解决扫描漏洞的拦截器

清疚 2024-04-20 08:37 66阅读 0赞

import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.ApplicationContext;
    import org.springframework.web.method.HandlerMethod;
    import org.springframework.web.servlet.ModelAndView;
    import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
    import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
    import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.util.ArrayList;
    import java.util.List;
    import java.util.Map;
    import java.util.Set;
    import java.util.regex.Matcher;
    import java.util.regex.Pattern;
    
    /** * 类名称:ScanInteceptor * 类描述: 解决扫描漏洞的拦截器 * @author: */
    public class ScanInteceptor extends HandlerInterceptorAdapter { 
    
    
        @Override
        public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object object) throws Exception { 
            String requestPath = request.getRequestURI();
            System.out.println("拦截器 ========requestPath========"+requestPath);
    
            if (isSpecialChar(requestPath.toLowerCase())) { 
                response.setContentType("text/html;charset=utf-8");
                response.getWriter().println("参数含有非法字符, 已禁止继续访问!");
                return false;
            }
    
            if (ToolUtil.isNotEmpty(request.getQueryString())) { 
                if (judgeSQLInjectUrl(request.getQueryString().toLowerCase())) { 
                    response.setContentType("text/html;charset=utf-8");
                    response.getWriter().println("参数含有非法字符, 已禁止继续访问!");
                    return false;
                }
            }
    
            return true;
        }
    
        /** * 方法名: judgeSQLInjectUrl * 方法描述: 判断参数是否含有攻击字符串 * 修改日期: 2019/9/18 15:57 * @param toLowerCase * @return boolean * @author * @throws */
        private boolean judgeSQLInjectUrl(String value) { 
            if (value == null || "".equals(value)) { 
                return false;
            }
    
            String xssStr ="and |or |select |insert |update |delete |drop |truncate |alert|eval";
            String[] xssArr = xssStr.split("\\|");
    
            //遍历是否有攻击字符串
            for (int i = 0; i < xssArr.length; i++) { 
    
                if (value.indexOf(xssArr[i]) > -1) { 
                    return true;
                }
            }
            return false;
        }
    
        @Override
        public void postHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, ModelAndView modelAndView) throws Exception { 
    
        }
    
        @Override
        public void afterCompletion(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o, Exception e) throws Exception { 
    
        }
    
        /** * 方法名: isSpecialChar * 方法描述: 判断是否有特殊字符 * 修改日期: 2019/9/18 9:25 * @param str * @return boolean * @author * @throws */
        private  boolean isSpecialChar(String str) { 
            String regEx = "[`()|{}''\\[\\]<>（）]";
            Pattern p = Pattern.compile(regEx);
            Matcher m = p.matcher(str);
            return m.find();
        }
    
    
    }

注册拦截器

import org.springframework.context.annotation.Configuration;
    import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
    import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
    
    /** * 类名称:InterceptorConfig * 类描述:TODO * * @author: * 创建时间:2019/9/18 16:19 * Version 1.0 */
    @Configuration
    public class InterceptorConfig implements WebMvcConfigurer { 
    
        /** * 注册自定义拦截器 */
        @Override
        public void addInterceptors(InterceptorRegistry registry) { 
    
            registry.addInterceptor(new ScanInteceptor()).addPathPatterns("/**");
    
        }
    }