From 4a878127ba646e2a550f563055d8ae3c87b24b01 Mon Sep 17 00:00:00 2001
From: j3ers3
Date: Wed, 18 Oct 2023 17:50:10 +0800
Subject: [PATCH 01/13] =?UTF-8?q?=F0=9F=92=A5=20Java=20Sec?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
README.md | 6 +-
pom.xml | 23 ++-
.../java/com/best/hello/config/MvcConfig.java | 4 +-
.../java/com/best/hello/controller/CSRF.java | 81 +++++++-
.../best/hello/controller/CSVInjection.java | 93 +++++++++
.../com/best/hello/controller/XSS/XSS.java | 87 ++++++--
.../java/com/best/hello/entity/XSSEntity.java | 24 +++
.../java/com/best/hello/mapper/XSSMapper.java | 23 +++
src/main/resources/banner.txt | 4 +-
src/main/resources/db.sql | 14 +-
src/main/resources/static/css/base.css | 23 +--
src/main/resources/static/css/signin.css | 7 +-
.../resources/templates/commons/commons.html | 39 +++-
src/main/resources/templates/csrf.html | 143 +++++++++++---
.../resources/templates/csv_injection.html | 170 ++++++++++++++++
.../templates/{xss.html => xss_reflect.html} | 42 ++--
src/main/resources/templates/xss_store.html | 187 ++++++++++++++++++
17 files changed, 878 insertions(+), 92 deletions(-)
create mode 100644 src/main/java/com/best/hello/controller/CSVInjection.java
create mode 100644 src/main/java/com/best/hello/entity/XSSEntity.java
create mode 100644 src/main/java/com/best/hello/mapper/XSSMapper.java
create mode 100644 src/main/resources/templates/csv_injection.html
rename src/main/resources/templates/{xss.html => xss_reflect.html} (78%)
create mode 100644 src/main/resources/templates/xss_store.html
diff --git a/README.md b/README.md
index c216b4d..16ce346 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@
- [x] SSRF
- [x] Directory Traversal
- [x] Redirect
-- [ ] CSRF
+- [x] CSRF
- [x] File Upload
- [x] XXE
- [x] Actuator
@@ -27,13 +27,13 @@
- [x] Dos
- [x] Xpath
- [x] Jwt
-- [ ] more
+- [ ] more and more

## Run
### IDEA
-配置数据库连接,数据库文件`db.sql`
+配置数据库连接,数据库文件`src/main/resources/db.sql`
```
spring.datasource.url=jdbc:mysql://127.0.0.1:3306/test
spring.datasource.username=root
diff --git a/pom.xml b/pom.xml
index b49fd3a..a609488 100644
--- a/pom.xml
+++ b/pom.xml
@@ -11,7 +11,7 @@
com.best
javasec
- 1.10
+ 1.11
hello java sec
Java Sec
jar
@@ -149,7 +149,7 @@
org.jsoup
jsoup
- 1.12.2
+ 1.15.4
@@ -211,6 +211,12 @@
2.2.0.0
+
+ org.owasp.encoder
+ encoder
+ 1.2.3
+
+
org.apache.logging.log4j
@@ -275,6 +281,19 @@
0.9.5.2
+
+ org.apache.commons
+ commons-csv
+ 1.9.0
+
+
+
+
+ javax.xml.bind
+ jaxb-api
+ 2.3.1
+
+
diff --git a/src/main/java/com/best/hello/config/MvcConfig.java b/src/main/java/com/best/hello/config/MvcConfig.java
index 91eae2a..488b560 100644
--- a/src/main/java/com/best/hello/config/MvcConfig.java
+++ b/src/main/java/com/best/hello/config/MvcConfig.java
@@ -12,7 +12,8 @@ public void addViewControllers(ViewControllerRegistry registry) {
registry.addViewController("/").setViewName("index");
registry.addViewController("/login").setViewName("login");
registry.addViewController("/index").setViewName("index");
- registry.addViewController("/index/xss").setViewName("xss");
+ registry.addViewController("/index/xss").setViewName("xss_reflect");
+ registry.addViewController("/index/xss/store").setViewName("xss_store");
registry.addViewController("/index/rce").setViewName("rce");
registry.addViewController("/index/spel").setViewName("spel");
registry.addViewController("/index/ssti").setViewName("ssti");
