漏洞修复
This commit is contained in:
itcast
parent
341990088e
commit
bb962793fd
|
|
@ -0,0 +1,64 @@
|
|||
{
|
||||
"_from": "lodash@latest",
|
||||
"_id": "lodash@4.17.21",
|
||||
"_inBundle": false,
|
||||
"_integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
|
||||
"_location": "/lodash",
|
||||
"_phantomChildren": {},
|
||||
"_requested": {
|
||||
"type": "tag",
|
||||
"registry": true,
|
||||
"raw": "lodash@latest",
|
||||
"name": "lodash",
|
||||
"escapedName": "lodash",
|
||||
"rawSpec": "latest",
|
||||
"saveSpec": null,
|
||||
"fetchSpec": "latest"
|
||||
},
|
||||
"_requiredBy": [
|
||||
"#USER",
|
||||
"/"
|
||||
],
|
||||
"_resolved": "https://registry.npmmirror.com/lodash/-/lodash-4.17.21.tgz",
|
||||
"_shasum": "679591c564c3bffaae8454cf0b3df370c3d6911c",
|
||||
"_spec": "lodash@latest",
|
||||
"_where": "D:\\all\\JavaWeb\\devicesmgt",
|
||||
"author": {
|
||||
"name": "John-David Dalton",
|
||||
"email": "john.david.dalton@gmail.com"
|
||||
},
|
||||
"bugs": {
|
||||
"url": "https://github.com/lodash/lodash/issues"
|
||||
},
|
||||
"bundleDependencies": false,
|
||||
"contributors": [
|
||||
{
|
||||
"name": "John-David Dalton",
|
||||
"email": "john.david.dalton@gmail.com"
|
||||
},
|
||||
{
|
||||
"name": "Mathias Bynens",
|
||||
"email": "mathias@qiwi.be"
|
||||
}
|
||||
],
|
||||
"deprecated": false,
|
||||
"description": "Lodash modular utilities.",
|
||||
"homepage": "https://lodash.com/",
|
||||
"icon": "https://lodash.com/icon.svg",
|
||||
"keywords": [
|
||||
"modules",
|
||||
"stdlib",
|
||||
"util"
|
||||
],
|
||||
"license": "MIT",
|
||||
"main": "lodash.js",
|
||||
"name": "lodash",
|
||||
"repository": {
|
||||
"type": "git",
|
||||
"url": "git+https://github.com/lodash/lodash.git"
|
||||
},
|
||||
"scripts": {
|
||||
"test": "echo \"See https://travis-ci.org/lodash-archive/lodash-cli for testing details.\""
|
||||
},
|
||||
"version": "4.17.21"
|
||||
}
|
||||
|
|
@ -0,0 +1,111 @@
|
|||
package com.bonus.sgzb.gateway.filter;
|
||||
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import org.springframework.cloud.gateway.filter.GlobalFilter;
|
||||
import org.springframework.cloud.gateway.filter.GatewayFilterChain;
|
||||
import org.springframework.core.Ordered;
|
||||
import org.springframework.http.HttpStatus;
|
||||
import org.springframework.http.MediaType;
|
||||
import org.springframework.stereotype.Component;
|
||||
import org.springframework.web.server.ServerWebExchange;
|
||||
import reactor.core.publisher.Mono;
|
||||
import reactor.core.publisher.Flux;
|
||||
import org.springframework.core.io.buffer.DataBuffer;
|
||||
import org.springframework.http.server.reactive.ServerHttpRequest;
|
||||
import org.springframework.http.server.reactive.ServerHttpResponse;
|
||||
import org.springframework.util.MultiValueMap;
|
||||
|
||||
import java.nio.charset.StandardCharsets;
|
||||
import java.util.*;
|
||||
import java.util.regex.Pattern;
|
||||
|
||||
/**
|
||||
* 防御 XSLT 注入 Gateway 过滤器
|
||||
* 校验 Query / Form / JSON 中指定参数，白名单 + 关键字双重过滤
|
||||
*/
|
||||
@Slf4j
|
||||
@Component
|
||||
