add csrf switch

Author: JoyChou93

README.md

@@ -18,13 +18,13 @@ Sort by letter.
 - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback-online.xml)
 - [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java)
 - [CRLF Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java)
-- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/WebSecurityConfig.java)
+- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java)
 - [Deserialize](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java)
 - [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java)
 - [File Upload](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java)
 - [IP Forge](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java)
 - [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java)
-- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java)
+- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/jsonp/JSONP.java)
 - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java)
 - [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java)
 - [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java)

README_zh.md

@@ -15,13 +15,13 @@
 - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback-online.xml)
 - [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java)
 - [CRLF Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java)
-- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/WebSecurityConfig.java)
+- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java)
 - [Deserialize](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java)
 - [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java)
 - [File Upload](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java)
 - [IP Forge](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java)
 - [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java)
-- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java)
+- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/jsonp/JSONP.java)
 - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java)
 - [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java)
 - [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java)

src/main/java/org/joychou/CsrfAccessDeniedHandler.java renamed to src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java

@@ -1,4 +1,4 @@
-package org.joychou;
+package org.joychou.security;
 
 
 import org.springframework.http.MediaType;
@@ -11,12 +11,12 @@
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 
+/**
+ * Design csrf access denied page.
+ *
+ */
 public class CsrfAccessDeniedHandler implements AccessDeniedHandler {
 
-    /**
-     * Design csrf access denied page.
-     *
-     */
     @Override
     public void handle(HttpServletRequest request, HttpServletResponse response,
                        AccessDeniedException accessDeniedException) throws IOException, ServletException {

src/main/java/org/joychou/WebSecurityConfig.java renamed to src/main/java/org/joychou/security/WebSecurityConfig.java

@@ -1,5 +1,6 @@
-package org.joychou;
+package org.joychou.security;
 
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
@@ -10,10 +11,18 @@
 import java.util.Arrays;
 import java.util.HashSet;
 
+
+/**
+ * Congifure csrf
+ *
+ */
 @EnableWebSecurity
 @Configuration
 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
+    @Value("${org.joychou.security.csrf}")
+    private Boolean csrfSwitch;  // get csrf switch in application.properties
+
     RequestMatcher csrfRequestMatcher = new RequestMatcher() {
 
         // 配置不需要CSRF校验的请求方式
@@ -23,6 +32,9 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
         @Override
         public boolean matches(HttpServletRequest request) {
             // return false表示不校验csrf
+            if (!csrfSwitch) {
+                return false;
+            }
             return !this.allowedMethods.contains(request.getMethod());
         }
 

src/main/java/org/joychou/security/secFilter.java renamed to src/main/java/org/joychou/security/jsonpFilter.java

@@ -18,7 +18,7 @@
  *
  */
 @WebFilter(filterName = "referSecCheck", urlPatterns = "/*")
-public class secFilter implements Filter {
+public class jsonpFilter implements Filter {
 
     @Value("${org.joychou.security.jsonp}")
     private Boolean jsonpSwitch;  // get application.properties configure

src/main/resources/application.properties

@@ -1,7 +1,8 @@
 
 # Spring Boot Actuator Vulnerable Config
 management.security.enabled=false
-logging.config=classpath:logback-online.xml
+# logging.config=classpath:logback-online.xml
 
 # jsonp check referer switch
-org.joychou.security.jsonp = true
+org.joychou.security.jsonp = true
+org.joychou.security.csrf = false