@@ -40,6 +41,7 @@ public void addViewControllers(ViewControllerRegistry registry) {
registry.addViewController("/index/swagger").setViewName("swagger");
registry.addViewController("/index/jwt").setViewName("jwt");
registry.addViewController("/index/xpath").setViewName("xpath");
+ registry.addViewController("/index/csv").setViewName("csv_injection");
}
diff --git a/src/main/java/com/best/hello/controller/CSRF.java b/src/main/java/com/best/hello/controller/CSRF.java
index 0ebc9b1..75fde2b 100644
--- a/src/main/java/com/best/hello/controller/CSRF.java
+++ b/src/main/java/com/best/hello/controller/CSRF.java
@@ -1,12 +1,89 @@
package com.best.hello.controller;
import io.swagger.annotations.Api;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
+import io.swagger.annotations.ApiOperation;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.*;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.UUID;
@Api("跨站请求伪造")
@RestController
@RequestMapping("/CSRF")
public class CSRF {
+ @ApiOperation(value = "vul: 危险的转账")
+ @GetMapping("/transfer/vul")
+ public Map transferMoney(HttpServletRequest request, HttpServletResponse response, HttpSession session) {
+ // 从请求中获取转账金额和接收者
+ String from = (String) session.getAttribute("LoginUser");
+ String amount = request.getParameter("amount");
+ String receiver = request.getParameter("receiver");
+
+ Map result = new HashMap<>();
+ result.put("from", from);
+ result.put("receiver", receiver);
+ result.put("amount", amount);
+ result.put("success", true);
+ return result;
+ }
+
+ @ApiOperation(value = "vul: referer绕过", notes = "通过referer限制,只允许本站发起的请求,但是referer可以伪造")
+ @GetMapping("/transfer/referer")
+ public Map transferMoneySafe(HttpServletRequest request, HttpServletResponse response, HttpSession session) {
+ String from = (String) session.getAttribute("LoginUser");
+ String amount = request.getParameter("amount");
+ String receiver = request.getParameter("receiver");
+ Map result = new HashMap<>();
+ // 校验Referer 判断请求是否来自本站
+ String referer = request.getHeader("referer");
+ if (referer == null || !referer.startsWith("http://baidu.com")) {
+ result.put("success", false);
+ result.put("message", "referer is not valid");
+ return result;
+ }
+ result.put("from", from);
+ result.put("receiver", receiver);
+ result.put("amount", amount);
+ result.put("success", true);
+ return result;
+ }
+
+ @GetMapping("/transfer/genCSRFToken")
+ public Map genCSRFToken(HttpSession session, Model model) {
+ String token = UUID.randomUUID().toString();
+ session.setAttribute("csrfToken", token);
+ Map result = new HashMap<>();
+ result.put("csrfToken", token);
+ return result;
+ }
+
+ @PostMapping("/transfer/doTransferToken")
+ public Map doTransferToken(HttpServletRequest request, HttpSession session) {
+ String token = request.getParameter("csrfToken");
+ String sessionToken = (String) session.getAttribute("csrfToken");
+ String from = (String) session.getAttribute("LoginUser");
+ String amount = request.getParameter("amount");
+ String receiver = request.getParameter("receiver");
+ Map result = new HashMap<>();
+
+ // 校验CSRF Token
+ if (!token.equals(sessionToken)) {
+ result.put("success", false);
+ result.put("message", "token is not valid");
+ return result;
+ }
+
+ result.put("from", from);
+ result.put("receiver", receiver);
+ result.put("amount", amount);
+ result.put("csrfToken", token);
+ result.put("success", true);
+ return result;
