SpringBoot-Web应用安全策略实现
背景
近期项目上线，甲方要求通过安全检测才能进行验收，故针对扫描结果对系统进行了一系列的安全加固，本文对一些常见的安全问题及防护策略进行介绍，提供对应的解决方案
跨站脚本攻击
XSS常发生于论坛评论等系统，现在富文本编辑器已对XSS进行了防护，但是我们任需要在后端接口进行数据过滤,
常见防护策略是通过过滤器将恶意提交的脚本进行过滤与替换
public class XSSFilter implements Filter {
@Override
public void init(FilterConfig filterConfig) throws ServletException {
}
@Override
public void destroy() {
}
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
//System.out.println("XSSFilter");
String contentType = request.getContentType();
if (StringUtils.isNotBlank(contentType) && contentType.contains("application/json")) {
XSSBodyRequestWrapper xssBodyRequestWrapper = new XSSBodyRequestWrapper((HttpServletRequest) request);
chain.doFilter(xssBodyRequestWrapper, response);
} else {
chain.doFilter(request, response);
}
}
}
public class XSSBodyRequestWrapper extends HttpServletRequestWrapper {
private String body;
public XSSBodyRequestWrapper(HttpServletRequest request) {
super(request);
try{
body = XSSScriptUtil.handleString(CommonUtil.getBodyString(request));
}catch (Exception e){
e.printStackTrace();
}
}
@Override
public BufferedReader getReader() throws IOException {
return new BufferedReader(new InputStreamReader(getInputStream()));
}
@Override
public ServletInputStream getInputStream() throws IOException {
final ByteArrayInputStream bais = new ByteArrayInputStream(body.getBytes(Charset.forName("UTF-8")));
return new ServletInputStream() {
@Override
public int read() throws IOException {
return bais.read();
}
@Override
public boolean isFinished() {
return false;
}
@Override
public boolean isReady() {
return false;
}
@Override
public void setReadListener(ReadListener readListener) {
}
};
}
}
public class XSSScriptUtil {
public static String handleString(String value) {
if (value != null) {
Pattern scriptPattern = Pattern.compile("<script>(\\s*.*?)</script>",
Pattern.CASE_INSENSITIVE);
value = scriptPattern.matcher(value).replaceAll("-");
scriptPattern = Pattern.compile("</script(\\s*.*?)>",
Pattern.CASE_INSENSITIVE);
value = scriptPattern.matcher(value).replaceAll("-");
scriptPattern = Pattern.compile("<script(\\s*.*?)>",
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
| Pattern.DOTALL);
value = scriptPattern.matcher(value).replaceAll("-");
scriptPattern = Pattern.compile("eval\\((.*?)\\)",
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
| Pattern.DOTALL);
value = scriptPattern.matcher(value).replaceAll("-");
scriptPattern = Pattern.compile("expression\\((.*?)\\)",
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
| Pattern.DOTALL);
value = scriptPattern.matcher(value).replaceAll("-");
scriptPattern = Pattern.compile("javascript:",
Pattern.CASE_INSENSITIVE);
value = scriptPattern.matcher(value).replaceAll("-");
scriptPattern = Pattern.compile("vbscript:",
Pattern.CASE_INSENSITIVE);
value = scriptPattern.matcher(value).replaceAll("-");
scriptPattern = Pattern.compile("onload(.*?)=",
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
| Pattern.DOTALL);
value = scriptPattern.matcher(value).replaceAll("-");
