URL存在http host头攻击漏洞-修复方案

URL存在http host头攻击漏洞-修复方案

spring boot使用注解的方式 --

第一步：在自定义filter类上添加如下注释

package com.cmcc.hy.mobile.config;
 
import java.io.IOException;
import java.util.Arrays;
import java.util.List;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Value;
 
/**
 * @author wangzhengrong
 * @date 2019/1/22 11:09
 */
@WebFilter(filterName = "otherFilter")
public class HostFilter implements Filter {
 
  /**
   * 自定义实现host白名单添加
   */
  @Value("${ALLOWED_SERVERNAMES}")
  private String ALLOWED_SERVERNAMES;
 
  @Override
  public void init(FilterConfig filterConfig) throws ServletException {
//    System.out.println("Filter初始化中");
  }
 
  /**
   * host拦截
   */
  @Override
  public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
      FilterChain filterChain) throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) servletRequest;
    HttpServletResponse response = (HttpServletResponse) servletResponse;
//    String host = request.getHeader("host");
    String serverName = request.getServerName();
    System.out.println("serverName-debug:" + serverName);
    if (!isEmpty(serverName)) {
      if (checkBlankList(serverName)) {
        filterChain.doFilter(servletRequest, servletResponse);
      } else {
        System.out.println("[serverName deny access tips]->" + serverName);
//        response.getWriter().print("host deny");
        response.setStatus(403);
        response.flushBuffer();
      }
    } else {
      filterChain.doFilter(servletRequest, servletResponse);
    }
 
  }
 
  @Override
  public void destroy() {
//    System.out.println("Filter销毁");
  }
 
  /**
   * 校验当前host是否在白名单中
   */
  private boolean checkBlankList(String serverName) {
    String[] allowdServerName = ALLOWED_SERVERNAMES.split(",");
    List<String> serverNameList = Arrays.asList(allowdServerName);
    for(String str : serverNameList){
      if(!isEmpty(str) && str.equals(serverName)){
        return true;
      }
    }
    return false;
  }
 
  /**
   * 判空
   */
  public boolean isEmpty(Object str) {
    return str == null || "".equals(str);
  }
 
}

第二步：还需要在启动类上添加注释 @ServletComponentScan，以确保能扫描的Filter类，当然也可以指定该注解的basePackages属性。这里需要注意的是，使用这种方式时，不能像第一种方式那样指定filter顺序，使用Order注解也无效