public class XsltInjectionGatewayFilter implements GlobalFilter, Ordered {
|
||||
|
||||
/* 仅允许字母、数字、_- */
|
||||
private static final Pattern WHITE = Pattern.compile("^[A-Za-z0-9_-]+$");
|
||||
|
||||
/* XSLT 危险关键字（大小写不敏感） */
|
||||
private static final Set<String> BLACK_KEYS = Collections.unmodifiableSet(
|
||||
new HashSet<>(Arrays.asList(
|
||||
"xsl:", "<?xml", "system-property", "document(", "unparsed-text",
|
||||
"<![cdata[", "xsl:script", "xsl:eval", "xmlns:xsl=","xsl:include", "xsl:import", "exslt:"
|
||||
))
|
||||
);
|
||||
|
||||
/* 需要校验的参数名 */
|
||||
private static final Set<String> CHECK_PARAMS = Collections.unmodifiableSet(
|
||||
new HashSet<>(Arrays.asList("type", "xsl", "xml", "stylesheet", "transform"))
|
||||
);
|
||||
|
||||
@Override
|
||||
public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
|
||||
ServerHttpRequest request = exchange.getRequest();
|
||||
String path = request.getPath().value();
|
||||
|
||||
/* 1. 校验 Query 参数 */
|
||||
MultiValueMap<String, String> queryParams = request.getQueryParams();
|
||||
for (String key : CHECK_PARAMS) {
|
||||
List<String> values = queryParams.get(key);
|
||||
if (values != null) {
|
||||
for (String v : values) {
|
||||
if (!isValid(v)) {
|
||||
log.warn("XSLT_INJECTION_QUERY ip={} uri={} param={} value={}",
|
||||
request.getRemoteAddress(), path, key, v);
|
||||
return reject(exchange);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* 2. 校验 Form 参数（application/x-www-form-urlencoded） */
|
||||
MediaType contentType = request.getHeaders().getContentType();
|
||||
if (MediaType.APPLICATION_FORM_URLENCODED.isCompatibleWith(contentType)) {
|
||||
return exchange.getFormData()
|
||||
.flatMap(form -> {
|
||||
for (String key : CHECK_PARAMS) {
|
||||
List<String> values = form.get(key);
|
||||
if (values != null) {
|
||||
for (String v : values) {
|
||||
if (!isValid(v)) {
|
||||
log.warn("XSLT_INJECTION_FORM ip={} uri={} param={} value={}",
|
||||
request.getRemoteAddress(), path, key, v);
|
||||
return reject(exchange);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return chain.filter(exchange);
|
||||
});
|
||||
}
|
||||
|
||||
/* 3. JSON 参数留扩展（可继续读 body 校验） */
|
||||
return chain.filter(exchange);
|
||||
}
|
||||
|
||||
private boolean isValid(String value) {
|
||||
if (value == null || value.isEmpty()) return true;
|
||||
if (!WHITE.matcher(value).matches()) return false;
|
||||
String lower = value.toLowerCase(Locale.ROOT);
|
||||
return BLACK_KEYS.stream().noneMatch(lower::contains);
|
||||
}
|
||||
|
||||
private Mono<Void> reject(ServerWebExchange exchange) {
|
||||
ServerHttpResponse resp = exchange.getResponse();
|
||||
resp.setStatusCode(HttpStatus.BAD_REQUEST);
|
||||
byte[] body = "Illegal XSLT keyword/character in parameter".getBytes(StandardCharsets.UTF_8);
|
||||
DataBuffer buffer = resp.bufferFactory().wrap(body);
|
||||
return resp.writeWith(Flux.just(buffer));
|
||||
}
|
||||
|
||||
@Override
|
||||
public int getOrder() {
|
||||
/* 比 SecurityHeaderFilter 更早执行，先拦非法参数再加头 */
|
||||
return Ordered.HIGHEST_PRECEDENCE;
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue