\u626b\u63cf\u6240\u7528\u5de5\u5177
\nAPPSCAN web\u626b\u63cf\u5de5\u5177
\nFortify java\u626b\u63cf\u5de5\u5177<\/p>\n
1\u767b\u5f55\u540e\u8981\u6e05\u6389session\u548ccookie
\n\u5b9e\u73b0
\n\/\/\u6e05\u9664\u6389\u4ee5\u524d\u7684session
\nrequest.getSession(true).invalidate();\/\/\u6e05\u7a7asession
\nCookie cookie = request.getCookies()[0];\/\/\u83b7\u53d6cookie
\ncookie.setMaxAge(0);\/\/\u8ba9cookie\u8fc7\u671f<\/p>\n
2\u767b\u5f55\u4e94\u6b21\u540e\u5982\u679c\u4f9d\u7136\u5931\u8d25\u7b49\u5f85\u51e0\u5206\u949f\u540e\u624d\u80fd \u91cd\u8bd5
\n\u4ee3\u7801\u592a\u591a\uff0c\u660e\u767d\u5565\u610f\u601d\u5c31\u884c\uff0c\u6ca1\u5565\u6280\u672f\u96be\u5ea6
\n3\u767b\u5f55\u7684\u65f6\u4e0d\u80fd\u63d0\u793a\u8d26\u53f7\u9519\u8bef\u8fd8\u662f\u5bc6\u7801\u9519\u8bef
\n\u8d26\u53f7\u5bc6\u7801\u9519\u8bef\u7684\u8fd4\u56de\u65f6\u5e94\u8be5\u662f\u4e00\u6837\u7684\u8fd4\u56de\u53c2\u6570\u548c\u8868\u73b0\u5f62\u5f0f
\n4\u767b\u5f55\u8981\u6709\u8fc7\u671f\u65f6\u95f4
\nSession\u8bbe\u7f6e\u8fc7\u671f\u65f6\u95f4
\n5 mybatis \u5c3d\u91cf\u7528#{}\u4e0d\u8981\u7528&{}\u51cf\u5c11sql\u8bed\u53e5\u6ce8\u5165
\n6 mybatis \u5bf9\u4e8esql\u8bed\u53e5\u4e2d\u7c7b\u578b\u6709\u8981\u6c42\u7684\u4e00\u5b9a\u8981\u5728\u5e94\u7528\u5c42\u505a\u597d\u9632\u62a4\uff0c\u6bd4\u5982\u5206\u9875limit\u4e00\u5b9a\u8981\u662f\u6570\u5b57\u7b49
\n7\u5bf9\u4e8e\u524d\u53f0\u53c2\u6570\u662f\u5b57\u7b26\u4e32\u7684\u53c2\u6570\u5728\u5e94\u7528\u5c42\u8981\u505a\u597d\u53c2\u6570\u8fc7\u6ee4\u3002\u6bd4\u5982\u5bf9\u4e8e\u4e00\u4e9b\u6570\u636e\u5e93\u654f\u611f\u5b57\u7b26\u505a\u51fa\u5904\u7406
\n\u5b9e\u73b0,\u6216\u8005\u6570\u5b57\u6ea2\u51fa\u7b49
\n\/\/\u6bd4\u8f83\u7b28\u7684\u8fc7\u6ee4sql\u5b57\u7b26\u4e32
\npublic static String doFilter(String str){
\nstr=str.replaceAll(“\\.”,”\u3002”);
\nstr=str.replaceAll(“:”,”\uff1a”);
\nstr=str.replaceAll(“;”,”\uff1b”);
\nstr=str.replaceAll(“&”,”\uff06”);
\nstr=str.replaceAll(“<“,\u201c\uff1c\u201d);
\nstr=str.replaceAll(“>”,\u201c\uff1e\u201d);
\nstr=str.replaceAll(“\u2019”,”\uff07”);
\nstr=str.replaceAll(“””,”\u201c”);
\nstr=str.replaceAll(“\u2013”,”\uff0d\uff0d”);
\nstr=str.replaceAll(“\/”,”\uff0f”);
\nstr=str.replaceAll(“%”,”\uff05”);
\nstr=str.replaceAll(“\\+”, \u201c\uff0b\u201d);
\nstr=str.replaceAll(“”,\u201c\uff08\u201d);str=str.replaceAll(“”, \u201c\uff09\u201d)
\nreturn str;
\n}
