java敏感异常列表_j2ee应用异常信息处理不当，可能导致的安全问题：敏感信息泄露及XSS!...

最新推荐文章于 2022-05-06 21:41:33 发布

何堤森

最新推荐文章于 2022-05-06 21:41:33 发布

阅读量922

点赞数

文章标签： java敏感异常列表

本文链接：https://blog.csdn.net/weixin_34430692/article/details/114826046

版权

j2ee应用异常信息处理不当，可能导致的安全问题：敏感信息泄露及XSS!

shine | 2013-01-22 14:35

//这个以前在空间里有简要说明过这个常见的小问题，也把它搬到乌云来放在一起，以后好找点！

Java异常处理机制(Exception)简要说明：Java中它是由Trowable类的两个子类的两大部分组成，Error类和Exception类。Error是不推荐捕获的(请查看Java异常处理机制中Error与Exception的区别)，而Exception类除了子类RuntimeException是不能被捕获，其他子类的异常必须捕获，简单来讲，就产生异常信息了。

但Exception产生异常信息的过程有个特点，当发生异常时，异常抛给调用该函数的上一级函数，直到出现包含异常处理(catch)的层为止，这个给开发者在程序调试中带来很大的方便，能够快速定位问题所在等，看这段异常信息：

org.springframework.dao.DataIntegrityViolationException: could not execute query; SQL [

select AdContentId,ContentDesc,ContentType,ContentSize,ContentUrl

from AAS_BIZ_AdContent

where 1=1

and AdInfoId = ?

and contentType = ?

order by AdInfoId ,ContentSize

]; nested exception is org.hibernate.exception.DataException: could not execute query

at org.springframework.orm.hibernate3.SessionFactoryUtils.convertHibernateAccessException(SessionFactoryUtils.java:642)

at org.springframework.orm.hibernate3.HibernateAccessor.convertHibernateAccessException(HibernateAccessor.java:412)

at org.springframework.orm.hibernate3.HibernateTemplate.doExecute(HibernateTemplate.java:411)

at org.springframework.orm.hibernate3.HibernateTemplate.executeFind(HibernateTemplate.java:343)

at com.suning.framework.dao.UniversalDaoHibernate.queryListBySql(UniversalDaoHibernate.java:567)

at com.suning.framework.dao.UniversalDaoHibernate.queryListBySql(UniversalDaoHibernate.java:554)

at com.suning.aas.ad.dao.hibernate.AdContentDaoHibernate.searchContent(AdContentDaoHibernate.java:40)

at com.suning.aas.ad.logic.impl.AdInfoBizImpl.searchContent(AdInfoBizImpl.java:100)

at sun.reflect.GeneratedMethodAccessor267.invoke(Unknown Source)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

at java.lang.reflect.Method.invoke(Method.java:600)

at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:309)

at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)

at com.suning.framework.template.ServiceInterceptor.invoke(ServiceInterceptor.java:86)

at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)

at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)

at $Proxy53.searchContent(Unknown Source)

at com.suning.aas.portal.adsearch.action.ChannelAdAction.orderPage(ChannelAdAction.java:152)

at sun.reflect.GeneratedMethodAccessor358.invoke(Unknown Source)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

at java.lang.reflect.Method.invoke(Method.java:600)

at com.opensymphony.xwork2.DefaultActionInvocation.invokeAction(DefaultActionInvocation.java:441)

at com.opensymphony.xwork2.DefaultActionInvocation.invokeActionOnly(DefaultActionInvocation.java:280)

at com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:243)

at com.opensymphony.xwork2.validator.ValidationInterceptor.doIntercept(ValidationInterceptor.java:252)

at org.apache.struts2.interceptor.validation.AnnotationValidationInterceptor.doIntercept(AnnotationValidationInterceptor.java:68)

at com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:87)