+ }
}
diff --git a/src/main/java/com/best/hello/controller/CSVInjection.java b/src/main/java/com/best/hello/controller/CSVInjection.java
new file mode 100644
index 0000000..a027ac0
--- /dev/null
+++ b/src/main/java/com/best/hello/controller/CSVInjection.java
@@ -0,0 +1,93 @@
+package com.best.hello.controller;
+
+import com.best.hello.entity.XSSEntity;
+import com.best.hello.mapper.XSSMapper;
+import io.swagger.annotations.Api;
+import org.apache.commons.csv.CSVFormat;
+import org.apache.commons.csv.CSVPrinter;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import java.io.IOException;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+import java.util.List;
+
+@Api("CSV注入漏洞")
+@RestController
+@RequestMapping("/CSVInjection")
+public class CSVInjection {
+ @Autowired
+ private XSSMapper xssMapper;
+
+ @PostMapping("/save")
+ public String save(HttpServletRequest request, HttpSession session) {
+ String content = request.getParameter("content");
+ SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+ String date = df.format(new Date());
+ String user = session.getAttribute("LoginUser").toString();
+ xssMapper.add(user, content, date);
+ return "success";
+ }
+
+ @GetMapping("/getData")
+ public List getData() {
+ return xssMapper.list();
+ }
+
+ @GetMapping("/delete")
+ public String delete(int id) {
+ xssMapper.deleteFeedById(id);
+ return "success";
+ }
+
+ @GetMapping("/exportVul")
+ public void exportVul(HttpServletResponse response) throws Exception {
+ exportCSV(response, false);
+ }
+
+ @GetMapping("/exportSafe")
+ public void exportSafe(HttpServletResponse response) throws Exception {
+ exportCSV(response, true);
+ }
+
+ /**
+ * 导出 CSV 文件
+ */
+ private void exportCSV(HttpServletResponse response, boolean safe) throws IOException {
+ List data = xssMapper.list();
+
+ String fileName = "csv_injection.csv";
+ response.setContentType("text/csv");
+ response.setHeader("Content-Disposition", "attachment; filename=" + fileName);
+
+ CSVPrinter csvPrinter = new CSVPrinter(response.getWriter(), CSVFormat.DEFAULT
+ .withHeader("ID", "用户名", "内容", "时间"));
+
+ for (XSSEntity x : data) {
+ String content = safe ? filterCSVInjection(x.getContent()) : x.getContent();
+ csvPrinter.printRecord(x.getId(), x.getUser(), content, x.getDate());
+ }
+ csvPrinter.flush();
+ }
+
+ private String filterCSVInjection(String input) {
+ // 定义需要过滤的特殊字符
+ String[] forbiddenChars = {"=", "+", "-", "@"};
+
+ // 遍历特殊字符,将其替换为空字符串
+ for (String forbiddenChar : forbiddenChars) {
+ input = input.replace(forbiddenChar, "");
+ }
+
+ return input;
+ }
+
+
+}
diff --git a/src/main/java/com/best/hello/controller/XSS/XSS.java b/src/main/java/com/best/hello/controller/XSS/XSS.java
index da07a30..8c4e3e2 100644
--- a/src/main/java/com/best/hello/controller/XSS/XSS.java
+++ b/src/main/java/com/best/hello/controller/XSS/XSS.java
@@ -1,18 +1,24 @@
package com.best.hello.controller.XSS;
+import com.best.hello.mapper.XSSMapper;
import com.best.hello.util.Security;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
import org.jsoup.Jsoup;
-import org.jsoup.safety.Whitelist;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
+import org.jsoup.safety.Safelist;
+import org.owasp.encoder.Encode;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.*;
import org.springframework.web.util.HtmlUtils;
import org.owasp.esapi.ESAPI;
+import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
import java.io.IOException;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+import java.util.List;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -31,18 +37,22 @@ public class XSS {
static Logger log = LoggerFactory.getLogger(XSS.class);
- @ApiOperation(value = "vul: 反射型XSS")
+ @Autowired
+ private XSSMapper xssMapper;
+
+ @ApiOperation(value = "vul: 反射型XSS", notes = "直接返回用户输入内容")
@GetMapping("/reflect")
- public static String vul1(String content) {
+ public String xssReflect1(String content) {
log.info("[vul] 反射型XSS:" + content);
return content;
}
- @GetMapping("/vul2")
- public static void vul2(String content, HttpServletResponse response) {
- // 修复,设置ContentType类型:response.setContentType("text/plain;charset=utf-8");
+ @ApiOperation(value = "反射型XSS2", notes = "使用HttpServletResponse输出用户输入内容")
+ @GetMapping("/reflect2")
+ public void xssReflect2(String content, HttpServletResponse response) {
try {
+ // 修复方式设置ContentType类型:response.setContentType("text/plain;charset=utf-8");
response.getWriter().println(content);
response.getWriter().flush();
} catch (IOException e) {
@@ -50,10 +60,48 @@ public static void vul2(String content, HttpServletResponse response) {
}
}
+ @ApiOperation(value = "vul: 存储型XSS", notes = "存储用户输入内容")
+ @PostMapping("/save")
+ public String save(HttpServletRequest request, HttpSession session) {
+ String content = request.getParameter("content");
+ SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+ String date = df.format(new Date());
+ String user = session.getAttribute("LoginUser").toString();
+ xssMapper.add(user, content, date);
+ log.info("[vul] 存储型XSS:" + content);
+ return "success";
+ }
+
+ @ApiOperation(value = "获取存储的XSS数据")
+ @GetMapping("/getStored")
+ public List getStored() {
+ return xssMapper.list();
+ }
+
+ @ApiOperation(value = "删除存储的XSS数据")
+ @GetMapping("/delete")
+ public String delete(int id) {
+ xssMapper.deleteFeedById(id);
+ return "success";
+ }
+
+ @ApiOperation(value = "safe: 存储型XSS")
+ @PostMapping("/safeSave")
+ public String safeSave(HttpServletRequest request, HttpSession session) {
+ String content = request.getParameter("content");
+ SimpleDateFormat df = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+ String date = df.format(new Date());
+ String user = session.getAttribute("LoginUser").toString();
+
+ String safe_content = HtmlUtils.htmlEscape(content);
+
+ xssMapper.add(user, safe_content, date);
+ return "success";
+ }
@ApiOperation(value = "safe: 采用实体编码", notes = "采用自带函数HtmlUtils.htmlEscape()来过滤")
@GetMapping("/escape")
- public static String safe1(String content) {
+ public String safe1(String content) {
log.info("[safe] htmlEscape实体编码:" + content);
return HtmlUtils.htmlEscape(content);
}
@@ -61,16 +109,15 @@ public static String safe1(String content) {
@ApiOperation(value = "safe: 过滤特殊字符", notes = "做filterXss方法, 基于转义的方式")
@GetMapping("/filter")
- public static String safe2(String content) {
+ public String safe2(String content) {
log.info("[safe] xss过滤:" + content);
return Security.filterXss(content);
}
-
@ApiOperation(value = "safe: 富文本过滤", notes = "采用Jsoup做富文本过滤")
@GetMapping("/whitelist")
- public static String safe3(String content) {
- Whitelist whitelist = (new Whitelist())
+ public String safe3(String content) {
+ Safelist whitelist = (new Safelist())
.addTags("p", "hr", "div", "img", "span", "textarea") // 设置允许的标签
