From c479c75264d185ebfadaabb585f1cd03ec9cd77e Mon Sep 17 00:00:00 2001 From: chenrui <1950717904@qq.com> Date: Fri, 3 May 2024 20:55:23 +0800 Subject: [PATCH] =?UTF-8?q?=E6=8F=90=E4=BA=A4=E6=BC=8F=E6=B4=9E=E4=BF=AE?= =?UTF-8?q?=E5=A4=8D=E4=BB=A3=E7=A0=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../auth/framework/config/CookieFilter.java | 15 +- .../auth/framework/config/CorsFilter.java | 4 +- .../framework/config/GlobalCorsConfig.java | 2 +- .../auth/framework/config/HostFilter.java | 14 +- .../auth/framework/config/InjectFilter.java | 2 +- .../framework/config/ResourcesConfig.java | 4 +- .../auth/framework/config/TomcatConfig.java | 4 +- .../config/XssHttpServletRequestWraper.java | 196 ------------------ .../shiro/web/filter/LogoutFilter.java | 1 - .../user/controller/LoginController.java | 18 +- .../src/main/resources/templates/login.html | 2 +- 11 files changed, 29 insertions(+), 233 deletions(-) delete mode 100644 lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssHttpServletRequestWraper.java diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java index 55f97baa..18a85cc2 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CookieFilter.java @@ -10,7 +10,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; -@Component +//@Component public class CookieFilter implements Filter { @@ -19,16 +19,6 @@ public class CookieFilter implements Filter { HttpServletRequest httpRequest = (HttpServletRequest) servletRequest; HttpServletResponse httpResponse = (HttpServletResponse) servletResponse; - //这里模拟下浏览器发送请求中包含三个cookie, - // 因为后端在request中无法添加cookie,咱们就先添加到response中， - //第一次请求把三个cookie带到客户端，再请求时浏览器就把这三个cookie带过来了 -// Cookie cookie1 = new Cookie("name","lsl"); -// httpResponse.addCookie(cookie1); -// Cookie cookie2 = new Cookie("age","18"); -// httpResponse.addCookie(cookie2); -// Cookie cookie3 = new Cookie("addr","beijing"); -// httpResponse.addCookie(cookie3); - String url = httpRequest.getRequestURL().toString(); Cookie[] cookies = httpRequest.getCookies(); @@ -38,8 +28,9 @@ public class CookieFilter implements Filter { String cookieName = cookie.getName(); String cookieValue = cookie.getValue(); System.out.println("url = " + url + ", cookieName = " + cookieName + ", cookieValue = " + cookieValue); - ResponseCookie lastCookie = ResponseCookie.from(cookieName, cookieValue).httpOnly(true).sameSite("Lax").build(); + ResponseCookie lastCookie = ResponseCookie.from(cookieName, cookieValue).httpOnly(true).sameSite("Strict").build(); httpResponse.addHeader(HttpHeaders.SET_COOKIE,lastCookie.toString()); + httpResponse.addHeader(HttpHeaders.COOKIE,lastCookie.toString()); } } diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java index 05234c31..84018f9a 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/CorsFilter.java @@ -25,7 +25,7 @@ public class CorsFilter implements Filter { throws IOException, ServletException { HttpServletResponse res = (HttpServletResponse) response; res.addHeader("Access-Control-Allow-Credentials", "true"); - res.addHeader("Access-Control-Allow-Origin", ((HttpServletRequest) request).getHeader("origin")); + res.addHeader("Access-Control-Allow-Origin", "http://10.132.108.3"); res.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT"); res.addHeader("Access-Control-Allow-Headers", "Content-Type,X-CAF-Authorization-Token,sessionToken,X-TOKEN,token"); res.addHeader("X-Frame-Options", "SAMEORIGIN"); @@ -48,8 +48,6 @@ public class CorsFilter implements Filter { res.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED); return; } - - chain.doFilter(request, response); } @Override diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java index 81f65783..7adbdc32 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/GlobalCorsConfig.java @@ -16,7 +16,7 @@ public class GlobalCorsConfig { //添加CORS配置信息 CorsConfiguration corsConfiguration = new CorsConfiguration(); //允许的域，不要写*，否则cookie就无法使用了 - corsConfiguration.addAllowedOrigin("*"); + corsConfiguration.addAllowedOrigin("http://10.132.108.3"); //允许的头信息 corsConfiguration.addAllowedHeader("*"); //允许的请求方式 diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/HostFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/HostFilter.java index 83abab85..34610cf7 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/HostFilter.