Web系统安全问题整理（暴露版本号/重放）

一、系统暴露Tomcat、Nginx版本号

解决办法：

1. 进入tomcat的lib目录找到catalina.jar
2. 进入catalina.jar的org/apache/catalina/util 编辑配置文件ServerInfo.properties
3. 修改ServerInfo.properties中的参数为

 server.info=Apache Tomcat   
  server.number=0.0.0.0 
  server.built=Nov 7 2016 20:05:27 UTC

4. 修改nginx.conf配置文件

http {    
	server_tokens off; 　　#默认是注释掉的
 }

二、防重放

理解：重放漏洞是指不法分子抓取你的增加/修改报文，不断重新请求对应的URL造成数据重复添加操作。
思路：增加一个拦截器，拦截全部增加、修改操作，在方法请求处理之前增加一个唯一标识（UUID等）保存至缓存与request header中，在拦截器中获取两个值进行比较，相同则安全。
代码如下：
封装ajax

function ajax(obj) {
    obj = $.extend({
        contentType: "application/x-www-form-urlencoded; charset=UTF-8"
    }, obj);
    var successFun = obj.success;
    var result;
    var recevieMsgFun = obj.recevieMsg;
    obj.success = function (data, textstatus, request) {
        var tempToken = request.getResponseHeader('token');
        if (tempToken != null && tempToken != '' && tempToken != undefined) {
            window.tokenValue = tempToken;
        }
        if (typeof successFun === "function") {
            successFun(data);
        } else {
            result = data;
        }
        if(typeof recevieMsgFun!="function") {
            alert(data);
        }
        else {
            if(message && message.messageList && message.messageList.length > 0)
            {
                recevieMsgFun(message.messageList);
            }
        }
    }
    var errorFun = obj.error;
    obj.error = function (data) {
        if (typeof errorFun === "function") {
            errorFun(data);
        }
        if (data.responseText && data.responseText.indexOf("{") === 0) {
            if (typeof recevieMsgFun != "function") {
                eval("data=" + data.responseText);
                alert(data);
            }
        }
        var tempToken = data.getResponseHeader("token");
        if (tempToken != null && tempToken != '' && tempToken != undefined) {
            window.tokenValue = tempToken;
        }

    }

    obj.beforeSend = function (request) {
        request.setRequestHeader("token", window.tokenValue);
    }

    $.ajax(obj);
    return result;
}

自定义防重放拦截器 spring配置文件

<mvc:interceptor>
   <mvc:mapping path="/**"/>
   <bean class="****.RefererInterceptor">
   <property name="includeUrls">
   <list> 
   </list>
   </property>
   </bean>
</mvc:interceptor>

RefererInterceptor.java

public class RefererInterceptor implements HandlerInterceptor {
   private Log logger = LogFactory.getLog(this.getClass());
   private final static String TOKEN_NAMESPACE = "TOKEN_NAMESPACE";
 
   private List<String> includeUrls;

   @Override
   public void afterCompletion(HttpServletRequest arg0, HttpServletResponse arg1, Object arg2, Exception arg3)
         throws Exception {}

   @Override
   public void postHandle(HttpServletRequest arg0, HttpServletResponse arg1, Object arg2, ModelAndView arg3)
         throws Exception {}

   @Override
   public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object obj) throws Exception {
      /**
       * 新增、删除、修改操作时进行token验证
       */
      if(isIncludeUrl(request)){     
         String token = UUID.randomUUID().toString();
         request.getSession(false).setAttribute("token", token);
         String sessionId = request.getSession().getId();
         CacheService cacheService = CacheServiceFactory.getInstance();     
         String serverToken = cacheService.getVal(TOKEN_NAMESPACE, sessionId);
         cacheService.putVal(TOKEN_NAMESPACE, sessionId, token);
         response.addHeader("token", token);
         request.setAttribute("token", token);
         String headerToken = request.getHeader("token");

         if (EmptyUtils.isEmpty(headerToken)) {
            headerToken = request.getParameter("token");
         }
         
         if (EmptyUtils.isEmpty(headerToken)  || serverToken == null || !serverToken.equals(headerToken)) {
            
            logger.error(request.getRequestURI() + "请求的token已失效"  + "  serverToken = "  +serverToken   + "  headerToken = "  + headerToken);
            return false;
         }
      }
      return true;
   }

   private boolean isIncludeUrl(HttpServletRequest request) {
      if (!EmptyUtils.isAnyoneEmpty(includeUrls)) {
         String requestPath = request.getRequestURI();
         for (String urlRegex : includeUrls) {
            Pattern p = Pattern.compile(urlRegex);
            if (p.matcher(requestPath).find()) {
               return true;
            }
         }
      }
      return false;
   }
   
   public List<String> getIncludeUrls() {
      return includeUrls;
   }
   public void setIncludeUrls(List<String> includeUrls) {
      this.includeUrls = includeUrls;
   }
}

后续更新XSS注入与越权等安全问题。