每个人都该懂点网络安全

风险

防范

示例 

<tr>
    <td><spring:message code="lable.field.user.company" /></td>
    <td>${username}</td>
    <td></td>
</tr>

防范

private static final char[] QUOTE_ENCODE = """.toCharArray();
private static final char[] AMP_ENCODE = "&".toCharArray();
private static final char[] LT_ENCODE = "<".toCharArray();

public static final String escapeForHtml(String string) {
   if (string == null) {
      return null;
   }
   char ch;
   int i = 0;
   int last = 0;
   char[] input = string.toCharArray();
   int len = input.length;
   StringBuffer out = new StringBuffer((int) (len * 1.3));
   for (; i < len; i++) {
      ch = input[i];
      if (ch > '>') {
         continue;
      } else if (ch == '<') {
         if (i > last) {
            out.append(input, last, i - last);
         }
         last = i + 1;
         out.append(LT_ENCODE);
      } else if (ch == '"') {
         if (i > last) {
            out.append(input, last, i - last);
         }
         last = i + 1;
         out.append(QUOTE_ENCODE);
      }
   }
   if (last == 0) {
      return string;
   }
   if (i > last) {
      out.append(input, last, i - last);
   }
   return out.toString();
}

response.sendRedirect(request.getParameter("done"));

public boolean sendRedirect(String url) {
   if (!StringUtil.isEmpty(url)) {
      try {
         url = url.trim();
         if (!WHITE_DOMAIN_PATTERN.matcher(url).matches()) {
            url = "http://www.dxy.cn/redirect?url=" + URLEncoder.encode(url, "UTF-8");
         }
         res.sendRedirect(url);
         return true;
      } catch (Throwable ex) {

      }
   }
   return false;
}

private static Pattern WHITE_DOMAIN_PATTERN = null;
static {
   StringBuilder buff = new StringBuilder();
   for (String domain : new String[] { “abc\\.(cn|com|net)",
         “aaa\\.cn", “bbb\\.(cn|com)", “ccc\\.cn" }) {
      if (buff.length() > 0) {
         buff.append("|");
      }
      buff.append("(^http[s]?://[\\w-]+\\.");
      buff.append(domain);
      buff.append("(\\/.*)?$)");
   }

   buff.append("|(^(?!http).+$)");

   WHITE_DOMAIN_PATTERN = Pattern.compile(buff.toString(),
         Pattern.CASE_INSENSITIVE);
}

风险

服务器被黑客控制

原理

攻击者通过附件上传漏洞，上传可执行脚本，从而控制服务器。 

1. 验证文件扩展名，只允许上传白名单中的文件类型（前后端都加验证）
2. 文件上传和下载使用不同的域名
3. 上传文件路径随机产生，使攻击者不能猜测文件路径
4. 对图片进行压缩，隐藏原图路径