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/HostFilter.java @@ -1,5 +1,6 @@ package com.zdxt.auth.framework.config; +import lombok.extern.slf4j.Slf4j; import org.springframework.beans.factory.annotation.Value; import org.springframework.stereotype.Component; @@ -19,6 +20,7 @@ import java.util.List; * 多个host用逗号隔开，本地开发使用127.0.0.1,localhost * @author liufr */ +@Slf4j @Component public class HostFilter implements Filter{ /** @@ -35,14 +37,16 @@ public class HostFilter implements Filter{ FilterChain filterChain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) servletRequest; HttpServletResponse response = (HttpServletResponse) servletResponse; -// String host = request.getHeader("host"); + String host = request.getHeader("host"); + String[] split = host.split(":"); String serverName = request.getServerName(); - System.out.println("serverName-debug:" + serverName); - if (!isEmpty(serverName)) { - if (checkBlankList(serverName)) { + log.info("请求的源地址：{}",host); + System.out.println("serverName-debug:" + host); + if (!isEmpty(split[0])) { + if (checkBlankList(split[0])) { filterChain.doFilter(servletRequest, servletResponse); } else { - System.out.println("[serverName deny access tips]->" + serverName); + System.out.println("[serverName deny access tips]->" + split[0]); // response.getWriter().print("host deny"); response.setStatus(403); response.flushBuffer(); diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/InjectFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/InjectFilter.java index 1f7b4222..efe05e1e 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/InjectFilter.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/InjectFilter.java @@ -59,7 +59,7 @@ public class InjectFilter implements Filter { while (e.hasMoreElements()) { attributeName = (String) e.nextElement(); //不对密码信息进行过滤，一般密码中可以包含特殊字符 - if (attributeName.equals("username") || attributeName.equals("password")) { + if (attributeName.equals("password")) { continue; } attributeValues = request.getParameterValues(attributeName); diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java index bec7e0a2..4249eb2d 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/ResourcesConfig.java @@ -52,7 +52,7 @@ public class ResourcesConfig implements WebMvcConfigurer .allowedHeaders("*") //允许的请求头 .allowedMethods("GET", "POST", "PUT", "DELETE") //允许的请求方法 .maxAge(1800) //探测请求的有效期 - .allowedOrigins("http://10.132.108.3:85","http://192.168.110.36:3301"); //支持的域 + .allowedOrigins("http://10.132.108.3:85","http://10.76.108.1:85"); //支持的域 } /** @@ -80,7 +80,7 @@ public class ResourcesConfig implements WebMvcConfigurer "/monitor/operlog", "/monitor/logininfor", "/system/dict", - "/system/config", +// "/system/config", "/monitor/job", "/statistical/analysis", "/statistical/view" diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java index 38a3a5d9..6be52b5a 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/TomcatConfig.java @@ -29,7 +29,7 @@ public class TomcatConfig { collection.addMethod("PUT"); collection.addMethod("DELETE"); collection.addMethod("HEAD"); - collection.addMethod("OPTIONS"); +// collection.addMethod("OPTIONS"); collection.addMethod("TRACE"); //url匹配表达式 所有路径 collection.addPattern("/*"); @@ -50,7 +50,7 @@ public class TomcatConfig { return context -> { final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor(); // 设置Cookie的SameSite - cookieProcessor.setSameSiteCookies(SameSiteCookies.LAX.getValue()); + cookieProcessor.setSameSiteCookies(SameSiteCookies.STRICT.getValue()); context.setCookieProcessor(cookieProcessor); }; } diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssHttpServletRequestWraper.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssHttpServletRequestWraper.java deleted file mode 100644 index 10489c14..00000000 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/config/XssHttpServletRequestWraper.java +++ /dev/null @@ -1,196 +0,0 @@ -package com.zdxt.auth.framework.config; - -import cn.hutool.http.HttpException; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; - -import javax.servlet.ReadListener; -import javax.servlet.ServletInputStream; -import javax.servlet.ServletOutputStream; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletRequestWrapper; -import javax.servlet.http.HttpServletResponse; -import java.io.BufferedReader; -import java.io.ByteArrayInputStream; -import java.io.IOException; -import java.io.InputStreamReader; -import java.nio.charset.Charset; -import java.util.regex.Matcher; -import java.util.regex.Pattern; - -public class XssHttpServletRequestWraper extends HttpServletRequestWrapper { - - Logger log = LoggerFactory.getLogger(this.getClass()); - - - public