diff --git a/backend/pom.xml b/backend/pom.xml index 7539ed412b..9f0f5c4b44 100644 --- a/backend/pom.xml +++ b/backend/pom.xml @@ -384,7 +384,7 @@ **/* - true + false @@ -414,11 +414,11 @@ true - + maven-clean-plugin diff --git a/backend/src/main/java/io/dataease/commons/filter/SqlFilter.java b/backend/src/main/java/io/dataease/commons/filter/SqlFilter.java new file mode 100644 index 0000000000..3a913cb270 --- /dev/null +++ b/backend/src/main/java/io/dataease/commons/filter/SqlFilter.java @@ -0,0 +1,78 @@ +package io.dataease.commons.filter; + +import io.dataease.commons.holder.ThreadLocalContextHolder; +import io.dataease.commons.wrapper.XssAndSqlHttpServletRequestWrapper; +import org.apache.commons.lang3.StringUtils; +import javax.servlet.*; +import javax.servlet.http.HttpServletRequest; +import java.io.*; + + +public class SqlFilter implements Filter { + + + + + @Override + public void destroy() { + // TODO Auto-generated method stub + + } + + @Override + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { + + String method = "GET"; + String param = ""; + XssAndSqlHttpServletRequestWrapper xssRequest = null; + if (request instanceof HttpServletRequest) { + method = ((HttpServletRequest) request).getMethod(); + xssRequest = new XssAndSqlHttpServletRequestWrapper((HttpServletRequest) request); + } + if ("POST".equalsIgnoreCase(method)) { + param = this.getBodyString(xssRequest.getReader()); + if(StringUtils.isNotBlank(param)){ + if(xssRequest.checkXSSAndSql(param)){ + response.setCharacterEncoding("UTF-8"); + response.setContentType("application/json;charset=UTF-8"); + PrintWriter out = response.getWriter(); + String msg = ThreadLocalContextHolder.getData().toString(); + out.write(msg); + return; + } + } + } + if (xssRequest.checkParameter()) { + response.setCharacterEncoding("UTF-8"); + response.setContentType("application/json;charset=UTF-8"); + PrintWriter out = response.getWriter(); + String msg = ThreadLocalContextHolder.getData().toString(); + out.write(msg); + return; + } + chain.doFilter(xssRequest, response); + } + + @Override + public void init(FilterConfig filterConfig) throws ServletException { + + } + + // 获取request请求body中参数 + public static String getBodyString(BufferedReader br) { + String inputLine; + String str = ""; + try { + while ((inputLine = br.readLine()) != null) { + str += inputLine; + } + br.close(); + } catch (IOException e) { + System.out.println("IOException: " + e); + } + return str; + + } + + +} diff --git a/backend/src/main/java/io/dataease/commons/holder/ThreadLocalContextHolder.java b/backend/src/main/java/io/dataease/commons/holder/ThreadLocalContextHolder.java new file mode 100644 index 0000000000..6aad695532 --- /dev/null +++ b/backend/src/main/java/io/dataease/commons/holder/ThreadLocalContextHolder.java @@ -0,0 +1,24 @@ +package io.dataease.commons.holder; + +public class ThreadLocalContextHolder { + + + private static ThreadLocal sceneThreadLocal = new ThreadLocal<>(); + + + public static Object getData() { + return sceneThreadLocal.get(); + } + + public static void setData(Object data) { + if (ThreadLocalContextHolder.sceneThreadLocal == null) { + ThreadLocalContextHolder.sceneThreadLocal = new ThreadLocal<>(); + } + ThreadLocalContextHolder.sceneThreadLocal.set(data); + } + + public static void clearScene() { + setData(null); + } + +} diff --git a/backend/src/main/java/io/dataease/commons/wrapper/XssAndSqlHttpServletRequestWrapper.java b/backend/src/main/java/io/dataease/commons/wrapper/XssAndSqlHttpServletRequestWrapper.java new file mode 100644 index 0000000000..34fff33383 --- /dev/null +++ b/backend/src/main/java/io/dataease/commons/wrapper/XssAndSqlHttpServletRequestWrapper.java @@ -0,0 +1,370 @@ +package io.dataease.commons.wrapper; + + +import java.io.BufferedReader; +import java.io.ByteArrayInputStream; +import java.io.IOException; +import java.io.InputStreamReader; +import java.util.Enumeration; +import java.util.HashMap; +import java.util.Map; +import java.util.Set; +import java.util.Vector; +import java.util.regex.Matcher; +import java.util.regex.Pattern; +import javax.servlet.ReadListener; +import javax.servlet.ServletInputStream; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletRequestWrapper; + +import io.dataease.commons.holder.ThreadLocalContextHolder; +import