struts2 ongl漏洞解决方案

 

采用比较简单的过滤器方式拦截掉攻击代码。
以下为解决方式：
过滤器代码：
package org.openxtiger.filter;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
public class CMSContextFilter implements Filter {
@Override
public void destroy() {
// TODO Auto-generated method stub
}
@Override
public void doFilter(ServletRequest request, ServletResponse response,FilterChain chain) throws IOException, ServletException {
request.setCharacterEncoding(“utf-8″);
HttpServletRequest req = (HttpServletRequest)request;
HttpServletResponse res = (HttpServletResponse)response;
String queryString = req.getQueryString();
System.out.println(“queryString=”+queryString);
if(queryString!=null && queryString.indexOf(“\\u0023″)>0){
System.out.println(“有攻击代码!”);
res.sendRedirect(“error.jsp”);
return;
} else {
System.out.println(“没有代码!”);
}
chain.doFilter(request, response);
}
@Override
public void init(FilterConfig cfg) throws ServletException {
}
}
web.xml中的相关配置:
<filter>
<filter-name>filter</filter-name>
<filter-class>
org.openxtiger.filterCMSContextFilter
</filter-class>
</filter><filter-mapping>
<filter-name>filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>