XssHttpServletRequestWraper() { - super(null); - } - - public XssHttpServletRequestWraper(HttpServletRequest httpservletrequest) { - super(httpservletrequest); - } - - //过滤springmvc中的 @RequestParam 注解中的参数 - public String[] getParameterValues(String s) { - - String str[] = super.getParameterValues(s); - if (str == null) { - return null; - } - int i = str.length; - String as1[] = new String[i]; - for (int j = 0; j < i; j++) { - //System.out.println("getParameterValues:"+str[j]); - as1[j] = cleanXSS(cleanSQLInject(str[j])); - } - log.info("XssHttpServletRequestWraper净化后的请求为：==========" + as1); - return as1; - } - - //过滤request.getParameter的参数 - public String getParameter(String s) { - String s1 = super.getParameter(s); - if (s1 == null) { - return null; - } else { - String s2 = cleanXSS(cleanSQLInject(s1)); - log.info("XssHttpServletRequestWraper净化后的请求为：==========" + s2); - return s2; - } - } - - //过滤请求体 json 格式的 - @Override - public ServletInputStream getInputStream() throws IOException { - final ByteArrayInputStream bais = new ByteArrayInputStream(inputHandlers(super.getInputStream ()).getBytes ()); - - return new ServletInputStream() { - - @Override - public int read() throws IOException { - return bais.read(); - } - - @Override - public boolean isFinished() { - return false; - } - - @Override - public boolean isReady() { - return false; - } - - @Override - public void setReadListener(ReadListener readListener) { - - } - }; - } - - - public String inputHandlers(ServletInputStream servletInputStream){ - StringBuilder sb = new StringBuilder(); - BufferedReader reader = null; - try { - reader = new BufferedReader(new InputStreamReader(servletInputStream, Charset.forName("UTF-8"))); - String line = ""; - while ((line = reader.readLine()) != null) { - sb.append(line); - } - } catch (IOException e) { - e.printStackTrace(); - } finally { - if (servletInputStream != null) { - try { - servletInputStream.close(); - } catch (IOException e) { - e.printStackTrace(); - } - } - if (reader != null) { - try { - reader.close(); - } catch (IOException e) { - e.printStackTrace(); - } - } - } - return cleanXSS(sb.toString ()); - } - - public String cleanXSS(String src) { - String temp = src; - - src = src.replaceAll("<", "＜").replaceAll(">", "＞"); - src = src.replaceAll("\\(", "（").replaceAll("\\)", "）"); - src = src.replaceAll("'", "＇"); - src = src.replaceAll(";", "；"); - //bgh 2018/05/30 新增 - /**-----------------------start--------------------------*/ - src = src.replaceAll("<", "& lt;").replaceAll(">", "& gt;"); - src = src.replaceAll("\\(", "& #40;").replaceAll("\\)", "& #41"); - src = src.replaceAll("eval\\((.*)\\)", ""); - src = src.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\""); - src = src.replaceAll("script", ""); - src = src.replaceAll("link", ""); - src = src.replaceAll("frame", ""); - /**-----------------------end--------------------------*/ - Pattern pattern = Pattern.compile("(eval\\((.*)\\)|script)", - Pattern.CASE_INSENSITIVE); - Matcher matcher = pattern.matcher(src); - src = matcher.replaceAll(""); - - pattern = Pattern.compile("[\\\"\\'][\\s]*javascript:(.*)[\\\"\\']", - Pattern.CASE_INSENSITIVE); - matcher = pattern.matcher(src); - src = matcher.replaceAll("\"\""); - - // 增加脚本 - src = src.replaceAll("script", "").replaceAll(";", "") - /*.replaceAll("\"", "").replaceAll("@", "")*/ - .replaceAll("0x0d", "").replaceAll("0x0a", ""); - - if (!temp.equals(src)) { - // System.out.println("输入信息存在xss攻击！"); - // System.out.println("原始输入信息-->" + temp); - // System.out.println("处理后信息-->" + src); - - log.error("xss攻击检查：参数含有非法攻击字符，已禁止继续访问！！"); - log.error("原始输入信息-->" + temp); - - throw new HttpException("xss攻击检查：参数含有非法攻击字符，已禁止继续访问！！"); - } - return src; - } - - //输出 - public void outputMsgByOutputStream(HttpServletResponse response, String msg) throws IOException { - ServletOutputStream outputStream = response.getOutputStream(); //获取输出流 - response.setHeader("content-type", "text/html;charset=UTF-8"); //通过设置响应头控制浏览器以UTF-8的编码显示数据，如果不加这句话，那么浏览器显示的将是乱码 - byte[] dataByteArr = msg.getBytes("UTF-8");// 将字符转换成字节数组，指定以UTF-8编码进行转换 - outputStream.write(dataByteArr);// 使用OutputStream流向客户端输出字节数组 - } - - // 需要增加通配，过滤大小写组合 - public String cleanSQLInject(String src) { - String lowSrc = src.toLowerCase(); - String temp = src; - String lowSrcAfter = lowSrc.replaceAll("insert", "forbidI") - .replaceAll("select", "forbidS") - .replaceAll("update", "forbidU") - .replaceAll("delete", "forbidD").replaceAll("and", "forbidA") - .replaceAll("or", "forbidO"); - - if (!lowSrcAfter.equals(lowSrc)) { - log.error("sql注入检查：输入信息存在SQL攻击！"); - log.error("原始输入信息-->" + temp); - log.error("处理后信息-->" + lowSrc); - throw new HttpException("sql注入检查：参数含有非法攻击字符，已禁止继续访问！！"); - - } - return src; - } - -} diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/shiro/web/filter/LogoutFilter.