\n\u5176\u5b9e\u4e0d\u5149\u8fd9\u4e9b\u8fd8\u6709\u53c2\u6570\u662f\u5426\u4e3a\u7a7a\uff0c\u6574\u6570\u662f\u4e0d\u662f\u6ea2\u51fa\u7b49\u7b49\u8981\u505a\u5168\u9762\u7684\u9a8c\u8bc1
\n8\u6240\u6709\u7684\u9a8c\u8bc1\u90fd\u5e94\u8be5\u7531\u670d\u52a1\u5668\u7aef\u8fdb\u884c\u9a8c\u8bc1
\n9\u8bf7\u6c42\u4e2d\u4e0d\u53ef\u4ee5\u5e26\u7740\u7528\u6237\u4fe1\u606f\u548c\u6807\u8bc6\uff08\u4ece\u540e\u53f0\u83b7\u53d6\uff09
\n\u653esession\u91cc\u4ece\u540e\u53f0\u53d6
\n10\u670d\u52a1\u5668\u7aef\u8bbe\u7f6e\u4e2a\u8fc7\u6ee4\u5668\u6dfb\u52a0\u51e0\u4e2a\u5934\u8bbe\u7f6e\u4e3a\u4e86\u5b89\u5168
\n\u5b9e\u73b0
\n\/\/1\u8bbe\u7f6e\u5b89\u5168\u5934
\nresponse.setHeader(\u201cAccess-Control-Allow-Origin\u201d, request.getHeader(\u201cOrigin\u201d));
\nresponse.setHeader(\u201cAccess-Control-Allow-Methods\u201d, \u201cPOST, GET\u201d);\/\/\u5141\u8bb8\u8de8\u57df\u7684\u8bf7\u6c42\u65b9\u5f0f
\nresponse.setHeader(\u201cAccess-Control-Max-Age\u201d, \u201c3600\u201d);\/\/\u9884\u68c0\u8bf7\u6c42\u7684\u95f4\u9694\u65f6\u95f4
\nresponse.setHeader(\u201cAccess-Control-Allow-Headers\u201d, \u201cOrigin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With,userId,token,Access-Control-Allow-Headers\u201d);\/\/\u5141\u8bb8\u8de8\u57df\u8bf7\u6c42\u643a\u5e26\u7684\u8bf7\u6c42\u5934
\nresponse.setHeader(\u201cAccess-Control-Allow-Credentials\u201d,\u201ctrue\u201d);\/\/\u82e5\u8981\u8fd4\u56decookie\u3001\u643a\u5e26seesion\u7b49\u4fe1\u606f\u5219\u5c06\u6b64\u9879\u8bbe\u7f6e\u6211true
\nresponse.setHeader(\u201cstrict-transport-security\u201d,\u201cmax-age=16070400; includeSubDomains\u201d);\/\/\u7b80\u79f0\u4e3aHSTS\u3002\u5b83\u5141\u8bb8\u4e00\u4e2aHTTPS\u7f51\u7ad9\uff0c\u8981\u6c42\u6d4f\u89c8\u5668\u603b\u662f\u901a\u8fc7HTTPS\u6765\u8bbf\u95ee\u5b83
\n\/\/\u4e3a\u4e86\u5b89\u5168\u505a\u7684\u5934\u5904\u7406 \u6682\u65f6\u7528\u4e0d\u4e86 \u524d\u6bb5\u592a\u591a\u4e1c\u897f\u8ddf\u5b83\u51b2\u7a81
\nresponse.setHeader(\u201cContent-Security-Policy\u201d,\u201cupgrade-insecure-requests\u201d);
\n\/\/response.setHeader(\u201cContent-Security-Policy\u201d,\u201cdefault-src \u2018self\u2019\u201d);\/\/\u8fd9\u4e2a\u54cd\u5e94\u5934\u4e3b\u8981\u662f\u7528\u6765\u5b9a\u4e49\u9875\u9762\u53ef\u4ee5\u52a0\u8f7d\u54ea\u4e9b\u8d44\u6e90\uff0c\u51cf\u5c11XSS\u7684\u53d1\u751f
