From ab69c0b60c6746476a9c7be3172867000b8fefa2 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Mon, 3 Aug 2020 17:17:33 +0800 Subject: [PATCH 01/20] bug fix --- README.md | 1 + pom.xml | 2 +- .../java/org/joychou/config/SafeDomainParser.java | 11 +++++------ src/main/java/org/joychou/controller/SSRF.java | 7 +------ .../java/org/joychou/controller/URLWhiteList.java | 7 +++++-- .../org/joychou/security/CsrfAccessDeniedHandler.java | 7 +++---- .../java/org/joychou/security/ssrf/SSRFChecker.java | 2 +- src/main/java/org/joychou/util/HttpUtils.java | 10 ++++++++-- src/main/resources/templates/index.html | 1 + 9 files changed, 26 insertions(+), 22 deletions(-) diff --git a/README.md b/README.md index 2c0a0bc8..56d10960 100644 --- a/README.md +++ b/README.md @@ -40,6 +40,7 @@ Sort by letter. - [ooxmlXXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java) - [PathTraversal](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/PathTraversal.java) - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java) +- [Swagger](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/config/SwaggerConfig.java) - [SpEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SpEL.java) - [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java) - [SSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java) diff --git a/pom.xml b/pom.xml index 6e5c2455..2b273bad 100644 --- a/pom.xml +++ b/pom.xml @@ -7,7 +7,7 @@ sec java-sec-code 1.0.0 - war + jar 1.8 diff --git a/src/main/java/org/joychou/config/SafeDomainParser.java b/src/main/java/org/joychou/config/SafeDomainParser.java index 6157f645..b92ff9eb 100644 --- a/src/main/java/org/joychou/config/SafeDomainParser.java +++ b/src/main/java/org/joychou/config/SafeDomainParser.java @@ -29,11 +29,9 @@ public SafeDomainParser() { try { // 读取resources目录下的文件 ClassPathResource resource = new ClassPathResource(safeDomainClassPath); - File file = resource.getFile(); - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); DocumentBuilder db = dbf.newDocumentBuilder(); - Document doc = db.parse(file); // parse xml + Document doc = db.parse(resource.getInputStream()); // parse xml NodeList rootNode = doc.getElementsByTagName(rootTag); // 解析根节点domains Node domainsNode = rootNode.item(0); @@ -68,6 +66,7 @@ public SafeDomainParser() { WebConfig wc = new WebConfig(); wc.setSafeDomains(safeDomains); + logger.info(safeDomains.toString()); wc.setBlockDomains(blockDomains); // 解析SSRF配置 @@ -86,11 +85,10 @@ public SafeDomainParser() { try { // 读取resources目录下的文件 ClassPathResource resource = new ClassPathResource(ssrfSafeDomainClassPath); - File file = resource.getFile(); - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); DocumentBuilder db = dbf.newDocumentBuilder(); - Document doc = db.parse(file); // parse xml + // 修复打包成jar包运行，不能读取文件的bug + Document doc = db.parse(resource.getInputStream()); // parse xml NodeList rootNode = doc.getElementsByTagName(ssrfRootTag); // 解析根节点 Node domainsNode = rootNode.item(0); @@ -130,6 +128,7 @@ public SafeDomainParser() { logger.error(e.toString()); } + logger.info(ssrfBlockIps.toString()); wc.setSsrfBlockDomains(ssrfBlockDomains); wc.setSsrfBlockIps(ssrfBlockIps); wc.setSsrfSafeDomains(ssrfSafeDomains); diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java index a98c9952..9fdf757f 100644 --- a/src/main/java/org/joychou/controller/SSRF.java +++ b/src/main/java/org/joychou/controller/SSRF.java @@ -150,23 +150,18 @@ public String ImageIO(@RequestParam String url) { } - /** - * The default setting of followRedirects is true. - * UserAgent is okhttp/2.5.0. - */ @GetMapping("/okhttp/sec") public String okhttp(@RequestParam String url) { try { SecurityUtil.startSSRFHook(); - HttpUtils.okhttp(url); + return HttpUtils.okhttp(url); } catch (SSRFException | IOException e) { return e.getMessage(); } finally { SecurityUtil.stopSSRFHook(); } - return "okhttp ssrf test"; } diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java index b4d3c2f0..e6f9b987 100644 --- a/src/main/java/org/joychou/controller/URLWhiteList.java +++ b/src/main/java/org/joychou/controller/URLWhiteList.java @@ -6,6 +6,8 @@ import org.slf4j.LoggerFactory; import org.springframework.web.bind.annotation.