Jeesite安全問題檢查及解決方案

一、檢測到目標URL存在跨站漏洞，檢測到目標URL存在框架注入漏洞。

解決方案：

第一步：web.xml註冊監聽

<filter>
   <filter-name>XssFilter</filter-name>
   <filter-class>com.weichai.common.filter.XssFilter</filter-class>
</filter>
<filter-mapping>
   <filter-name>XssFilter</filter-name>
   <url-pattern>/*</url-pattern>
   <dispatcher>REQUEST</dispatcher>
</filter-mapping>

 

第二步：建立監聽實現類

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

public class XssFilter implements Filter {

    FilterConfig filterConfig = null;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        this.filterConfig = filterConfig;
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        chain.doFilter(new XssHttpServletRequestWrapperNew(
                (HttpServletRequest) request), response);

    }

    @Override
    public void destroy() {
        this.filterConfig = null;
    }
}

 

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
import java.text.CharacterIterator;
import java.text.StringCharacterIterator;
import java.util.regex.Pattern;

public class XssHttpServletRequestWrapperNew extends HttpServletRequestWrapper{
    HttpServletRequest orgRequest = null;

    public XssHttpServletRequestWrapperNew(HttpServletRequest request) {
        super(request);
        orgRequest = request;
    }

    /**
     * 覆蓋getParameter方法，將參數名和參數值都作xss過濾。
     * 若是須要得到原始的值，則經過super.getParameterValues(name)來獲取
     * getParameterNames,getParameterValues和getParameterMap也可能須要覆蓋
     */
    @Override
    public String getParameter(String name) {
        String value = super.getParameter(xssEncode(name));
        if (value != null) {
            value = xssEncode(value);
            value = HTMLEncode(value);
        }
        return value;
    }

    /**
     * 對一些特殊字符進行轉義
     */
    public static String HTMLEncode(String aText){
        final StringBuilder result = new StringBuilder();
        final StringCharacterIterator iterator = new StringCharacterIterator(aText);
        char character =  iterator.current();
        while (character != CharacterIterator.DONE ){
            if (character == '<') {
                result.append("&lt;");
            } else if (character == '>') {
                result.append("&gt;");
            } else if (character == '&') {
                result.append("&amp;");
            } else if (character == '\"') {
                result.append("&quot;");
            } else {
                result.append(character);
            }
            character = iterator.next();
        }
        return result.toString();
    }


    /**
     * 覆蓋getHeader方法，將參數名和參數值都作xss過濾。 若是須要得到原始的值，則經過super.getHeaders(name)來獲取
     * getHeaderNames 也可能須要覆蓋
     */
    @Override
    public String getHeader(String name) {
        String value = super.getHeader(xssEncode(name));
        if (value != null) {
            value = xssEncode(value);
        }
        return value;
    }

    /**
     * 將容易引發xss漏洞的半角字符直接替換成全角字符
     * 目前xssProject對注入代碼要求是必須開始標籤和結束標籤(如<script></script>)正確匹配才能解析，不然報錯；所以只能替換調xssProject換爲自定義實現
     * @param s
     * @return
     */
    private static String xssEncode(String s) {
        if (s == null || s.isEmpty()) {
            return s;
        }

        String result = stripXSS(s);
        if (null != result) {
            result = escape(result);
        }

        return result;

    }

    public static String escape(String s) {
        StringBuilder sb = new StringBuilder(s.length() + 16);
        for (int i = 0; i < s.length(); i++) {
            char c = s.charAt(i);
            switch (c) {
                case '>':
                    sb.append('＞');// 全角大於號
                    break;
                case '<':
                    sb.append('＜');// 全角小於號
                    break;
                case '\'':
                    sb.append('‘');// 全角單引號
                    break;
                case '\"':
                    sb.append('「');// 全角雙引號
                    break;
                case '\\':
                    sb.append('＼');// 全角斜線
                    break;
                case '%':
                    sb.append('％'); // 全角冒號
                    break;
                default:
                    sb.append(c);
                    break;
            }

        }
        return sb.toString();
    }

    private static String stripXSS(String value) {
        if (value != null) {

            // Avoid null characters
            value = value.replaceAll("", "");
            // Avoid anything between script tags
            Pattern scriptPattern = Pattern.compile("<script>(.*?)</script>",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
            // Avoid anything in a src='...' type of expression
            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
            scriptPattern = Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
            // Remove any lonesome </script> tag
            scriptPattern = Pattern.compile("</script>",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
            // Remove any lonesome <script ...> tag
            scriptPattern = Pattern.compile("<script(.*?)>",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
            // Avoid eval(...) expressions
            scriptPattern = Pattern.compile("eval\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
            // Avoid expression(...) expressions
            scriptPattern = Pattern.compile("expression\\((.*?)\\)",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
            // Avoid javascript:... expressions
            scriptPattern = Pattern.compile("javascript:",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
            // Avoid vbscript:... expressions
            scriptPattern = Pattern.compile("vbscript:",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
            // Avoid onload= expressions
            scriptPattern = Pattern.compile("onload(.*?)=",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("<iframe>(.*?)</iframe>",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");

            scriptPattern = Pattern.compile("</iframe>",
                    Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
            // Remove any lonesome <script ...> tag
            scriptPattern = Pattern.compile("<iframe(.*?)>",
                    Pattern.CASE_INSENSITIVE | Pattern.MULTILINE
                            | Pattern.DOTALL);
            value = scriptPattern.matcher(value).replaceAll("");
        }
        return value;
    }

    /**
     * 獲取最原始的request
     *
     * @return
     */
    public HttpServletRequest getOrgRequest() {
        return orgRequest;
    }

    /**
     * 獲取最原始的request的靜態方法
     *
     * @return
     */
    public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
        if (req instanceof XssHttpServletRequestWrapperNew) {
            return ((XssHttpServletRequestWrapperNew) req).getOrgRequest();
        }

        return req;
    }

}

二、Apache Geronimo應用服務器多個輸入驗證漏洞

解決方案：

出現這個問題時，應用Tomcat的版本爲7.0.551。解決的方案是將tomcat的版本升到7.0.79版本，這是7系列中最新的版本。具體軟件請到Apache官網下載。