java 目录遍历漏洞_HttpClient使用之下载远程服务器中的文件(注意目录遍历漏洞)...

参考文献：

1.下载地址

Apache-》Projects-》HttpComponents

2.DownloadServlet

1 packagecom.servlet;2

3 importjava.io.BufferedInputStream;4 importjava.io.BufferedOutputStream;5 importjava.io.File;6 importjava.io.FileInputStream;7 importjava.io.IOException;8 importjava.io.InputStream;9 importjava.io.OutputStream;10 importjava.net.URLDecoder;11 importjava.net.URLEncoder;12

13 importjavax.servlet.ServletException;14 importjavax.servlet.http.HttpServlet;15 importjavax.servlet.http.HttpServletRequest;16 importjavax.servlet.http.HttpServletResponse;17

18

19

20 public class DownloadServlet extendsHttpServlet {21

22 private static final long serialVersionUID = 1L;23

24 public voiddoGet(HttpServletRequest request, HttpServletResponse response)25 throwsServletException, IOException {26 String filename = request.getParameter("id");27 String fileUrl = request.getServletContext().getRealPath("").replace("\\", "/");28 fileUrl = fileUrl + "/files/document/" +filename;29 System.out.println("fileUrl:"+fileUrl);30 String rname = new String(filename.getBytes("utf-8"));31 System.out.println("begin:"+rname);32 rname =URLEncoder.encode(rname);33 System.out.println("end:"+rname);34 response.addHeader("Content-Disposition", "attachment;filename="+rname);35 response.setContentType("application/octet-stream");36

37 File file = newFile(fileUrl);38 InputStream is = new BufferedInputStream(newFileInputStream(file));39 byte[] buffer = new byte[is.available()];40 is.read(buffer);41 is.close();42

43 OutputStream os = newBufferedOutputStream(response.getOutputStream());44 os.write(buffer);45 os.flush();46 os.close();47 }48

49

50 public voiddoPost(HttpServletRequest request, HttpServletResponse response)51 throwsServletException, IOException {52

53

54 }55

56

57 }58

59

3.ClientA.java

packagecom.tool;importjava.io.File;importjava.io.FileOutputStream;importjava.io.IOException;importjava.io.InputStream;importjava.io.OutputStream;importorg.apache.http.HttpResponse;importorg.apache.http.client.ClientProtocolException;importorg.apache.http.client.HttpClient;importorg.apache.http.client.methods.HttpGet;importorg.apache.http.impl.client.DefaultHttpClient;public classClientA {/***

*@paramargs*/

public static voidmain(String[] args) {//TODO 自动生成的方法存根

ClientA client = newClientA();

client.service();

}public voidservice() {//TODO 自动生成的方法存根

String url= "http://此处填写ip或网址/download.do";

HttpClient client= newDefaultHttpClient();

HttpGet get= newHttpGet(url);try{

HttpResponse response=client.execute(get);}catch(ClientProtocolException e) {//TODO Auto-generated catch block

e.printStackTrace();

}catch(IOException e) {//TODO Auto-generated catch block

e.printStackTrace();

}

}

}

4.注意服务器的编码方式和客户端的区别

统一为utf-8

5.注意目录遍历漏洞

目录遍历是通过操作URL强行访问web目录以外的文件，目录和命令，攻击者可以在目标机器的任何位置访问文件，执行命令。

最基本的目录遍历攻击技术是在URL中使用"../"序列，改变访问资源的路径，访问到web目录以外的文件。

例如：

http://example.com/../../../../some/file

http://example.com/..%255c..%255c/some/file

正常请求为:

http://example.com/test.cgi?look=intex.html

如果存在目录遍历漏洞，攻击者可以访问

http://example.com/test.cgi?look=test.cgi

解决办法：

过滤请求数据中"../"字符序列及其各种变形。

验证用户请求中提交的需要访问的文件是否在限定的范围内。

java web使用fliter过滤url即可。