\nresponse.setHeader(\u201cX-Content-Type-Options\u201d,\u201cnosniff\u201d);\/\/\u4e92\u8054\u7f51\u4e0a\u7684\u8d44\u6e90\u6709\u5404\u79cd\u7c7b\u578b\uff0c\u901a\u5e38\u6d4f\u89c8\u5668\u4f1a\u6839\u636e\u54cd\u5e94\u5934\u7684Content-Type\u5b57\u6bb5\u6765\u5206\u8fa8\u5b83\u4eec\u7684\u7c7b\u578b\u3002\u901a\u8fc7\u8fd9\u4e2a\u54cd\u5e94\u5934\u53ef\u4ee5\u7981\u7528\u6d4f\u89c8\u5668\u7684\u7c7b\u578b\u731c\u6d4b\u884c\u4e3a
\nresponse.setHeader(\u201cX-XSS-Protection\u201d,\u201c1; mode=block\u201d);\/\/1; mode=block\uff1a\u542f\u7528XSS\u4fdd\u62a4\uff0c\u5e76\u5728\u68c0\u67e5\u5230XSS\u653b\u51fb\u65f6\uff0c\u505c\u6b62\u6e32\u67d3\u9875\u9762
\nresponse.setHeader(\u201cX-Frame-Options\u201d,\u201cSAMEORIGIN\u201d);\/\/SAMEORIGIN\uff1a\u4e0d\u5141\u8bb8\u88ab\u672c\u57df\u4ee5\u5916\u7684\u9875\u9762\u5d4c\u5165\uff1b
\n11\u8de8\u7ad9\u70b9\u8bf7\u6c42\u4f2a\u9020 \u4f7f\u7528token\u9a8c\u8bc1 \u8bf7\u6c42\u662f\u4e0d\u662f\u81ea\u5df1\u7f51\u9875\u53d1\u51fa\u7684
\n\u8bf4\u4e0b\u5b9e\u73b0\u6d41\u7a0b\u767b\u5f55\u6210\u529f\u540e\u751f\u6210\u4e00\u4e2atoken\u968f\u673a\u6570\u7136\u540e\u8fd4\u56de\u7ed9\u524d\u53f0\uff0c\u524d\u53f0\u7559\u4e0b\u5b83\uff0c\u524d\u53f0\u62e6\u622a\u6bcf\u6b21\u8bf7\u6c42\u7528head\u5e26\u4e0a\u8fd9\u4e2atoken\uff0c\u901a\u8fc7\u540e\u53f0\u8fc7\u6ee4\u5668\u6bcf\u6b21\u9a8c\u8bc1\u524d\u540e\u53f0token\u662f\u5426\u76f8\u540c\u6765\u5b9e\u73b0\u76ee\u7684
\n12\u5bf9\u4e8e\u9700\u8981\u91ca\u653e\u7684\u8d44\u6e90\u4e00\u5b9a\u8981\u5173\u95ed\u6216\u8005\u91ca\u653e \u6bd4\u5982\u8f93\u5165\u8f93\u51fa\u6d41\u7b49
\n13catch\u4e2d\u8981\u6253\u65e5\u5fd7\u4e0d\u8981\u53ea\u662f\u8f93\u51fa\u5230\u63a7\u5236\u53f0
\n14\u4f7f\u7528 HTTP \u52a8\u8bcd\u7be1\u6539\u7684\u8ba4\u8bc1\u65c1\u8def \u5228\u9664\u6240\u6709\u9664\u4e86getpost\u4ee5\u5916\u8bf7\u6c42
\n\u8fc7\u6ee4\u5668\u91cc
\nif(!\u201cGET\u201d.equals(method)&&!\u201cPOST\u201d.equals(method)&&!\u201cHEAD\u201d.equals(method))
\n{
\nSessionoutre.refeifa(response);
\nreturn;
\n}
\n\u6211\u731c\u6d4b\u8fd8\u6709\u5176\u4ed6\u65b9\u6cd5\u6bd4\u5982\u8fd9\u4e2ahttps:\/\/blog.csdn.net\/liutinghui989\/article\/details\/88845707
\n\u611f\u89c9\u6b63\u89c4\u4e9b\u800c\u4e14\u8fd8\u89e3\u51b3\u4e86TRAC \u9700\u8981\u5173\u95ed\u7684\u95ee\u9898\uff0c\u4f46\u6211\u6ca1\u6709\u8bd5\u8fc7\u3002
\n15\u5173\u4e8e\u6743\u9650\u4e0d\u53ea\u662f\u5bf9\u4e8e\u663e\u793a\u7684\u9a8c\u8bc1\u3002\u5bf9\u4e8e\u6743\u9650\u4e0b\u7684\u6bcf\u4e00\u4e2a\u63a5\u53e3\u90fd\u5e94\u8be5\u505a\u6743\u9650\u6821\u9a8c
\n16\u5f53\u9519\u8bef\u8bbf\u95ee\u8fbe\u5230\u4e00\u5b9a\u6b21\u6570\u9700\u8981\u8fdb\u884cip\u5c01\u6389\u7684\u64cd\u4f5c\u6765\u7981\u6389\u653b\u51fb\u64cd\u4f5c
