SpringBoot 之 SpringMVC 实现SQL注入过滤完整版（支持POST请求和GET请求）

谁借莪１个温暖的怀抱￠ 2024-04-19 16:05 72阅读 0赞

首先请参考：[SpringBoot 之 SpringMVC拦截器从Request中获取参数并解决request的请求流只能读取一次的问题][SpringBoot _ SpringMVC_Request_request]

参考完上面的代码，现在开始编辑SQL注入拦截器，核心功能代码如下：

package com.digipower.erms.interceptor;
    
    import java.io.BufferedReader;
    import java.io.InputStreamReader;
    import java.util.ArrayList;
    import java.util.Date;
    import java.util.Enumeration;
    import java.util.HashMap;
    import java.util.List;
    import java.util.Map;
    import java.util.regex.Pattern;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import org.apache.commons.lang.StringEscapeUtils;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.core.LocalVariableTableParameterNameDiscoverer;
    import org.springframework.web.method.HandlerMethod;
    import org.springframework.web.servlet.ModelAndView;
    import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
    import com.alibaba.druid.util.StringUtils;
    import com.alibaba.fastjson.JSON;
    import com.alibaba.fastjson.JSONObject;
    import com.ctc.wstx.util.StringUtil;
    import com.digipower.erms.annotation.SysLog;
    import com.digipower.erms.api.LogRecordService;
    import com.digipower.erms.common.cache.RedisUtil;
    import com.digipower.erms.common.model.Result;
    import com.digipower.erms.domain.LogRecord;
    import com.digipower.erms.request.wrapper.SQLInjectionHttpServletRequestWrapper;
    import com.digipower.erms.util.HttpContextUtils;
    import com.digipower.erms.util.HttpUtils;
    import com.digipower.erms.util.SecurityUtils;
    
    /**
     * 全局拦截器
     */
    public class ErmsInterceptor extends HandlerInterceptorAdapter {
    
        private static final Logger log = LoggerFactory.getLogger(ErmsInterceptor.class);
        
        @Autowired
    	private LogRecordService service;
        
        @Autowired
    	SecurityUtils securityUtils;
    
        @Override
        public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        	log.debug("ErmsInterceptor start pre ...");
        	String method = request.getMethod();
        	if("POST".equals(method)){
        		SQLInjectionHttpServletRequestWrapper wrapper = new SQLInjectionHttpServletRequestWrapper(request);
        		String requestBody = wrapper.getRequestBodyParame();
        		if(!StringUtils.isEmpty(requestBody)){
        			//sql注入直接拦截
    				if(sqlInject(requestBody.toLowerCase())){ 
    					 // 补全拦截器过滤用户登入信息
    					 if (handler instanceof HandlerMethod) {
    						 HandlerMethod h = (HandlerMethod) handler;
    						 insertLogRecord(h,requestBody); 
    					 }
    					response.setContentType("text/html;charset=UTF-8");  
    					response.getWriter().print(JSON.toJSONString(Result.ok("-3","请求异常").setData("error-message", "参数含有非法攻击字符,已禁止继续访问")));  
    					return false;  
    				}
        		}  
        	} else {
        		Enumeration<String> names = request.getParameterNames(); 
        		// 请求参数转换JSON 对象
    			List<Map> container = new ArrayList<Map>();
    			while(names.hasMoreElements()){
    				Map<String,String> map = new HashMap<String,String>();
    				String key = names.nextElement();
    				String value = request.getParameter(key);
    				map.put(key, value);
    				container.add(map);
    			}
    			String requestBody = JSON.toJSONString(container);
    			
        		while(names.hasMoreElements()){  
        			String name = names.nextElement();  
        			String[] values = request.getParameterValues(name);  
        			for(String value: values){
        				//sql注入直接拦截
        				if(sqlInject(value.toLowerCase())){
        					 // 补全拦截器过滤用户登入信息
        					if(handler instanceof HandlerMethod){
        						HandlerMethod h = (HandlerMethod) handler;
        						insertLogRecord(h,requestBody); 
        					}
        					
        					response.setContentType("text/html;charset=UTF-8");  
        					response.getWriter().print(JSON.toJSONString(Result.ok("-3","请求异常").setData("error-message", "参数含有非法攻击字符,已禁止继续访问")));  
        					return false;  
        				}
        				// 脚本注入XSS
        				StringEscapeUtils.escapeHtml(value);
        				StringEscapeUtils.escapeHtml(value);
        			}  
        		}  
        	}
    
            //TODO 
            return true;
        }
    
        @Override
        public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
            super.postHandle(request, response, handler, modelAndView);
        }
    
        @Override
        public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
            super.afterCompletion(request, response, handler, ex);
        }
    
        @Override
        public void afterConcurrentHandlingStarted(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
            super.afterConcurrentHandlingStarted(request, response, handler);
        }
        
