jsp页面高危漏洞的解决办法

最新推荐文章于 2024-04-25 13:59:04 发布

风云正

最新推荐文章于 2024-04-25 13:59:04 发布

阅读量1.5k

点赞数

分类专栏： IT应用文章标签：高危漏洞

本文链接：https://blog.csdn.net/chenzheng8975/article/details/84294844

版权

IT应用专栏收录该内容

8 篇文章 0 订阅

订阅专栏

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html  PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<%@ page language="java" import="java.util.*,java.lang.*"
	pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jstl/core_rt"%>
<%@ taglib prefix="sql" uri="http://java.sun.com/jstl/sql_rt"%>
<%@taglib uri="http://java.sun.com/jstl/fmt_rt" prefix="fmt"%>
<html>
 <head>
  <title> New Document </title>
  <meta name="Generator" content="EditPlus">
  <meta name="Author" content="">
  <meta name="Keywords" content="">
  <meta name="Description" content="">
<script type="text/javascript">

var kw = "<%=request.getParameter("sword")%>";

</script>
 </head>

 <body>
  
 </body>
</html>

注入漏洞：

http://wap.51bi.com/wap/search/searchindex.jsp?page=1&sword=";alert('hacker');"

解决办法：

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<%@ page language="java" import="java.util.*,java.lang.*"
    pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jstl/core_rt"%>
<%@ taglib prefix="sql" uri="http://java.sun.com/jstl/sql_rt"%>
<%@taglib uri="http://java.sun.com/jstl/fmt_rt" prefix="fmt"%>
<%
String sword = request.getParameter("sword");
    sword = sword.replace('<', ' ');
    sword = sword.replace('>', ' ');
    sword = sword.replace('"', ' ');
    sword = sword.replace('\'', ' ');
    sword = sword.replace('/', ' ');
    sword = sword.replace('%', ' ');
    sword = sword.replace(';', ' ');
    sword = sword.replace('(', ' ');
    sword = sword.replace(')', ' ');
    sword = sword.replace('&', ' ');
    sword = sword.replace('+', '_');
%>
<html>
<head>
<title> New Document </title>
<meta name="Generator" content="EditPlus">
<meta name="Author" content="">
<meta name="Keywords" content="">
<meta name="Description" content="">
<script type="text/javascript">
var kw = "<%=sword%>";
</script>
</head>

<body>

</body>
</html>

参考方案：

http://knowledge.twisc.ntust.edu.tw/doku.php?id=3%E4%BC%BA%E6%9C%8D%E7%AB%AF%E5%AE%89%E5%85%A8:3-3%E5%AE%89%E5%85%A8%E7%A8%8B%E5%BC%8F%E7%A2%BC%E5%AF%AB%E4%BD%9C:jsp%E9%81%BF%E5%85%8Dxss%E6%96%B9%E6%B3%95

风云正

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
jsp页面高危漏洞的解决办法

&lt;?xml version="1.0" encoding="utf-8"?&gt;&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"&gt;&lt;%@ page language
复制链接

扫一扫