\n17\u4e0d\u8981\u628a\u4efb\u4f55\u7a0b\u5e8f\u62a5\u7684\u9519\u8bef\u8fd4\u56de\u7ed9\u524d\u53f0\u3002
\n\u89e3\u51b3\u529e\u6cd5\uff1a\u5728action\u91cccatch\u6240\u6709\u9519\u8bef\u7136\u540e\u8fd4\u56de\u4e00\u4e2a\u81ea\u5b9a\u4e49\u7684\u9519\u8bef\u9875\u9762
\n18 \u4f7f\u7528https\u4e0d\u8981\u4f7f\u7528http\u4e86
\n\u5fc3\u5f97\uff1a\u6000\u7591\u4e00\u5207\u4ece\u524d\u53f0\u4f20\u6765\u7684\u8bf7\u6c42\u548c\u53c2\u6570\u3002<\/p>\n
\u6211\u4e5f\u662f\u5b89\u5168\u65b9\u9762\u7684\u521d\u5b66\u8005\u4f1a\u7684\u5c31\u662f\u7528\u4e9b\u626b\u63cf\u5de5\u5177\u626b\u4e00\u626b\u7a0b\u5e8f\u3002\u8fd9\u4e9b\u662f\u6211\u9047\u5230\u7684\u4e00\u4e9b\u548c\u89e3\u51b3\u529e\u6cd5\u3002
\n\u4ee3\u7801\u6280\u672f\u662fvue\u548cspringboot\uff0c\u8ddf\u5927\u5bb6\u5206\u4eab\uff0c\u5e0c\u671b\u5927\u5bb6\u4e5f\u53ef\u4ee5\u8ba8\u8bba\u5171\u540c\u5b66\u4e60\u5171\u540c\u8fdb\u6b65
\n\u8bf4\u660e\uff1a
\n\u8fd9\u4e9b\u89e3\u51b3\u529e\u6cd5\u90fd\u662f\u7f51\u4e0a\u627e\u7684
\n\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014<\/p>\n
\u7248\u6743\u58f0\u660e\uff1a\u672c\u6587\u4e3a\u535a\u4e3b\u539f\u521b\u6587\u7ae0\uff0c\u9075\u5faa CC 4.0 BY-SA \u7248\u6743\u534f\u8bae\uff0c\u8f6c\u8f7d\u8bf7\u9644\u4e0a\u539f\u6587\u51fa\u5904\u94fe\u63a5\u548c\u672c\u58f0\u660e\u3002<\/p>\n
\u539f\u6587\u94fe\u63a5\uff1ahttps:\/\/blog.csdn.net\/baby_you_Know\/article\/details\/103274347<\/p>\n","protected":false},"excerpt":{"rendered":"
\u626b\u63cf\u6240\u7528\u5de5\u5177 APPSCAN web\u626b\u63cf\u5de5\u5177 Fortify…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-1061","post","type-post","status-publish","format-standard","hentry","category-java"],"_links":{"self":[{"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/posts\/1061","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/comments?post=1061"}],"version-history":[{"count":1,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/posts\/1061\/revisions"}],"predecessor-version":[{"id":1062,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/posts\/1061\/revisions\/1062"}],"wp:attachment":[{"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/media?parent=1061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/categories?post=1061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/tags?post=1061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}