scriptPattern = Pattern.compile("<+.*(oncontrolselect|oncopy|oncut|ondataavailable|ondatasetchanged|ondatasetcomplete|ondblclick|ondeactivate|ondrag|ondragend|ondragenter|ondragleave|ondragover|ondragstart|ondrop|onerror|onerroupdate|onfilterchange|onfinish|onfocus|onfocusin|onfocusout|onhelp|onkeydown|onkeypress|onkeyup|onlayoutcomplete|onload|onlosecapture|onmousedown|onmouseenter|onmouseleave|onmousemove|onmousout|onmouseover|onmouseup|onmousewheel|onmove|onmoveend|onmovestart|onabort|onactivate|onafterprint|onafterupdate|onbefore|onbeforeactivate|onbeforecopy|onbeforecut|onbeforedeactivate|onbeforeeditocus|onbeforepaste|onbeforeprint|onbeforeunload|onbeforeupdate|onblur|onbounce|oncellchange|onchange|onclick|oncontextmenu|onpaste|onpropertychange|onreadystatechange|onreset|onresize|onresizend|onresizestart|onrowenter|onrowexit|onrowsdelete|onrowsinserted|onscroll|onselect|onselectionchange|onselectstart|onstart|onstop|onsubmit|onunload)+.*=+",
Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
| Pattern.DOTALL);
value = scriptPattern.matcher(value).replaceAll("-");
// 过滤emoji表情
scriptPattern = Pattern
.compile(
"[\ud83c\udc00-\ud83c\udfff]|[\ud83d\udc00-\ud83d\udfff]|[\u2600-\u27ff]",
Pattern.UNICODE_CASE | Pattern.CASE_INSENSITIVE);
value = scriptPattern.matcher(value).replaceAll("-");
}
return value;
}
}
SQL注入
sql注入是系统最常见的安全问题之一，会导致登陆安全，数据访问权限安全等，常见策略除了对sql语句保持参数化编写外，我们也需要使用拦截器对与提交参数进行检测，出现敏感字符进行错误提示
@Component
public class SQLInjectInterceptor implements HandlerInterceptor {
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
//System.out.println("SQLInjectInterceptor");
boolean isvalid = true;
String contentType = request.getContentType();
if (StringUtils.isNotBlank(contentType) && contentType.contains("application/json")) {
String body = CommonUtil.getBodyString(request);
try {
Object object = JSON.parse(body);
if (object instanceof JSONObject) {
JSONObject jsonObject = JSONObject.parseObject(body);
for (Map.Entry<String, Object> item : jsonObject.entrySet()) {
String value = ConvertOp.convert2String(item.getValue());
if (SQLInjectUtil.checkSQLInject(value)) {
isvalid = false;
break;
}
}
}
} catch (Exception e) {
e.printStackTrace();
}
}
if (!isvalid) {
response.sendRedirect(request.getContextPath() + "/frame/error/sqlInjectionError");
}
return isvalid;
}
}
public class SQLInjectUtil {
public static String keyWord = "select|update|delete|insert|truncate|declare|cast|xp_cmdshell|count|char|length|sleep|master|mid|and|or";
public static boolean checkSQLInject(String value) {
boolean flag = false;
value = ConvertOp.convert2String(value).toLowerCase().trim();
if (!StringUtil.isEmpty(value) && !StringUtil.checkIsOnlyContainCharAndNum(value)) {
List<String> keyWordList = Arrays.asList(keyWord.split("\\|"));
for (String ss : keyWordList) {
if (value.contains(ss)) {
if (StringUtil.checkFlowChar(value, ss, " ", true) ||
StringUtil.checkFlowChar(value, ss, "(", true) ||
StringUtil.checkFlowChar(value, ss, CommonUtil.getNewLine(), true)) {
flag = true;
break;
}
}
}
}
return flag;
}
}
HTTP请求方法限制