*; +import java.net.MalformedURLException; +import java.net.URL; import java.util.ArrayList; import java.util.regex.Matcher; import java.util.regex.Pattern; @@ -92,7 +94,7 @@ public String regex(@RequestParam("url") String url) { * More details: https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass */ @GetMapping("/vuln/url_bypass") - public String url_bypass(String url) { + public String url_bypass(String url) throws MalformedURLException { logger.info("url: " + url); @@ -100,7 +102,8 @@ public String url_bypass(String url) { return "Url is not http or https"; } - String host = SecurityUtil.gethost(url); + URL u = new URL(url); + String host = u.getHost(); logger.info("host: " + host); // endsWith . diff --git a/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java b/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java index ba9c3f7f..2e1df795 100644 --- a/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java +++ b/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java @@ -7,15 +7,14 @@ import org.springframework.security.access.AccessDeniedException; import org.springframework.security.web.access.AccessDeniedHandler; - -import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; /** - * Design csrf access denied page. + * Csrf access denied page. * + * @author JoyChou */ public class CsrfAccessDeniedHandler implements AccessDeniedHandler { @@ -23,7 +22,7 @@ public class CsrfAccessDeniedHandler implements AccessDeniedHandler { @Override public void handle(HttpServletRequest request, HttpServletResponse response, - AccessDeniedException accessDeniedException) throws IOException, ServletException { + AccessDeniedException accessDeniedException) throws IOException { logger.info("[-] URL: " + request.getRequestURL() + "?" + request.getQueryString() + "\t" + "Referer: " + request.getHeader("referer")); diff --git a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java index 4ef0f046..01b1b350 100644 --- a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java +++ b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java @@ -50,7 +50,7 @@ public static boolean checkURLFckSSRF(String url) { /** * 解析url的ip，判断ip是否是内网ip，所以TTL设置为0的情况不适用。 * url只允许https或者http，并且设置默认连接超时时间。 - * 该修复方案会主动请求重定向后的链接。最好用Hook方式获取到所有url后，进行判断，代码待续… + * 该修复方案会主动请求重定向后的链接。 * * @param url check的url * @param checkTimes 设置重定向检测的最大次数，建议设置为10次 diff --git a/src/main/java/org/joychou/util/HttpUtils.java b/src/main/java/org/joychou/util/HttpUtils.java index 571680a2..1f92cfb9 100644 --- a/src/main/java/org/joychou/util/HttpUtils.java +++ b/src/main/java/org/joychou/util/HttpUtils.java @@ -146,10 +146,16 @@ public static String Jsoup(String url) { } - public static void okhttp(String url) throws IOException { + /** + * The default setting of followRedirects is true. The option of followRedirects is true. + * + * UserAgent is okhttp/2.5.0. + */ + public static String okhttp(String url) throws IOException { OkHttpClient client = new OkHttpClient(); + // client.setFollowRedirects(false); com.squareup.okhttp.Request ok_http = new com.squareup.okhttp.Request.Builder().url(url).build(); - client.newCall(ok_http).execute(); + return client.newCall(ok_http).execute().body().string(); } diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html index 671045d5..72779b8e 100644 --- a/src/main/resources/templates/index.html +++ b/src/main/resources/templates/index.html @@ -8,6 +8,7 @@

Hello .

Welcome to login java-sec-code application. Application Infomation

+ Swagger   CmdInject   JSONP   FileUpload   From 30dd98b81a6795f7f577ae0f2fde56680404395b Mon Sep 17 00:00:00 2001 From: JoyChou Date: Mon, 3 Aug 2020 17:49:12 +0800 Subject: [PATCH 02/20] fixes #23 --- src/main/resources/templates/login.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/resources/templates/login.html b/src/main/resources/templates/login.html index dc6ee40f..1a4c4225 100644 --- a/src/main/resources/templates/login.html +++ b/src/main/resources/templates/login.html @@ -8,7 +8,7 @@ - +