【软件开发规范四】《应用系统安全编码规范》

<%

//String num = request.getParameter("num");

String num="4";

int charNum = 4; // 随机产生字符数量

if(num != null){

charNum = Integer.parseInt(num);

}

int width = 74; // 图片宽

int height = 30; // 图片高

int lineSize = 100; // 干扰线数量

String randString=""; ////需要绘制的随机字符串

BufferedImage buffImage = new BufferedImage(width, height, BufferedImage.TYPE_INT_BGR); // BufferedImage具有可访问图像数据缓冲区的类描述Image

Graphics2D g = buffImage.createGraphics();

//设置背景色

g.setColor(Color.white);

g.fillRect(0, 0, width, height);

//设置字体

g.setFont(new Font("Times New Roman", Font.ROMAN_BASELINE, 18));

//画边框

g.drawRect(0,0,width-1,height-1);

//绘制干扰线

Random random = new Random();

for (int i = 0; i <= lineSize; i )

{

int x = random.nextInt(width);

int y = random.nextInt(height);

int xl = random.nextInt(width/8);

int yl = random.nextInt(height/8);

g.setColor(randColor(130, 250));

g.drawLine(x, y, x xl, y yl);

}

///字符集随机生成字符串

char[] characterSet = 0，1，2，3，4，5，6

'A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z'};

g.setComposite(AlphaComposite.getInstance(AlphaComposite.SRC_OVER, 0.6f)); //设置透明色

g.setFont(new Font("Fixedsys", Font.CENTER_BASELINE, 24));

//产生随机验证码

for (int i = 1; i <= charNum; i )

{

g.setColor(randColor(20,130));

String rand = String.valueOf(characterSet[random.nextInt(characterSet.length)]); //获取随机字符

g.translate(random.nextInt(3), random.nextInt(3));

g.drawString(rand, width/(charNum 2) * i, height/4*3);

randString = rand;

&bsp;}

 g.dispose();

 System.out.println("验证码:"+randString);

 session.setAttribute("validateCode", randString);

 //禁止图像缓存。  

 response.setHeader("Pragma", "no-cache");  

 response.setHeader("Cache-Control", "no-cache");  

 response.setDateHeader("Expires", 0);  

 OutputStream os = response.getOutputStream();

 try

 {

  ImageIO.write(buffImage, "png", os);

  os.close();

  out.clear();

  out = pageContext.pushBody();

 }

 catch (IOException e)

 {

  e.printStackTrace();

 }

%>

<%!

/*

 * 随机获取颜色

 */

private Color randColor(int fc, int bc)

{

 Random random = new Random();

 if (fc > 255)

  fc = 255;

 if (bc > 255)

  bc = 255;

 int r = fc + random.nextInt(bc - fc);

 int g = fc + random.nextInt(bc - fc);

 int b = fc + random.nextInt(bc - fc);

 return new Color(r, g, b);

}

%>

public int doControl() throws SsException {

 try {

  String sms_input =(String)mapValue.get("sms_yzm");

  String errMsg=(String)mapValue.get("respmsg");

  String sms_yzm = priDataCache.getParam("sms_yzm");

  String sms_time = priDataCache.getParam("sms_yzm_time");

boolean isBeyondCount=false;

  //检查是否获取到短信验证码

  if(sms_yzm==null || sms_time==null ||sms_time.equals("")||sms_yzm.equals("")){

   priDataCache.setParam("respcode", "m2019");

   priDataCache.setParam("respmsg", "未获取短信验证码!");

   return -1;

  }

    //短信验证码超时检查

 if(System.currentTimeMillis()-180000>Long.parseLong(sms_time)){//三分钟

   priDataCache.setParam("respcode", "m2020");

   priDataCache.setParam("respmsg", "短信验证码已经超时，请重新获取");

   return -1;

  }

  //检查短信验证码是否已被使用

  if(sms_input!=null&&sms_input.equals(sms_yzm)){

   priDataCache.setParam("sms_yzm", "");

   priDataCache.setParam("sms_yzm_time", "");

  }

   //判断短信的错误尝试次数

        if(sms_input!=null){

int msgCount = iBaseDao.queryForInt("customer.countMsg", param);

     if(msgCount>10){

      isBeyondCount=true;}

if(isBeyondCount){

    TransUtil.buildResponseMessage(AppConstants.RspCode_FAIL, "短信验证码在一天之内不允许超过10次",rst);

    return rst;

}

else{

   priDataCache.setParam("respcode", "m2021");

   priDataCache.setParam("respmsg", errMsg);

   return -1;

  }

 }catch(Exception ex){

  Log.getInstance().error(logId,ex.getMessage(),ex);

  throw new SsException("m2022", "验证码输入不正确" + ex.toString());