.addAttributes("a", "href", "title") // 设置标签允许的属性, 避免如nmouseover属性
.addProtocols("img", "src", "http", "https") // img的src属性只允许http和https开头
@@ -79,12 +126,18 @@ public static String safe3(String content) {
return Jsoup.clean(content, whitelist);
}
-
- @ApiOperation(value = "safe: ESAPI", notes = "采用ESAPI过滤")
+ @ApiOperation(value = "safe: ESAPI")
@GetMapping("/esapi")
- public static String safe4(String content) {
+ public String safe4(String content) {
log.info("[safe] ESAPI:" + content);
return ESAPI.encoder().encodeForHTML(content);
}
+ @ApiOperation(value = "safe: OWASP Java Encoder")
+ @GetMapping("/owaspEncoder")
+ public String safe5(String content) {
+ log.info("[safe] Encoder:" + content);
+ return Encode.forHtml(content);
+ }
+
}
diff --git a/src/main/java/com/best/hello/entity/XSSEntity.java b/src/main/java/com/best/hello/entity/XSSEntity.java
new file mode 100644
index 0000000..038767a
--- /dev/null
+++ b/src/main/java/com/best/hello/entity/XSSEntity.java
@@ -0,0 +1,24 @@
+package com.best.hello.entity;
+
+public class XSSEntity {
+ private Integer id;
+ private String user;
+ private String content;
+ private String date;
+
+ public Integer getId() {
+ return id;
+ }
+
+ public String getUser() {
+ return user;
+ }
+
+ public String getContent() {
+ return content;
+ }
+
+ public String getDate() {
+ return date;
+ }
+}
diff --git a/src/main/java/com/best/hello/mapper/XSSMapper.java b/src/main/java/com/best/hello/mapper/XSSMapper.java
new file mode 100644
index 0000000..d8b79fd
--- /dev/null
+++ b/src/main/java/com/best/hello/mapper/XSSMapper.java
@@ -0,0 +1,23 @@
+package com.best.hello.mapper;
+
+import com.best.hello.entity.XSSEntity;
+import org.apache.ibatis.annotations.Delete;
+import org.apache.ibatis.annotations.Insert;
+import org.apache.ibatis.annotations.Mapper;
+import org.apache.ibatis.annotations.Select;
+
+import java.util.List;
+
+@Mapper
+public interface XSSMapper {
+
+ @Select("select * from xss order by id desc")
+ List list();
+
+
+ @Delete("delete from xss where id = #{id}")
+ Integer deleteFeedById(Integer id);
+
+ @Insert("INSERT INTO xss(user, content, date) values(#{user}, #{content}, #{date}) ")
+ Integer add(String user, String content, String date);
+}
diff --git a/src/main/resources/banner.txt b/src/main/resources/banner.txt
index 56097ff..b8f4d0c 100644
--- a/src/main/resources/banner.txt
+++ b/src/main/resources/banner.txt
@@ -11,6 +11,6 @@
->>[======================]->>
MMMMMM---==[=Program : Hello Java Sec
- MMMMMM---==[=Version : 1.10
- MMMMMM---==[=Update : 2022/12/30
+ MMMMMM---==[=Version : 1.11
+ MMMMMM---==[=Update : 2023/10/18
MMMMMM---==[=Powered By : nul1
\ No newline at end of file
diff --git a/src/main/resources/db.sql b/src/main/resources/db.sql
index 71dabd7..c5f86ca 100644
--- a/src/main/resources/db.sql
+++ b/src/main/resources/db.sql
@@ -1,6 +1,7 @@
CREATE DATABASE IF NOT EXISTS test default charset utf8 COLLATE utf8_general_ci;
use test;
+-- SQL注入使用的数据
CREATE TABLE `users`
(
`id` int(11) unsigned NOT NULL AUTO_INCREMENT,
@@ -15,6 +16,7 @@ values (1, 'zhangwei', '123456');
INSERT INTO `users`
values (2, 'admin', 'password');
+-- 登录日志记录
CREATE TABLE `auth`
(
`id` int(6) unsigned NOT NULL AUTO_INCREMENT,
@@ -22,4 +24,14 @@ CREATE TABLE `auth`
`ip` varchar(50) NOT NULL,
`date` varchar(60) NOT NULL,
PRIMARY KEY (`id`)
-)
\ No newline at end of file
+);
+
+-- 存储型XSS
+CREATE TABLE `xss`
+(
+ `id` int(6) unsigned NOT NULL AUTO_INCREMENT,