org.springframework.util.StreamUtils; + + +public class XssAndSqlHttpServletRequestWrapper extends HttpServletRequestWrapper { + + + HttpServletRequest orgRequest = null; + private Map parameterMap; + private final byte[] body; //用于保存读取body中数据 + + public XssAndSqlHttpServletRequestWrapper(HttpServletRequest request) throws IOException{ + super(request); + orgRequest = request; + parameterMap = request.getParameterMap(); + body = StreamUtils.copyToByteArray(request.getInputStream()); + } + + // 重写几个HttpServletRequestWrapper中的方法 + /** + * 获取所有参数名 + * + * @return 返回所有参数名 + */ + @Override + public Enumeration getParameterNames() { + Vector vector = new Vector(parameterMap.keySet()); + return vector.elements(); + } + + /** + * 覆盖getParameter方法,将参数名和参数值都做xss & sql过滤。
+ * 如果需要获得原始的值,则通过super.getParameterValues(name)来获取
+ * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖 + */ + @Override + public String getParameter(String name) { + String[] results = parameterMap.get(name); + if (results == null || results.length <= 0) + return null; + else { + String value = results[0]; + if (value != null) { + value = xssEncode(value); + } + return value; + } + } + + /** + * 获取指定参数名的所有值的数组,如:checkbox的所有数据 接收数组变量 ,如checkobx类型 + */ + @Override + public String[] getParameterValues(String name) { + String[] results = parameterMap.get(name); + if (results == null || results.length <= 0) + return null; + else { + int length = results.length; + for (int i = 0; i < length; i++) { + results[i] = xssEncode(results[i]); + } + return results; + } + } + + /** + * 覆盖getHeader方法,将参数名和参数值都做xss & sql过滤。
+ * 如果需要获得原始的值,则通过super.getHeaders(name)来获取
+ * getHeaderNames 也可能需要覆盖 + */ + @Override + public String getHeader(String name) { + + String value = super.getHeader(xssEncode(name)); + if (value != null) { + value = xssEncode(value); + } + return value; + } + + /** + * 将容易引起xss & sql漏洞的半角字符直接替换成全角字符 + * + * @param s + * @return + */ + private static String xssEncode(String s) { + if (s == null || s.isEmpty()) { + return s; + } else { + s = stripXSSAndSql(s); + } + StringBuilder sb = new StringBuilder(s.length() + 16); + for (int i = 0; i < s.length(); i++) { + char c = s.charAt(i); + switch (c) { + case '>': + sb.append(">");// 转义大于号 + break; + case '<': + sb.append("<");// 转义小于号 + break; + // case '\'': + // sb.append("'");// 转义单引号 + // break; + // case '\"': + // sb.append(""");// 转义双引号 + // break; + case '&': + sb.append("&");// 转义& + break; + case '#': + sb.append("#");// 转义# + break; + default: + sb.append(c); + break; + } + } + return sb.toString(); + } + + /** + * 获取最原始的request + * + * @return + */ + public HttpServletRequest getOrgRequest() { + return orgRequest; + } + + /** + * 获取最原始的request的静态方法 + * + * @return + */ + public static HttpServletRequest getOrgRequest(HttpServletRequest req) { + if (req instanceof XssAndSqlHttpServletRequestWrapper) { + return ((XssAndSqlHttpServletRequestWrapper) req).getOrgRequest(); + } + + return req; + } + + /** + * + * 防止xss跨脚本攻击(替换,根据实际情况调整) + */ + + public static String stripXSSAndSql(String value) { + if (value != null) { + // NOTE: It's highly recommended to use the ESAPI library and + // uncomment the following line to + // avoid encoded attacks. + // value = ESAPI.encoder().canonicalize(value); + // Avoid null characters + /** value = value.replaceAll("", ""); ***/ + // Avoid anything between script tags + Pattern scriptPattern = Pattern.compile( + "<[\r\n| | ]*script[\r\n| | ]*>(.*?)", Pattern.CASE_INSENSITIVE); + value = scriptPattern.matcher(value).replaceAll(""); + // Avoid anything in a + // src="http://www.yihaomen.com/article/java/..." type of + // e-xpression + scriptPattern = Pattern.compile("src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']", + Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL); + value = scriptPattern.matcher(value).replaceAll(""); + // Remove any lonesome tag + scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE); + value = scriptPattern.matcher(value).replaceAll(""); + // Remove any lonesome tag + scriptPattern = Pattern.compile("", Pattern.CASE_INSENSITIVE); + flag = scriptPattern.matcher(value).find(); + if (flag) { + ThreadLocalContextHolder.setData("包含XSS攻击脚本,请检查参数!"); + return flag; + } + // Remove any lonesome