 }

 return 0;

}

@RequestMapping(value="/delete/{addrId}")

public Object remove(@PathVariable Long addrId){     

     Map respMap = new HashMap();

     if (WebUtils.isLogged()) {

              this.addressService.removeUserAddress(addrId);            

             respMap.put(Constants.RESP_STATUS_CODE_KEY, Constants.RESP_STATUS_CODE_SUCCESS);

            respMap.put(Constants.MESSAGE,"地址删除成功!");

        }else{

         respMap.put(Constants.RESP_STATUS_CODE_KEY, Constants.RESP_STATUS_CODE_FAIL);

         respMap.put(Constants.ERROR,"用户没用登录，删除地址失败！");

        }

        return respMap;

}

public String getUUID(){

    UUID uuid=UUID.randomUUID();

    String str = uuid.toString();

    String uuidStr=str.replace("-", "");

    return uuidStr;

  }

@RequestMapping(value="/delete/{addrId}")

public Object remove(@PathVariable Long addrId){     

     Map respMap = new HashMap();

     if (WebUtils.isLogged()) {

              this.addressService.removeUserAddress(addrId,WebUtils.getLoggedUserId());            

             respMap.put(Constants.RESP_STATUS_CODE_KEY, Constants.RESP_STATUS_CODE_SUCCESS);

            respMap.put(Constants.MESSAGE,"地址删除成功!");

        }else{

         respMap.put(Constants.RESP_STATUS_CODE_KEY, Constants.RESP_STATUS_CODE_FAIL);

         respMap.put(Constants.ERROR,"用户没用登录，删除地址失败！");

        }

        return respMap;

}

@RequestMapping(value = "delete")

public String delete(HttpServletRequest request, @RequestParam Long id)

   throws Exception {

  try {

   userManager.delete(id);

   request.setAttribute("msg", "删除用户成功");

  } catch (ServiceException e) {

   // logger.error(e.getMessage(), e);

   request.setAttribute("msg", "删除用户失败");

  }

  return list(request);

}

public class PrivilegeFilter implements Filter

{

 private Properties properties=new Properties();

 @Override

 public void destroy(){properties=null;}

 @Override

 public void init(FilterConfig config) throws ServletException

 {

  //获取资源访问权限配置

  String fileName=config.getInitParameter("privilegeFile");

  String realPath=config.getServletContext().getRealPath(fileName);

  try

  {

   properties.load(new FileInputStream(realPath));

  }

  catch(Exception e)

  {

   config.getServletContext().log("读取权限控制文件失败",e);

  }

 }

 @Override

 public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)

   throws IOException, ServletException

 {

  HttpServletRequest request=(HttpServletRequest)req;

  HttpServletResponse response=(HttpServletResponse)res;

  String requestUri=request.getRequestURI().replace(request.getContextPath()+"/", "");

  String action=request.getParameter("action");

  action=action==null?"":action;

  String uri=requestUri+"?action="+action;

  String role=(String)request.getSession().getAttribute("role");

  role=role==null?"guest":role;

  boolean authen=false;

  for(Object obj:properties.keySet())

  {

   String key=(String)obj;

   if(uri.matches(key.replace("?", "\\?").replace(".", "\\.").replace("*", ".*")))

   {

    if(role.equals(properties.get(key)))

    {

     authen=true;

     break;

    }

   }

  }

  if(!authen)

  {

   throw new RuntimeException("您无权访问该页面，请以合适的身份登录后查看。");

  }

  chain.doFilter(request, response);

 }

}

admin.do?action=*  =  administrator

list.do?action=add  =  admin

list.do?action=view  =  guest

 privilegeFilter

 com.filter.privilegeFilter

  privilegeFile

  /WEB-INF/privilege.properties

String GenerateReceiptURL(String baseUrl) {

    Random ranGen = new Random();

    ranGen.setSeed((new Date()).getTime());

    return(baseUrl + ranGen.nextInt(400000000) + ".html");

}

String GenerateReceiptURL(String baseUrl) {

    SecureRandom ranGen = SecureRandom.getInstance(DEF_RANDOM_ALGORITHM);

    ranGen.setSeed((new Date()).getTime());

    return(baseUrl + ranGen.nextInt(400000000) + ".html");

}

protected void doPost(HttpServletRequest request,

HttpServletResponse response) throws ServletException, IOException {

try {

byte data[] = new byte[1];

//取得用户提交的图片文件名，没有检测是否为图片，也没有检测是否包含../../目录跳转的字符

String imgName = request.getParameter("imgName");

String imgKey = MD5Encrypt.MD5(imgName);//本地

if (imageCache.containsKey(imgKey)) {

data = (byte[]) imageCache.get(imgKey);

