Skip to content

Commit 6ae0527

Browse files
JoyChou93JoyChou93
committed
add filter cors fix code
1 parent 22f0ecd commit 6ae0527

File tree

8 files changed

+91
-27
lines changed

8 files changed

+91
-27
lines changed

‎src/main/java/org/joychou/config/CorsConfig2.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
//import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
88
//import org.springframework.web.filter.CorsFilter;
99
//
10+
//// https://spring.io/blog/2015/06/08/cors-support-in-spring-framework
1011
//@Configuration
1112
//public class CorsConfig2 {
1213
//

‎src/main/java/org/joychou/controller/CORS.java‎ renamed to ‎src/main/java/org/joychou/controller/Cors.java‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818

1919
@RestController
2020
@RequestMapping("/cors")
21-
public class CORS {
21+
public class Cors {
2222

2323
protected static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}";
2424
protected static String[] urlwhitelist = {"joychou.com", "joychou.me"};
@@ -46,42 +46,42 @@ private static String vuls3(HttpServletResponse response) {
4646
}
4747

4848

49-
/**
50-
* http://localhost:8080/cors/sec/webMvcConfigurer
51-
* https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/config/webMvcConfigurer.java
52-
*/
49+
// https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/config/webMvcConfigurer.java
5350
@RequestMapping("/sec/webMvcConfigurer")
5451
public CsrfToken getCsrfToken_01(CsrfToken token) {
5552
return token;
5653
}
5754

5855

59-
/**
60-
* https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java
61-
*/
56+
// https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java
6257
@RequestMapping("/sec/httpCors")
6358
public CsrfToken getCsrfToken_02(CsrfToken token) {
6459
return token;
6560
}
6661

6762

68-
/**
69-
* https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/filter/SecCorsFilter.java
70-
*/
63+
// https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/filter/SecCorsFilter.java
7164
@RequestMapping("/sec/corsFitler")
7265
public CsrfToken getCsrfToken_03(CsrfToken token) {
7366
return token;
7467
}
7568

7669

70+
// https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/filter/CorsFilter.java
71+
@RequestMapping("/sec/Filter")
72+
public CsrfToken getCsrfToken_04(CsrfToken token) {
73+
return token;
74+
}
75+
76+
7777
// http://localhost:8080/cors/sec/checkOrigin
7878
@RequestMapping("/sec/checkOrigin")
7979
public String seccode(HttpServletRequest request, HttpServletResponse response) {
8080
String origin = request.getHeader("Origin");
8181

8282
// 如果origin不为空并且origin不在白名单内，认定为不安全。
8383
// 如果origin为空，表示是同域过来的请求或者浏览器直接发起的请求。
84-
if ( origin != null && !SecurityUtil.checkURLbyEndsWith(origin, urlwhitelist) ) {
84+
if ( origin != null && SecurityUtil.checkURLbyEndsWith(origin, urlwhitelist) == null ) {
8585
return "Origin is not safe.";
8686
}
8787
response.setHeader("Access-Control-Allow-Origin", origin);

‎src/main/java/org/joychou/controller/URLRedirect.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ public static void forward(HttpServletRequest request, HttpServletResponse respo
8282
public static void sendRedirect_seccode(HttpServletRequest request, HttpServletResponse response) throws IOException{
8383
String url = request.getParameter("url");
8484
String urlwhitelist[] = {"joychou.org", "joychou.com"};
85-
if (!SecurityUtil.checkURLbyEndsWith(url, urlwhitelist)) {
85+
if (SecurityUtil.checkURLbyEndsWith(url, urlwhitelist) == null) {
8686
// Redirect to error page.
8787
response.sendRedirect("https://test.joychou.org/error3.html");
8888
return;

‎src/main/java/org/joychou/controller/jsonp/JSONP.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ private String referer(HttpServletRequest request) {
6262
private String emptyReferer(HttpServletRequest request) {
6363
String referer = request.getHeader("referer");
6464

65-
if (null != referer && !SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist)) {
65+
if (null != referer && SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist) == null) {
6666
return "error";
6767
}
6868

@@ -108,7 +108,7 @@ public ModelAndView mappingJackson2JsonView(HttpServletRequest req) {
108108
private String safecode(HttpServletRequest request) {
109109
String referer = request.getHeader("referer");
110110

111-
if (!SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist)) {
111+
if (SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist) == null) {
112112
return "error";
113113
}
114114

‎src/main/java/org/joychou/security/HttpFilter.java‎ renamed to ‎src/main/java/org/joychou/filter/HttpFilter.java‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package org.joychou.security;
1+
package org.joychou.filter;
22

33

44
import javax.servlet.*;
@@ -9,6 +9,7 @@
99

1010
import org.apache.commons.lang.StringUtils;
1111
import org.joychou.config.WebConfig;
12+
import org.joychou.security.SecurityUtil;
1213
import org.slf4j.Logger;
1314
import org.slf4j.LoggerFactory;
1415
import org.springframework.util.AntPathMatcher;
@@ -30,7 +31,7 @@ public void init(FilterConfig filterConfig) throws ServletException {
3031

3132
}
3233

33-
private final Logger logger= LoggerFactory.getLogger(HttpFilter.class);
34+
private final Logger logger= LoggerFactory.getLogger(this.getClass());
3435

3536
@Override
3637
public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain)
@@ -49,13 +50,15 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
4950
}
5051
}
5152

