asp.net防注类

 经常要写一些.net的程序，对于数据库的防注入要求要比较高。这时我从网上搜了一些代码。查看了一下主要是通过HTTPModel来进行对客户端转过来的数据进行处理。
       在服务器安全栏目里我写过一篇《破解通用Sql防注入方法》的文章中说到，一些通用的防注入方法中没有对cookie数据进行过滤，会给黑客留下可乘之机。当然我的这段代码对提交过来的cookie数据也进行了过滤。

代码：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
using System;
using System.Configuration;
using System.Web;
using System.Globalization;
namespace JNYW.StuM.SqlInject
{
    public class SqlstrAny : IHttpModule
    {       
        public void Init(HttpApplication application)
        {
            application.BeginRequest += (new
            EventHandler(this.Application_BeginRequest));
        }
        private void Application_BeginRequest(Object source, EventArgs e)
        {          
            ProcessRequest pr = new ProcessRequest();
            pr.StartProcessRequest();
        }
        public void Dispose()
        {
        }
     }

    public class ProcessRequest
     {
         private static string SqlStr = System.Configuration.ConfigurationManager.AppSettings["SqlInject"].ToString();
         private static string sqlErrorPage = System.Configuration.ConfigurationSettings.AppSettings["SQLInjectErrPage"].ToString();
         ///
         /// 用来识别是否是流的方式传输
         ///
         ///
         ///
         bool IsUploadRequest(HttpRequest request)
         {
             return StringStartsWithAnotherIgnoreCase(request.ContentType, "multipart/form-data");
         }
         ///
         /// 比较内容类型
         ///
         ///
         ///
         ///
         private static bool StringStartsWithAnotherIgnoreCase(string s1, string s2)
         {
             return (string.Compare(s1, 0, s2, 0, s2.Length, true, CultureInfo.InvariantCulture) == 0);
         }
        
        //SQL注入式攻击代码分析
         #region SQL注入式攻击代码分析
         ///
         /// 处理用户提交的请求
         ///
        public void StartProcessRequest()
         {
             HttpRequest Request = System.Web.HttpContext.Current.Request;
             HttpResponse Response = System.Web.HttpContext.Current.Response;
             try
             {
                 string getkeys = "";
                 if (IsUploadRequest(Request)) return; //如果是流传递就退出
//字符串参数
                 if (Request.QueryString != null)
                 {
                     for (int i = 0; i < Request.QueryString.Count; i++)
                     {
                         getkeys = Request.QueryString.Keys[i];
                         if (!ProcessSqlStr(Request.QueryString[getkeys]))
                         {
                             Response.Redirect(sqlErrorPage + "?errmsg=QueryString中含有非法字符串&sqlprocess=true");
                             Response.End();
                         }
                     }
                 }
                //form参数
                 if (Request.Form != null)
                 {
                     for (int i = 0; i < Request.Form.Count; i++)
                     {
                         getkeys = Request.Form.Keys[i];
                         if (!ProcessSqlStr(Request.Form[getkeys]))
                         {
                             Response.Redirect(sqlErrorPage + "?errmsg=Form中含有非法字符串&sqlprocess=true");
                             Response.End();
                         }
                     }
                 }
               //cookie参数
                 if (Request.Cookies != null)
                 {
                     for (int i = 0; i < Request.Cookies.Count; i++)
                     {
                         getkeys = Request.Cookies.Keys[i];
                         if (!ProcessSqlStr(Request.Cookies[getkeys].Value))
                         {
                             Response.Redirect(sqlErrorPage + "?errmsg=Cookie中含有非法字符串&sqlprocess=true");
                             Response.End();
                         }
                     }
                 }
             }
             catch
             {
                 // 错误处理: 处理用户提交信息!
                 Response.Clear();
                 Response.Write("CustomErrorPage配置错误");
                 Response.End();
             }
         }
          
         ///
         /// 分析用户请求是否正常
         ///
         /// 传入用户提交数据
         /// 返回是否含有SQL注入式攻击代码
         private bool ProcessSqlStr(string Str)
         {
             bool ReturnValue = true;
             try
             {
                 if (Str != "")
                 {
                     string[] anySqlStr = SqlStr.Split('|');
                     foreach (string ss in anySqlStr)
                     {
                         if (Str.IndexOf(ss) >= 0)
                         {
                             ReturnValue = false;
                             break;
                         }
                     }
                 }
             }
             catch
             {
                 ReturnValue = false;
             }
             return ReturnValue;
         }
         #endregion
     }
}

在实际使用时，我们要在Web.config文件中的配置节中加上下面的代码

以下是示例代码：

1
2
3
    <!--防注入设置-->
    <add value="and |exec |insert |select |delete |update |count | * |chr |mid |master |truncate |char |declare " key="SQLInject" /?
    <add value="ShowErr.aspx" key="SQLInjectErrPage" />

并且在Web.Config文件的<SYSTEM.WEB>中再加上下面的代码。 以下是示例代码：

1
2
3
4
<!--防注入设置-->
      <HTTPMODULES>
           <addname="SqlstrAny" type="JNYW.StuM.SqlInject.SqlstrAny,SqlstrAny" />
      </HTTPMODULES>
posted @ 2009-02-12 02:45  飞叶  阅读(350)  评论(1)  编辑  收藏  举报