} else {

String imagePath = Consts.IMG_LOCAL_PAHT + imgName;

//没有对该参数进行严格的验证和过滤，就拼接成完整的图片路径

InputStream inputStream = null;

File imageFile = new File(imagePath);

logger.debug(imagePath + "  " + imageFile.exists());

if (imageFile.exists() && imageFile.isFile()) {

inputStream = new FileInputStream(imagePath);

int i = inputStream.available();

data = new byte[i];

inputStream.read(data);

inputStream.close();

imageCache.put(imgKey, data);

} else {

……

}

}

//将文件内容输出到客户端

response.setContentType("image/*");

OutputStream outputStream = response.getOutputStream();

outputStream.write(data);

outputStream.close();

}

protected void doPost(HttpServletRequest request,

HttpServletResponse response) throws ServletException, IOException {

try {

ImageDao imgDao=new ImageDao();

byte data[] = new byte[1];

String imgID = request.getParameter("imgID");

String imgName=imgDao.getImage(imgID);

String imgKey = MD5Encrypt.MD5(imgName);//本地

if (imageCache.containsKey(imgKey)) {

data = (byte[]) imageCache.get(imgKey);

} else {

String imagePath = Consts.IMG_LOCAL_PAHT + imgName;

//没有对该参数进行严格的验证和过滤，就拼接成完整的图片路径

InputStream inputStream = null;

File imageFile = new File(imagePath);

logger.debug(imagePath + "  " + imageFile.exists());

if (imageFile.exists() && imageFile.isFile()) {

inputStream = new FileInputStream(imagePath);

int i = inputStream.available();

data = new byte[i];

inputStream.read(data);

inputStream.close();

imageCache.put(imgKey, data);

} else {

……

}

}

response.setContentType("image/*");//将文件内容输出到客户端

OutputStream outputStream = response.getOutputStream();

outputStream.write(data);

outputStream.close();

}

String query = "SELECT account_balance FROM user_data WHERE user_name = ‘"

   + request.getParameter("customerName")+"’";

 try {

  Statement statement = connection.createStatement( … );

  ResultSet results = statement.executeQuery( query );

}

  select id, username, hashedPassword

  from some_table

  where id = ${id}

String custname = request.getParameter("customerName");

String query = "SELECT account_balance FROM user_data WHERE user_name = ? ";

PreparedStatement pstmt = connection.prepareStatement( query );

pstmt.setString( 1, custname);

ResultSet results = pstmt.executeQuery( );

  select id, username, hashedPassword

  from some_table

  where id = #{id}

String postid = request.getParameter("postid");

if (postid != null)

{

Statement stmt = con.createStatement();

ResultSet rs = null;

Codec MYSQL_CODEC = new MySQLCodec(Mode.STANDARD);

String escapeParam = ESAPI.encoder().encodeForSQL(MYSQL_CODEC, postid);

String sql = "select * from posts where postid=" + escapeParam;

rs = stmt.executeQuery(sql);

if (rs != null && rs.next())

{

out.print("Title:" + rs.getString("title") + "");

out.print("
-  Posted By " + rs.getString("user"));

out.print("

Content:
" + rs.getString("content"));

}

}

<%out.print(request.getParameter("param")); %>

while(rs.next())

{

%>

&

<

>

"

'

&

<

>

"

'

/

'

"

\

\/

\'

\"

\\

String safe = ESAPI.encoder().encodeForCSS( request.getParameter("input"));

#xmlEscape($name)

String cityname=”北京”+StringUtil.htmlEscape(city.name)+””;

String json =

"citys:{city:['"+

StringUtil.javascript(cityname) +

"']}";

response.setContentType("application/json");

PrintWriter out = response.getWriter();

out.println(StringUtil.htmlEscape(ajaxReturn));

标签

属性

规则

script

all

remove

style

style

css特殊处理

head

all

remove

iframe

all

remove

frame

all

remove

frameset

all

remove

标签

属性

规则

a

style、align、bgcolor、background、title、href

accept

hr

id、style、align、bgcolor、background、title

accept

标签

属性

规则

h1

id、style、align、bgcolor、background、title

accept

h2

id、style、align、bgcolor、background、title

accept

h3

id、style、align、bgcolor、background、title

accept

h4

id、style、align、bgcolor、background、title

accept

h5

id、style、align、bgcolor、background、title

accept

h6

id、style、align、bgcolor、background、title

accept

font

align、bgcolor、background、title、color、size

em

id、style、align、bgcolor、background、title

accept

标签

属性

规则

marquee

style、align、bgcolor、background、title

accept

标签

属性

规则

bgsound

src、loop、autostart

accept

blockquote

id、style、align、bgcolor、background、title

accept

int userid=Integer.valueOf(request.getSession().getAttribute("userid").toString());