我们应该只保留系统需要的请求方法，其它方法例如DELETE，PUT，TRACE等会造成系统数据泄露或破坏，一般在运行容器中配置即可，针对jar包运行的项目，因为使用了内置的tomcat，所以需要单独的配置文件代码进行控制
@Configuration
public class TomcatConfig {
@Bean
public TomcatServletWebServerFactory servletContainer() {
TomcatServletWebServerFactory tomcatServletContainerFactory = new TomcatServletWebServerFactory() {
@Override
protected void postProcessContext(Context context) {
SecurityConstraint constraint = new SecurityConstraint();
SecurityCollection collection = new SecurityCollection();
//http方法
List<String> forbiddenList = Arrays.asList("PUT|DELETE|HEAD|TRACE".split("\\|"));
for (String method:forbiddenList) {
collection.addMethod(method);
}
//url匹配表达式
collection.addPattern("/*");
constraint.addCollection(collection);
constraint.setAuthConstraint(true);
context.addConstraint(constraint );
//设置使用httpOnly
context.setUseHttpOnly(true);
}
};
tomcatServletContainerFactory.addConnectorCustomizers(connector -> {
connector.setAllowTrace(true);
});
return tomcatServletContainerFactory;
}
}
用户权限
密码加密
针对用户密码需要进行密文存储，保证数据安全，常用MD5算法，因为MD5的加密结果的固定性，我们需要在加密时加入盐来保证每个密码密文的唯一性，我们采用的是MD5（密码+“|”+登录名）的方式，同时针对加密内容存在中文的情况下完善处理，避免前后端MD5加密结果不一致的情况
public class EncryptUtil {
public static String encryptByMD5(String str) throws NoSuchAlgorithmException, UnsupportedEncodingException {
//生成md5加密算法
MessageDigest md5 = MessageDigest.getInstance("MD5");
md5.update(str.getBytes("UTF-8"));
byte b[] = md5.digest();
int i;
StringBuffer buf = new StringBuffer("");
for (int j = 0; j < b.length; j++) {
i = b[j];
if (i < 0)
i += 256;
if (i < 16)
buf.append("0");
buf.append(Integer.toHexString(i));
}
String md5_32 = buf.toString(); //32位加密 与mysql的MD5函数结果一致。
// String md5_16 = buf.toString().substring(8, 24); //16位加密
return md5_32;
}
}
登陆验证码
登陆验证码我们是基于redis来实现的，传统session实现方式会在chrome高版本跨域情况下有所限制
验证码实现方式就是生成随机字符，根据随机字符生成对应Base64图片，将图片返回给前端，字符存储Redis中并设置过期时间
@Component
public class ValidateCodeUtil {
private static Random random = new Random();
private int width = 165; //验证码的宽
private int height = 45; //验证码的高
private int lineSize = 30; //验证码中夹杂的干扰线数量
private int randomStrNum = 4; //验证码字符个数
private String randomString = "0123456789";
private final String sessionKey = "ValidateCode";
private int validDBIndex = 2;
@Autowired
RedisUtil redisUtil;
@Autowired
private FrameConfig frameConfig;
public String getBase64ValidateImage(String key) {
ServletRequestAttributes requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
// BufferedImage类是具有缓冲区的Image类,Image类是用于描述图像信息的类
BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_BGR);
Graphics g = image.getGraphics();
g.fillRect(0, 0, width, height);
g.setColor(getRandomColor(105, 189));
g.setFont(getFont());
//干扰线
for (int i = 0; i < lineSize; i++) {
drawLine(g);
}
//随机字符
String randomStr = "";
for (int i = 0; i < randomStrNum; i++) {
randomStr = drawString(g, randomStr, i);
}
g.dispose();
redisUtil.redisTemplateSetForList(key,sessionKey,randomStr,validDBIndex);
redisUtil.setExpire(key, frameConfig.getValidatecode_expireseconds(),TimeUnit.SECONDS,validDBIndex);
String base64String = "";
try {
// 直接返回图片