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/shiro/web/filter/LogoutFilter.java index 72fbe6c7..b38c81b7 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/shiro/web/filter/LogoutFilter.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/framework/shiro/web/filter/LogoutFilter.java @@ -125,7 +125,6 @@ public class LogoutFilter extends org.apache.shiro.web.filter.authc.LogoutFilter protected String getRedirectUrl(ServletRequest request, ServletResponse response, Subject subject) { String url = getLoginUrl(); - /* try{ if(sso){ HttpServletRequest requests=(HttpServletRequest)request; diff --git a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java index 5bfc98f6..5fb413b4 100644 --- a/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java +++ b/lib/EmergencyService/zdxtEmergencyAuthService/src/main/java/com/zdxt/auth/project/system/user/controller/LoginController.java @@ -88,17 +88,17 @@ public class LoginController extends BaseController @PostMapping("/login") @ResponseBody - public AjaxResult ajaxLogin(String username, String secretKey, Boolean rememberMe, String type, String clientid) { + public AjaxResult ajaxLogin(String secretName, String secretKey, Boolean rememberMe, String type, String clientid) { // username = username.toUpperCase(); //解密 secretKey = AesHelper.desEncrypt(secretKey); // UsernamePasswordToken token = new UsernamePasswordToken(username, password, false); - UserToken token = new UserToken(username, secretKey, LoginType.PASSWORD); + UserToken token = new UserToken(secretName, secretKey, LoginType.PASSWORD); Subject subject = SecurityUtils.getSubject(); try { if ("1".equals(type)) { //APP //System.out.println("验证当前Subject时获取到token为" + ReflectionToStringBuilder.toString(token, ToStringStyle.MULTI_LINE_STYLE)); - User sysUser = userService.selectUserByLoginName(username); + User sysUser = userService.selectUserByLoginName(secretName); //String newToken = ReflectionToStringBuilder.toString(token, ToStringStyle.MULTI_LINE_STYLE); if (null != sysUser) { String oldPwd = passwordService.encryptPassword(sysUser.getLoginName(), secretKey, sysUser.getSalt()); @@ -106,24 +106,24 @@ public class LoginController extends BaseController if (oldPwd.equals(sysUser.getPassword())) { // 根据cid或者account查询出列表 - List list = userCidService.selectTcUserCidListByCidOrAccount(clientid, username); + List list = userCidService.selectTcUserCidListByCidOrAccount(clientid, secretName); // 只有cid或account在库中都不存在，才插入。保证数据唯一 if (list.size() < 1) { TcUserCid newTcCid = new TcUserCid(); newTcCid.setCid(clientid); - newTcCid.setAccount(username); + newTcCid.setAccount(secretName); String fID = UUID.randomUUID().toString(); newTcCid.setFid(fID); newTcCid.setStatus(0); newTcCid.setIseffect(1); Date date = new Date(); newTcCid.setCreateTime(date); - newTcCid.setCreator(username); - newTcCid.setUpdator(username); + newTcCid.setCreator(secretName); + newTcCid.setUpdator(secretName); newTcCid.setUpdateTime(date); userCidService.insertTcUserCid(newTcCid); } else { - list.get(0).setAccount(username); + list.get(0).setAccount(secretName); list.get(0).setCid(clientid); userCidService.updateTcUserCid(list.get(0)); } @@ -133,7 +133,7 @@ public class LoginController extends BaseController //result.put(AjaxResult.DATA_TAG,authcInfo); User userBean = userService.getAppCurrentUser(sysUser.getUserId()); Map map = new HashMap(); - map.put("organId", username); + map.put("organId", secretName); map.put("userName", sysUser.getUserName()); map.put("phoneNumber", sysUser.getPhonenumber()); map.put("userId", sysUser.getUserId()); diff --git a/lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/login.html b/lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/login.html index bea12b26..b110e7ac 100644 --- a/lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/login.html +++ b/lib/EmergencyService/zdxtEmergencyBootStart/src/main/resources/templates/login.html @@ -83,7 +83,7 @@ type: "post", url: ctx + "login", data: { - "username": userName, + "secretName": userName, "secretKey": Encrypt(passWord) //"rememberMe": rememberMe },