53+
// logger.info("[+] Referer: " + refer);
54+
5255
if (isMatch) {
5356
if (WebConfig.getReferSecEnabled()) {
5457
// Check referer for all GET requests with callback parameters.
5558
for (String callback: WebConfig.getCallbacks()) {
5659
if (request.getMethod().equals("GET") && StringUtils.isNotBlank(request.getParameter(callback)) ){
5760
// If the check of referer fails, a 403 forbidden error page will be returned.
58-
if (!SecurityUtil.checkURLbyEndsWith(refer, WebConfig.getReferWhitelist())){
61+
if (SecurityUtil.checkURLbyEndsWith(refer, WebConfig.getReferWhitelist()) == null ){
5962
logger.info("[-] URL: " + request.getRequestURL() + "?" + request.getQueryString() + "\t"
6063
+ "Referer: " + refer);
6164
response.sendRedirect("https://test.joychou.org/error3.html");

‎src/main/java/org/joychou/filter/OriginFilter.java‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
package org.joychou.filter;
2+
3+
4+
import javax.servlet.*;
5+
import javax.servlet.annotation.WebFilter;
6+
import javax.servlet.http.HttpServletRequest;
7+
import javax.servlet.http.HttpServletResponse;
8+
import java.io.IOException;
9+
10+
import org.joychou.security.SecurityUtil;
11+
import org.slf4j.Logger;
12+
import org.slf4j.LoggerFactory;
13+
14+
/**
15+
* 推荐使用该全局方案修复Cors跨域漏洞，因为可以校验一级域名。
16+
* @author JoyChou @ 2019.12.19
17+
*
18+
*/
19+
20+
@WebFilter(filterName = "OriginFilter", urlPatterns = "/cors/sec/Filter")
21+
public class OriginFilter implements Filter {
22+
23+
private static String[] urlwhitelist = {"joychou.org", "joychou.me"};
24+
25+
@Override
26+
public void init(FilterConfig filterConfig) throws ServletException {
27+
28+
}
29+
30+
private final Logger logger= LoggerFactory.getLogger(this.getClass());
31+
32+
@Override
33+
public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain)
34+
throws IOException, ServletException {
35+
36+
HttpServletRequest request = (HttpServletRequest)req;
37+
HttpServletResponse response = (HttpServletResponse)res;
38+
39+
String origin = request.getHeader("Origin");
40+
logger.info("[+] Origin: " + origin + "\tCurrent url:" + request.getRequestURL());
41+
42+
// 以file协议访问html，origin为字符串的null，所以依然会走安全check逻辑
43+
if ( origin != null && SecurityUtil.checkURLbyEndsWith(origin, urlwhitelist) == null) {
44+
logger.error("[-] Origin check error.");
45+
return;
46+
}
47+
48+
response.setHeader("Access-Control-Allow-Origin", origin);
49+
response.setHeader("Access-Control-Allow-Credentials", "true");
50+
response.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTION");
51+
52+
filterChain.doFilter(req, res);
53+
}
54+
55+
@Override
56+
public void destroy() {
57+
58+
}
59+
}

‎src/main/java/org/joychou/security/SecurityUtil.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,29 +18,29 @@ public class SecurityUtil {
1818
*
1919
* @param url 需要check的url
2020
* @param urlwhitelist url白名单list
21-
* @return 安全url返回true，危险url返回false
21+
* @return 安全url返回url，危险url返回null
2222
*/
23-
public static Boolean checkURLbyEndsWith(String url, String[] urlwhitelist) {
23+
public static String checkURLbyEndsWith(String url, String[] urlwhitelist) {
2424
if (null == url) {
25-
return false;
25+
return null;
2626
}
2727
try {
2828
URI uri = new URI(url);
2929

3030
if (!url.startsWith("http://") && !url.startsWith("https://")) {
31-
return false;
31+
return null;
3232
}
3333

3434
String host = uri.getHost().toLowerCase();
3535
for (String whitelist: urlwhitelist){
3636
if (host.endsWith("." + whitelist)) {
37-
return true;
37+
return url;
3838
}
3939
}
4040

41-
return false;
41+
return null;
4242
} catch (Exception e) {
43-
return false;
43+
return null;
4444
}
4545
}
4646

@@ -75,9 +75,9 @@ public static boolean checkSSRFWithoutRedirect(String url) {
7575
*
7676
* @param url The url that needs to check.
7777
* @param hostWlist host whitelist
78-
* @return Safe url returns true. Dangerous url returns false.
78+
* @return Safe url returns url. Dangerous url returns null.
7979
*/
80-
public static boolean checkSSRFByHostWlist(String url, String[] hostWlist) {
80+
public static String checkSSRFByHostWlist(String url, String[] hostWlist) {
8181
return checkURLbyEndsWith(url, hostWlist);
8282
}
8383

‎src/main/resources/templates/index.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
<p>
1111
<a th:href="@{/codeinject?filepath=/tmp;cat /etc/passwd}">CmdInject</a>&nbsp;&nbsp;
1212
<a th:href="@{/jsonp/getToken?_callback=test}">JSONP</a>&nbsp;&nbsp;
13+
<a th:href="@{cors/sec/Filter}">Cors</a>&nbsp;&nbsp;
1314
<a th:href="@{/path_traversal/vul?filepath=../../../../../etc/passwd}">PathTraversal</a>&nbsp;&nbsp;
1415
<a th:href="@{/sqli/jdbc/vul?username=joychou}">SqlInject</a>&nbsp;&nbsp;
1516
<a th:href="@{/ssrf/urlConnection?url=file:///etc/passwd}">SSRF</a>&nbsp;&nbsp;

0 commit comments

Comments
 (0)