+ `user` varchar(50) NOT NULL,
+ `content` TEXT NOT NULL,
+ `date` varchar(60) NOT NULL,
+ PRIMARY KEY (`id`)
+);
\ No newline at end of file
diff --git a/src/main/resources/static/css/base.css b/src/main/resources/static/css/base.css
index 055680d..f13b5ea 100644
--- a/src/main/resources/static/css/base.css
+++ b/src/main/resources/static/css/base.css
@@ -2,9 +2,7 @@ body {
font-size: .875rem;
}
-/*
- * Sidebar
- */
+/* Sidebar */
.sidebar {
position: fixed;
top: 0;
@@ -37,9 +35,9 @@ body {
/* 侧边栏样式 */
.sidebar .nav > li > a {
- padding: 9px 25px; /* 上下内边距是 10px,左右内边距是 30px*/
+ padding: 9px 15px;
color: #AEB7C2;
- border-left: 4px solid transparent; /* 左边样式 */
+ border-left: 4px solid transparent;
}
/* 侧边栏图标 */
@@ -76,17 +74,17 @@ body {
}
-/* 子菜单 */
+/* Submenu */
.sidebar .nav .nav {
background-color: #252c35;
}
-/* 子菜单布局 */
+/* Submenu layout */
.sidebar .nav .nav > li > a {
- padding-left: 50px;
+ padding-left: 30px;
padding-top: 4px;
padding-bottom: 6px;
- border-left: 4px solid transparent; /* 左边样式 */
+ border-left: 4px solid transparent;
}
.sidebar .nav .nav > li > a:focus, .sidebar .nav .nav > li > a.active {
@@ -180,25 +178,18 @@ body {
margin-right: 10px;
}
-/*
- * 漏洞描述
- */
.dec {
font-size: 15px;
-/ / background-color: #cee1f3;
background-color: #dce9f8;
}
-/* 标签 */
.nav-tabs .nav-link {
font-size: 15px;
}
.nav-tabs a.active.nav-link {
-/ / background-color: #dce9f8;
}
-/* 编码建议 */
#coder {
background-color: #dce9f8;
border: 0;
diff --git a/src/main/resources/static/css/signin.css b/src/main/resources/static/css/signin.css
index 3846881..7a53a25 100644
--- a/src/main/resources/static/css/signin.css
+++ b/src/main/resources/static/css/signin.css
@@ -6,14 +6,15 @@
align-items: center;
-webkit-box-pack: center;
justify-content: center;
- #background-image: url("/img/banner.png");
+}
+
+.form-control:focus {
+ box-shadow: none;
}
.form-signin {
width: 100%;
- #max-width: 400px;
padding: 45px;
- #margin: 0 auto;
margin-top: 100px;
box-shadow: 0 0 15px 12px #ececec;
border-radius: 20px;
diff --git a/src/main/resources/templates/commons/commons.html b/src/main/resources/templates/commons/commons.html
index e34b918..3b4981d 100644
--- a/src/main/resources/templates/commons/commons.html
+++ b/src/main/resources/templates/commons/commons.html
@@ -136,9 +136,26 @@
-
- XSS
-
+
+ 跨站脚本
+
@@ -241,11 +258,11 @@
其他漏洞
diff --git a/src/main/resources/templates/csrf.html b/src/main/resources/templates/csrf.html
index f23d146..ac0eee7 100644
--- a/src/main/resources/templates/csrf.html
+++ b/src/main/resources/templates/csrf.html
@@ -13,56 +13,127 @@
-
- CSRF是指跨站请求伪造(Cross-site request forgery)
-
+
+
+
+ CSRF(Cross-site request forgery),跨站请求伪造,是指利用受害者尚未失效的身份认证信息(cookie、会话等),诱骗其点击恶意链接或者访问包含攻击代码的页面,在受害人不知情的情况下以受害者的身份向(身份认证信息所对应的)服务器发送请求,从而完成非法操作(如转账、改密等)。CSRF与XSS最大的区别就在于,CSRF并没有盗取cookie而是直接利用。
-
编码建议
-
+
+
+ 1.要需要处理Referer为空的情况,当Referer为空则拒绝请求
+ 2.注意避免例如qq.com.evil.com 部分匹配的情况。
+
+
+
+
+
+
安全代码 - csrfToken
+
运行
-
安全代码 - 自定义过滤
+ th:href="@{/CSRF/transfer/referer?amount=100&receiver=zhangwei}">运行
+
安全代码 - referer
@@ -75,6 +146,20 @@
安全代码 - 自定义过滤
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ CSV注入(CSV Injection)也称为公式注入,是指在CSV文件中嵌入不受信任的输入时发生的情况。
+ 当使用诸如Microsoft Excel或LibreOffice Calc等电子表格程序打开CSV文件时,以=开头的单元格将被解释为公式,造成命令执行。
+
+
+
+
+
+
+
+
+
+
漏洞代码
+
+
+
+
+
+
+
+
+ 导出
+
安全代码
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+