From 7c16b212320001c2a6c479f3d40a097e635a87bd Mon Sep 17 00:00:00 2001 From: thinkgem Date: Thu, 17 Feb 2022 23:15:54 +0800 Subject: [PATCH] =?UTF-8?q?=E6=8E=92=E5=BA=8F=E8=BF=87=E6=BB=A4=E4=BC=98?= =?UTF-8?q?=E5=8C=96=EF=BC=8C=E5=8F=AA=E5=85=81=E8=AE=B8=E7=89=B9=E5=AE=9A?= =?UTF-8?q?=E5=AD=97=E7=AC=A6=E3=80=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../com/jeesite/common/codec/EncodeUtils.java | 94 ++++++++++--------- 1 file changed, 52 insertions(+), 42 deletions(-) diff --git a/common/src/main/java/com/jeesite/common/codec/EncodeUtils.java b/common/src/main/java/com/jeesite/common/codec/EncodeUtils.java index a759ec9d..f02fd61f 100644 --- a/common/src/main/java/com/jeesite/common/codec/EncodeUtils.java +++ b/common/src/main/java/com/jeesite/common/codec/EncodeUtils.java @@ -31,8 +31,9 @@ import com.jeesite.common.lang.StringUtils; * 2.自制的base62 编码 * 3.Commons-Lang的xml/html escape * 4.JDK提供的URLEncoder - * @author calvin - * @version 2013-01-15 + * 5、XSS、SQL、orderBy 过滤器 + * @author calvin、ThinkGem + * @version 2022-2-17 */ public class EncodeUtils { @@ -270,7 +271,7 @@ public class EncodeUtils { } if (logger.isInfoEnabled() && !value.equals(oriValue)){ logger.info("xssFilter: {} <=<=<= {} source: {}", value, text, - request != null ? request.getRequestURL() : StringUtils.EMPTY); + request != null ? request.getRequestURL() : "common"); } return value; } @@ -279,16 +280,18 @@ public class EncodeUtils { // 预编译SQL过滤正则表达式 private static Pattern sqlPattern = Pattern.compile( - "(?:')|(?:--)|(/\\*(?:.|[\\n\\r])*?\\*/)|((extractvalue|updatexml|if|mid|database)([\\s]*?)\\()|" - + "(\\b(select|update|and|or|delete|insert|trancate|char|into|substr|ascii|declare|exec|count|master|into|drop|execute|case when|sleep|union|load_file)\\b)", + "(?:')|(?:--)|(/\\*(?:.|[\\n\\r])*?\\*/)|((extractvalue|updatexml|if|mid|database|rand|user)([\\s]*?)\\()|" + + "(\\b(select|update|and|or|delete|insert|trancate|char|into|substr|ascii|declare|exec|count|master|into|" + + "drop|execute|case when|sleep|union|load_file)\\b)", Pattern.CASE_INSENSITIVE); + private static Pattern orderByPattern = Pattern.compile("[a-z0-9_\\.\\, ]*", Pattern.CASE_INSENSITIVE); /** * SQL过滤，防止注入，传入参数输入有select相关代码，替换空。 * @author ThinkGem */ public static String sqlFilter(String text){ - return sqlFilter(text, null); + return sqlFilter(text, "common"); } /** * SQL过滤，防止注入，传入参数输入有select相关代码，替换空。 @@ -297,9 +300,16 @@ public class EncodeUtils { public static String sqlFilter(String text, String source){ if (text != null){ String value = text; - Matcher matcher = sqlPattern.matcher(value); - if (matcher.find()) { - value = matcher.replaceAll(StringUtils.EMPTY); + if ("orderBy".equals(source)) { + Matcher matcher = orderByPattern.matcher(value); + if (!matcher.matches()) { + value = StringUtils.EMPTY; + } + } else { + Matcher matcher = sqlPattern.matcher(value); + if (matcher.find()) { + value = matcher.replaceAll(StringUtils.EMPTY); + } } if (logger.isWarnEnabled() && !value.equals(text)){ logger.info("sqlFilter: {} <=<=<= {} source: {}", value, text, source); @@ -310,38 +320,38 @@ public class EncodeUtils { return null; } - public static void main(String[] args) { - int i = 0; -// xssFilter((++i)+"你好，我还在。"); -// xssFilter((++i)+"你好，加粗文字我还在。"); -// xssFilter(""+(++i)+"你好，\">加粗文字我还在。"); -// xssFilter(""+(++i)+"你好，加粗文字我还在。"); -// xssFilter(""+(++i)+"你好，我还在。"); -// xssFilter(""+(++i)+"你好，eval(abc)我还在。"); -// xssFilter(""+(++i)+"你好，xpression(abc)我还在。"); -// xssFilter(""+(++i)+"你好，我还在。"); -// xssFilter(""+(++i)+"你好，我还在。"); -// xssFilter(""+(++i)+"你好，我还在。"); -// xssFilter(""+(++i)+"你好，hello我还在。"); -// xssFilter(""+(++i)+"你好，hello我还在。"); -// xssFilter(""+(++i)+"你好，hello我还在。"); -// xssFilter(""+(++i)+"你好，hello我还在。"); -// xssFilter(""+(++i)+"你好，hello我还在。"); -// xssFilter(""+(++i)+"你好，?abc=def&hello=123&world={\"a\":1}我还在。"); -// xssFilter(""+(++i)+"你好，?abc=def&hello=123&world={'a':1}我还在。"); - sqlFilter((++i)+"你好，select * from xxx where abc=def and 1=1我还在。"); - sqlFilter((++i)+"你好，insert into xxx values(1,2,3,4,5)我还在。"); - sqlFilter((++i)+"你好，delete from xxx我还在。"); - sqlFilter((++i)+"你好，a.audit_result asc,case when 1 like case when length(database())=6 then 1 else exp(11111111111111111) end then 1 else 1/0 end"); - sqlFilter((++i)+"你好，if(1=2,1,SLEEP(10))"); - } +// public static void main(String[] args) { +// xssFilter("1 你好 我还在。"); +// xssFilter("2 你好 加粗文字我还在。"); +// xssFilter("3 你好 \">加粗文字我还在。"); +// xssFilter("4 你好 加粗文字我还在。"); +// xssFilter("5 你好 我还在。"); +// xssFilter("14 你好 eval(abc)我还在。"); +// xssFilter("15 你好 xpression(abc)我还在。"); +// xssFilter("16 你好 我还在。"); +// xssFilter("17 你好 我还在。"); +// xssFilter("18 你好 我还在。"); +// xssFilter("19 你好 hello我还在。"); +// xssFilter("20 你好 hello我还在。"); +// xssFilter("21 你好 hello我还在。"); +// xssFilter("22 你好 hello我还在。"); +// xssFilter("23 你好 hello我还在。"); +// xssFilter("24 你好 ?abc=def&hello=123&world={\"a\":1}我还在。"); +// xssFilter("25 你好 ?abc=def&hello=123&world={'a':1}我还在。"); +// sqlFilter("1 你好 select * from xxx where abc=def and 1=1我还在。"); +// sqlFilter("2 你好 insert into xxx values(1,2,3,4,5)我还在。"); +// sqlFilter("3 你好 delete from xxx我还在。"); +// sqlFilter("4 a.audit_result asc,case when 1 like case when length(database())=6 then 1 else exp(111) end then 1 else 1/0 end", "orderBy"); +// sqlFilter("5 if(1=2,1,SLEEP(10)), if(mid(database(),{},1)=\\\"{}\\\",a.id,a.login_name)", "orderBy"); +// sqlFilter("6 a.audit_result asc, b.audit_result2 desc, b.AuditResult3 desc", "orderBy"); +// } }