URL存在http host头攻击漏洞-修复方案

spring boot使用注解的方式 --

第一步:在自定义filter类上添加如下注释

package com.cmcc.hy.mobile.config;

import java.io.IOException;
import java.util.Arrays;
import java.util.List;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Value; /**
* @author wangzhengrong
* @date 2019/1/22 11:09
*/
@WebFilter(filterName = "otherFilter")
public class HostFilter implements Filter { /**
* 自定义实现host白名单添加
*/
@Value("${ALLOWED_SERVERNAMES}")
private String ALLOWED_SERVERNAMES; @Override
public void init(FilterConfig filterConfig) throws ServletException {
// System.out.println("Filter初始化中");
} /**
* host拦截
*/
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
FilterChain filterChain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) servletRequest;
HttpServletResponse response = (HttpServletResponse) servletResponse;
// String host = request.getHeader("host");
String serverName = request.getServerName();
System.out.println("serverName-debug:" + serverName);
if (!isEmpty(serverName)) {
if (checkBlankList(serverName)) {
filterChain.doFilter(servletRequest, servletResponse);
} else {
System.out.println("[serverName deny access tips]->" + serverName);
// response.getWriter().print("host deny");
response.setStatus(403);
response.flushBuffer();
}
} else {
filterChain.doFilter(servletRequest, servletResponse);
} } @Override
public void destroy() {
// System.out.println("Filter销毁");
} /**
* 校验当前host是否在白名单中
*/
private boolean checkBlankList(String serverName) {
String[] allowdServerName = ALLOWED_SERVERNAMES.split(",");
List<String> serverNameList = Arrays.asList(allowdServerName);
for(String str : serverNameList){
if(!isEmpty(str) && str.equals(serverName)){
return true;
}
}
return false;
} /**
* 判空
*/
public boolean isEmpty(Object str) {
return str == null || "".equals(str);
} }

第二步:还需要在启动类上添加注释 @ServletComponentScan,以确保能扫描的Filter类,当然也可以指定该注解的basePackages属性。这里需要注意的是,使用这种方式时,不能像第一种方式那样指定filter顺序,使用Order注解也无效

05-08 15:46