struts2 高危漏洞修复

最新推荐文章于 2022-07-14 09:51:12 发布

原创最新推荐文章于 2022-07-14 09:51:12 发布 · 253 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#java

java 专栏收录该内容

61 篇文章

订阅专栏

本文介绍了一种自定义的Servlet过滤器实现方法，该过滤器用于拦截特定URL请求并进行安全检查。当请求的URL包含预设的敏感字符串时，过滤器将拒绝访问并返回403状态码。


 /**
     * 过滤器
     */
    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain)
        throws IOException, ServletException
    {

        HttpServletRequest request = (HttpServletRequest)req;
        String url = request.getQueryString();


        if (StringUtils.isEmpty(url) || !pattern.matcher(URLDecoder.decode(url, "utf-8")).matches())
        {
            chain.doFilter(req, resp);
        }
        else
        {
            HttpServletResponse res = (HttpServletResponse)resp;
            res.setStatus(403);
            res.getOutputStream().write("403".getBytes());
            res.getOutputStream().close();
            return;
        }
    }
// 初始化
    public void init(FilterConfig cfg)
        throws ServletException
    {

        String redirects= (new StringBuilder(".*(")).append(cfg.getInitParameter("redirects"))
            .append(").*")
            .toString();
        pattern = Pattern.compile(redirects);
    }
    private Pattern pattern;

2.web.xml


<filter>
       <filter-name>SafeFilter</filter-name>
       <filter-class>com.SafeFilter</filter-class>
       <init-param>
           <param-name>redirects</param-name>
           <param-value>redirect:|action:|redirectAction:</param-value>
       </init-param>
</filter>
<filter-mapping>
       <filter-name>SafeFilter</filter-name>
       <url-pattern>/*</url-pattern>
</filter-mapping>