// ImageIO.write(image, "PNG", response.getOutputStream());
//返回 base64
ByteArrayOutputStream bos = new ByteArrayOutputStream();
ImageIO.write(image, "PNG", bos);
byte[] bytes = bos.toByteArray();
Base64.Encoder encoder = Base64.getEncoder();
base64String = encoder.encodeToString(bytes);
} catch (Exception e) {
e.printStackTrace();
}
return base64String;
}
public String checkValidate(String key,String code){
String errorMessage = "";
if(redisUtil.isValid(key,validDBIndex)){
String sessionCode = ConvertOp.convert2String(redisUtil.redisTemplateGetForList(key,sessionKey,validDBIndex));
if(!code.toLowerCase().equals(sessionCode)){
errorMessage = "验证码不正确";
}
}else{
errorMessage = "验证码已过期";
}
return errorMessage;
}
//颜色的设置
private Color getRandomColor(int fc, int bc) {
fc = Math.min(fc, 255);
bc = Math.min(bc, 255);
int r = fc + random.nextInt(bc - fc - 16);
int g = fc + random.nextInt(bc - fc - 14);
int b = fc + random.nextInt(bc - fc - 12);
return new Color(r, g, b);
}
//字体的设置
private Font getFont() {
return new Font("Times New Roman", Font.ROMAN_BASELINE, 40);
}
//干扰线的绘制
private void drawLine(Graphics g) {
int x = random.nextInt(width);
int y = random.nextInt(height);
int xl = random.nextInt(20);
int yl = random.nextInt(10);
g.drawLine(x, y, x + xl, y + yl);
}
//随机字符的获取
private String getRandomString(int num){
num = num > 0 ? num : randomString.length();
return String.valueOf(randomString.charAt(random.nextInt(num)));
}
//字符串的绘制
private String drawString(Graphics g, String randomStr, int i) {
g.setFont(getFont());
g.setColor(getRandomColor(108, 190));
//System.out.println(random.nextInt(randomString.length()));
String rand = getRandomString(random.nextInt(randomString.length()));
randomStr += rand;
g.translate(random.nextInt(3), random.nextInt(6));
g.drawString(rand, 40 * i + 10, 25);
return randomStr;
}
}
踢人下线
此功能保证一个用户账号只能在同一个相同类型的设备上登陆，不同设备重复登陆，则其他登陆机器自动下,所以我们需要存储用户的登陆情况，表结构设计如下，LoginFrom标识登陆来源，比如电脑，移动端，大屏机等等，自动下线操作可以采用websoket监听通知
CREATE TABLE `f_online` (
`UnitGuid` varchar(50) NOT NULL,
`UserGuid` varchar(50) DEFAULT NULL,
`UserName` varchar(100) DEFAULT NULL,
`LoginFrom` varchar(50) DEFAULT NULL,
`LoginDate` datetime DEFAULT NULL,
`LoginToken` varchar(100) DEFAULT NULL,
`ReserveA` varchar(100) DEFAULT NULL,
`ReserveB` varchar(100) DEFAULT NULL,
`ReserveC` varchar(100) DEFAULT NULL,
`ReserveD` varchar(100) DEFAULT NULL,
`SpareX` varchar(100) DEFAULT NULL,
`SpareY` varchar(100) DEFAULT NULL,
`SpareZ` varchar(100) DEFAULT NULL,
PRIMARY KEY (`UnitGuid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
登陆错误锁定
为了避免恶意尝试密码登陆，我们需要对在一定时间内登陆错误的用户进行临时的锁定，我们结合登陆日志，例如如果在1分钟内登陆失败超过5此，则进行账户锁定1分钟，将锁定的key根据用户名生成存入redis中，设置锁定时间，在下次登陆时首先检查是否有对应的锁即可
Druid设置
系统在集成Druid线程池时，会默认有监控页面暴露，我们要做好登陆权限设置，避免数据库信息泄露
@Bean
public ServletRegistrationBean druidServlet() {
ServletRegistrationBean reg = new ServletRegistrationBean();
reg.setServlet(new StatViewServlet());
reg.addUrlMappings("/druid/*");
reg.addInitParameter("allow", ""); //白名单
reg.addInitParameter("loginUsername", "admin");
reg.addInitParameter("loginPassword", "11111");
return reg;
}
