String[] values = (String[]) parameters.get(key);
                for (int i = 0; i < values.length; i++) {
                    values[i] = guolv(values[i]);
                    System.out.println(values[i]);
                }
            }
        }
        filterChain.doFilter(request, response);
    }

    public void init(FilterConfig filterConfig) throws ServletException {
    }

    public static String guolv(String a) {
        a = a.replaceAll("%22", "");
        a = a.replaceAll("%27", "");
        a = a.replaceAll("%3E", "");
        a = a.replaceAll("%3e", "");
        a = a.replaceAll("%3C", "");
        a = a.replaceAll("%3c", "");
        a = a.replaceAll("<", "");
        a = a.replaceAll(">", "");
        a = a.replaceAll("\"", "");
        a = a.replaceAll("'", "");
        a = a.replaceAll("\\+", "");
        a = a.replaceAll("\\(", "");
        a = a.replaceAll("\\)", "");
        a = a.replaceAll(" and ", "");
        a = a.replaceAll(" or ", "");
        a = a.replaceAll(" 1=1 ", "");
        return a;
    }

    private String getRequestString(HttpServletRequest req) {
        String requestPath = req.getServletPath().toString();
        String queryString = req.getQueryString();
        if (queryString != null)
            return requestPath + "?" + queryString;
        else
            return requestPath;
    }

    public String guolv2(String a) {
        if (StringUtils.isNotEmpty(a)) {
            if (a.contains("%22") || a.contains("%3E") || a.contains("%3e")
                    || a.contains("%3C") || a.contains("%3c")
                    || a.contains("<") || a.contains(">") || a.contains("\"")
                    || a.contains("'") || a.contains("+") ||
                    a.contains(" and ") || a.contains(" or ")
                    || a.contains("1=1") || a.contains("(") || a.contains(")")) {
                return "bingo";
            }
        }
        return a;
    }
 

}

========================================

package com.security;

import java.io.IOException;
import java.util.Map;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class ServletCGIFilter implements Filter
{
    
    public void destroy()
    {
        
    }
    
    public void doFilter(ServletRequest request, ServletResponse resposne, FilterChain chain) throws IOException,
            ServletException
    {
        HttpServletRequest hReqest = (HttpServletRequest) request;
        String referer=hReqest.getHeader("Referer");
        Map map=hReqest.getParameterMap();
        HttpServletResponse hResponse = (HttpServletResponse) resposne;
        String queryString = hReqest.getQueryString();
        if ( queryString != null && (queryString.contains("\\u0023") || this.queryStringHasCommond(queryString)) )
        {
            hResponse.sendRedirect(hReqest.getContextPath() + "/404.jsp");
        }else if(map.toString().contains("redirect")){
            hResponse.sendRedirect(hReqest.getContextPath() + "/404.jsp");
        }
        else
        {
            chain.doFilter(request, resposne);
        }
    }
    
    /**
     *
     * 描述：检测查询参数是否包含命令行
     * @since
     * @param queryString
     * @return
     */
    private boolean queryStringHasCommond(String queryString)
    {
        String cmdModel = "^(action|redirect|redirectAction)(\\:|%3a).*$";
        boolean matched = queryString.toLowerCase().matches(cmdModel);
        return matched;
    }
    
    public void init(FilterConfig arg0) throws ServletException
    {
        
    }
    
}

===============================

在xml配置文件里面添加

    <!-- Defensive XSS Attacks Filter-->
    <filter>
        <filter-name>XSSFilters</filter-name>
        <filter-class>com.security.XSSFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>XSSFilters</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter>
        <filter-name>ServletCGIFilter</filter-name>
        <filter-class>com.security.ServletCGIFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>ServletCGIFilter</filter-name>
        <url-pattern>*</url-pattern>
    </filter-mapping>
    <!-- Host漏洞 -->
    <filter>
        <filter-name>SessionFilter</filter-name>
        <filter-class>com.security.SessionFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>SessionFilter</filter-name>
        <url-pattern>*jsp*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>SessionFilter</filter-name>
        <url-pattern>*.action*</url-pattern>
    </filter-mapping>
    <!-- Defensive Remote Code Attacks Filter -->

转载于:https://my.oschina.net/u/3855614/blog/1809574