        /**
         * 
         * @Title: sqlInject   
         * @Description: TODO SQL 注入正在表达式(sql 函数关键字过滤)
         * @param: @param value
         * @param: @return      
         * @return: boolean      
         * @throws
         */
        public boolean sqlInject(String value){  
            if(value == null || "".equals(value)){  
                return false;  
            }  
            String regex =".*(select|update|union|and|delete|insert|trancate|char|into|substr|ascii|declare|exec|count|master|drop|execute|[+]|%).*";
            boolean isMatch = Pattern.matches(regex, value);
            return isMatch;  
        }
        
        public void insertLogRecord(HandlerMethod handlerMethod,String queryParame){
        	LogRecord record = new LogRecord();
        	SysLog sysLog = handlerMethod.getMethodAnnotation(SysLog.class);
        	if (sysLog != null) {
                // 注解上的描述
            	record.setLogType(Short.valueOf("-1"));
            	record.setLogDesc(sysLog.value());
            }
        	String className = handlerMethod.getClass().getName();
            String methodName = handlerMethod.getMethod().getName();
        	record.setClassMethod(className + "." + methodName + "()");
        	// 请求参数
        	record.setParames(queryParame);
        	// 请求地址
            HttpServletRequest request = HttpContextUtils.getRequest();
            String ip = HttpUtils.getIpAddress(request);
            record.setIpAddress(ip);
            
            // 操作用户
           String username = securityUtils.getAuthUserPin(request);
           record.setUsername(username);
           
           // 创建时间
           record.setCreateTime(new Date()); 
           service.insert(record);
        }
    }

springboot 配置拦截器:

package com.digipower.ucas.config;
     
    import java.util.ArrayList;
    import java.util.List;
     
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.http.converter.HttpMessageConverter;
    import org.springframework.web.servlet.config.annotation.EnableWebMvc;
    import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
    import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
    import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
     
    import io.swagger.annotations.ApiOperation;
    import springfox.documentation.builders.ApiInfoBuilder;
    import springfox.documentation.builders.ParameterBuilder;
    import springfox.documentation.builders.PathSelectors;
    import springfox.documentation.builders.RequestHandlerSelectors;
    import springfox.documentation.schema.ModelRef;
    import springfox.documentation.service.ApiInfo;
    import springfox.documentation.service.Contact;
    import springfox.documentation.service.Parameter;
    import springfox.documentation.spi.DocumentationType;
    import springfox.documentation.spring.web.plugins.Docket;
    import springfox.documentation.swagger2.annotations.EnableSwagger2;
     
    @Configuration
    @EnableSwagger2
    @EnableWebMvc
    public class SwaggerConfig extends WebMvcConfigurerAdapter {
     
    	@Override
    	public void addResourceHandlers(ResourceHandlerRegistry registry) {
    		registry.addResourceHandler("swagger-ui.html").addResourceLocations("classpath:/META-INF/resources/");
    		registry.addResourceHandler("/webjars/**").addResourceLocations("classpath:/META-INF/resources/webjars/");
    	}
    	
    	// 定义json 转换器
    	@Override
    	public void configureMessageConverters(List<HttpMessageConverter<?>> converters) {
    		// TODO Auto-generated method stub
    		super.configureMessageConverters(converters);
    	}
     
    	@Bean
    	public Docket buildDocket() {
     
    		ParameterBuilder tokenPar = new ParameterBuilder();
    		List<Parameter> pars = new ArrayList<Parameter>();
    		tokenPar.name("X-CSRF-TOKEN").description("令牌").modelRef(new ModelRef("string")).parameterType("header")
    				.required(false).build();
    		pars.add(tokenPar.build());
     
    		return new Docket(DocumentationType.SWAGGER_2).select()
    				.apis(RequestHandlerSelectors.withMethodAnnotation(ApiOperation.class)).paths(PathSelectors.any())
    				.build().globalOperationParameters(pars).apiInfo(buildApiInf());
    	}
     
    	
     
    	private ApiInfo buildApiInf() {
    		return new ApiInfoBuilder().title("深圳市世纪伟图科技开发有限公司 - 城建档案系统").termsOfServiceUrl("http://www.digipower.cn/")
    				.description("API接口")
    				.contact(new Contact("digipower", "http://www.digipower.cn/", "digiservices@digipower.com"))
    				.version("2.0").build();
     
    	}
    	
    	    //SQL注入拦截器
    		@Bean
    		public ErmsInterceptor sqlInjectInterceptor () {
    			return new ErmsInterceptor ();
    		}
    	 
    		@Override
    		public void addInterceptors(InterceptorRegistry registry) {// 2
    			registry.addInterceptor(sqlInjectInterceptor());
    		}
    }

[SpringBoot _ SpringMVC_Request_request]: https://blog.csdn.net/zhouzhiwengang/article/details/101031353