户输入正确执行危险字符清理

/login?action…/webapps/RTJEKSWTN26635typerandomCode

cookie为Cookie:

JSESSIONID…/webapps/RTJEKSWTN26241;

测试返回为200

解决办法通过建立过滤器方法增加对所有用户输入信息中是否包含“..”两个点字符串进行清理过滤。

使用AppScan扫描之后可以通过这样的方式进行指定问题手动测试

web.xml

filterfilter-nameInjectFilter/filter-namefilter-classcom.fh.filter.InjectFilter/filter-class/filter

创建拦截器

org.springframework.http.HttpStatus;import

javax.servlet.*;

javax.servlet.http.HttpServletRequest;

import

javax.servlet.http.HttpServletResponse;

import

LoggerFactory.getLogger(InjectFilter.class);private

static

{//判断是否有注入攻击字符HttpServletRequest

req

request.getParameterNames();String

attributeName;String

attributeValues[];HttpServletRequest

req

e.nextElement();//不对密码信息进行过滤一般密码中可以包含特殊字符if

(attributeName.equals(username)

attributeName.equals(password))

request.getParameterValues(attributeName);for

(int

attributeValues[i].equals())continue;boolean

flag

isSpecialChar(attributeValues[i],

response);if

匹配到非法字符,立即返回responseMap.put(code,

入参中有非法字符);response.setContentType(application/json;charsetUTF-8);response.setStatus(HttpStatus.OK.value());PrintWriter

writer

response.getWriter();writer.write(JSON.toJSONString(responseMap));writer.flush();writer.close();return

false;}return