SpringBoot 之SpringMVC 常用配置--SQL注入

左手的ㄟ右手 2024-04-19 15:43 1阅读 0赞

应用场景：SpringMVC 发送get 请求方式，进行参数的sql 注入攻击清理，如果是post 的请求方式，这段代码是无法正常使用。

拦截器作用：  
拦截器Interceptor实现对每一个请求处理前后进行相关的业务处理。类似于Servlet的Filter。  
第一种方式：可以让普通的bean实现HandlerInterceptor接口或者继承HandlerInterceptorAdapter类来实现自定义拦截器。  
①继承HandlerInterceptorAdapter类来实现自定义拦截器  
重写preHandle：在请求发生前执行、postHandle在请求完后执行。

SQL拦截器源码：

package com.digipower.ucas.interceptor;
    
    import org.springframework.web.servlet.HandlerInterceptor;
    import org.springframework.web.servlet.ModelAndView;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.util.Enumeration;
    
    /**
     * 防止SQL注入的拦截器
     *
     * @author tyee.noprom@qq.com
     * @time 2/13/16 8:22 PM.
     */
    public class SqlInjectInterceptor implements HandlerInterceptor {
    
        public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object o) throws Exception {
            Enumeration<String> names = request.getParameterNames();
            while (names.hasMoreElements()) {
                String name = names.nextElement();
                String[] values = request.getParameterValues(name);
                for (String value : values) {
                    value = clearXss(value);
                }
            }
            return true;
        }
    
        public void postHandle(HttpServletRequest request, HttpServletResponse response, Object o, ModelAndView modelAndView) throws Exception {
    
        }
    
        public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object o, Exception e) throws Exception {
    
        }
    
        /**
         * 处理字符转义
         *
         * @param value
         * @return
         */
        private String clearXss(String value) {
            if (value == null || "".equals(value)) {
                return value;
            }
            value = value.replaceAll("<", "<").replaceAll(">", ">");
            value = value.replaceAll("\\(", "(").replace("\\)", ")");
            value = value.replaceAll("'", "'");
            value = value.replaceAll("eval\\((.*)\\)", "");
            value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']",
                    "\"\"");
            value = value.replace("script", "");
            return value;
        }
    }

SpringBoot 配置SpringMVC的拦截器

package com.digipower.ucas.config;
    
    import java.util.ArrayList;
    import java.util.List;
    
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.http.converter.HttpMessageConverter;
    import org.springframework.web.servlet.config.annotation.EnableWebMvc;
    import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
    import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
    import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
    
    import io.swagger.annotations.ApiOperation;
    import springfox.documentation.builders.ApiInfoBuilder;
    import springfox.documentation.builders.ParameterBuilder;
    import springfox.documentation.builders.PathSelectors;
    import springfox.documentation.builders.RequestHandlerSelectors;
    import springfox.documentation.schema.ModelRef;
    import springfox.documentation.service.ApiInfo;
    import springfox.documentation.service.Contact;
    import springfox.documentation.service.Parameter;
    import springfox.documentation.spi.DocumentationType;
    import springfox.documentation.spring.web.plugins.Docket;
    import springfox.documentation.swagger2.annotations.EnableSwagger2;
    
    @Configuration
    @EnableSwagger2
    @EnableWebMvc
    public class SwaggerConfig extends WebMvcConfigurerAdapter {
    
    	@Override
    	public void addResourceHandlers(ResourceHandlerRegistry registry) {
    		registry.addResourceHandler("swagger-ui.html").addResourceLocations("classpath:/META-INF/resources/");
    		registry.addResourceHandler("/webjars/**").addResourceLocations("classpath:/META-INF/resources/webjars/");
    	}
    	
    	// 定义json 转换器
    	@Override
    	public void configureMessageConverters(List<HttpMessageConverter<?>> converters) {
    		// TODO Auto-generated method stub
    		super.configureMessageConverters(converters);
    	}
    
    	@Bean
    	public Docket buildDocket() {
    
    		ParameterBuilder tokenPar = new ParameterBuilder();
    		List<Parameter> pars = new ArrayList<Parameter>();
    		tokenPar.name("X-CSRF-TOKEN").description("令牌").modelRef(new ModelRef("string")).parameterType("header")
    				.required(false).build();
    		pars.add(tokenPar.build());
    
    		return new Docket(DocumentationType.SWAGGER_2).select()
    				.apis(RequestHandlerSelectors.withMethodAnnotation(ApiOperation.class)).paths(PathSelectors.any())
    				.build().globalOperationParameters(pars).apiInfo(buildApiInf());
    	}
    
    	
    
    	private ApiInfo buildApiInf() {
    		return new ApiInfoBuilder().title("深圳市世纪伟图科技开发有限公司 - 城建档案系统").termsOfServiceUrl("http://www.digipower.cn/")
    				.description("API接口")
    				.contact(new Contact("digipower", "http://www.digipower.cn/", "digiservices@digipower.com"))
    				.version("2.0").build();
    
    	}
    	
    	    //拦截器
    		@Bean
    		public SqlInjectInterceptor  sqlInjectInterceptor () {
    			return new SqlInjectInterceptor();
    		}
    	 
    		@Override
    		public void addInterceptors(InterceptorRegistry registry) {// 2
    			registry.addInterceptor(sqlInjectInterceptor());
    		}
    }