String email=request.getParameter("email");

String tel=request.getParameter("password");

String realname=request.getParameter("realname");

Object[] params = new Object[4];

params[0] = email;

params[1] = password;

params[2] = realname;

params[3] = userid;

final String sql = "update user set email=?,password=?,realname=? where userid=?";

conn.execUpdate(sql,params);

// 从 HTTP 头中取得 Referer 值

String referer=request.getHeader("Referer");

// 判断 Referer 是否以 bank.example 开头

if((referer!=null) &&(referer.trim().startsWith(“bank.example”))){

    chain.doFilter(request, response);

}else{

request.getRequestDispatcher(“error.jsp”).forward(request,response);

}

HttpServletRequest req = (HttpServletRequest)request;

HttpSession s = req.getSession();

// 从 session 中得到 csrftoken 属性

String sToken = (String)s.getAttribute(“csrftoken”);

if(sToken == null){

    // 产生新的 token 放入 session 中

    sToken = generateToken();

    s.setAttribute(“csrftoken”,sToken);

    chain.doFilter(request, response);

} else{

    // 从 HTTP 头中取得 csrftoken

    String xhrToken = req.getHeader(“csrftoken”);

    // 从请求参数中取得 csrftoken

    String pToken = req.getParameter(“csrftoken”);

    if(sToken != null && xhrToken != null && sToken.equals(xhrToken)){

        chain.doFilter(request, response);

    }else if(sToken != null && pToken != null && sToken.equals(pToken)){

        chain.doFilter(request, response);

    }else{

request.getRequestDispatcher(“error.jsp”).forward(request,response);

    }

 }

private boolean doLogin(HttpServletRequest request) throws ParserConfigurationException, SAXException, IOException, XPathExpressionException

{

String userName=request.getParameter("username");

String password=request.getParameter("userpass");

DocumentBuilderFactory domFactory=DocumentBuilderFactory.newInstance();

domFactory.setNamespaceAware(true);

DocumentBuilder builder=domFactory.newDocumentBuilder();

Document doc=builder.parse(request.getRealPath("WEB-INF")+"/users.xml");

XPathFactory factory=XPathFactory.newInstance();

XPath xPath=factory.newXPath();

XPathExpression expression=xPath.compile("//users/user[username/text()='"+userName+"' and password/text()='"+password+"']");

Object result=expression.evaluate(doc, XPathConstants.NODESET);

NodeList nodes=(NodeList)result;

return (nodes.getLength()>=1);

}

declare variable $username as xs:string extenal;

declare variable $password as xs:string extenal;

//users/user[@username=$username and @password=$password]

private boolean doLogin(HttpServletRequest request) throws ParserConfigurationException, SAXException, IOException, XPathExpressionException

{

String userName=request.getParameter("username");

String password=request.getParameter("userpass");

DocumentBuilderFactory domFactory=DocumentBuilderFactory.newInstance();

domFactory.setNamespaceAware(true);

DocumentBuilder builder=domFactory.newDocumentBuilder();

Document doc=builder.parse(request.getRealPath("WEB-INF")+"/users.xml");

XQuery xquery=new XQueryFactory().createXQuery(new File(request.getRealPath("WEB-INF")+"/login.xq"));

Map queryMap=new HashMap();

queryMap.put("username",userName);

queryMap.put("password", password);

NodeList nodes=xquery.execute(doc,null,queryMap).toNodes();

NodeList nodes=(NodeList)result;

return (nodes.getLength()>=1);

}

ESAPI.encoder().encodeForXPath($userInput$);   

InputStream xml=request.getInputStream();

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

DocumentBuilder builder = factory.newDocumentBuilder();

InputSource is = new InputSource(xml);

Document doc = builder.parse(is);

Element element = doc.getDocumentElement();

NodeList nodes = element.getChildNodes();

out.print("
Result:
");

out.print("---------------------
");

for (int i = 0; i < nodes.getLength(); i++) {

out.print(nodes.item(i).getNodeName()+" : " + nodes.item(i).getFirstChild().getNodeValue().toString());

            out.print("
");

}

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();

try {

      // 这是优先选择. 如果不允许DTDs (doctypes) ,几乎可以阻止所有的XML实体攻击

      String FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";

      dbf.setFeature(FEATURE, true);

}catch (ParserConfigurationException e) {

            // This should catch a failed setFeature feature

            ...

}catch (SAXException e) {

            // On Apache, this should be thrown when disallowing DOCTYPE

        ...

}catch (IOException e) {

            // XXE that points to a file that doesn't exist

            ...

}