检测到目标URL存在http host头攻击漏洞

host：服务器的ip+端口
一.代码的方式
1.加过滤器，过滤掉非本机的ip

package com.nl.controller.common.filter;

import lombok.extern.slf4j.Slf4j;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.ArrayList;
import java.util.List;

/**
 * TODO host
 *
 * @author songtianxiong
 * @version 1.0
 * @date 2022/4/27 14:10
 */
@Slf4j
public class HostFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        HttpServletResponse httpServletResponse = (HttpServletResponse) response;

        // 头攻击检测  过滤主机名
        String requestHost = httpServletRequest.getHeader("host");
        if (requestHost != null && !checkBlankList(requestHost)) {
            httpServletResponse.setStatus(403);
            return;
        }
        chain.doFilter(request, response);
    }

    @Override
    public void destroy() {

    }

    //判断主机是否存在白名单中
    private boolean checkBlankList(String host) {
        log.info("host地址{}", host);
        List<String> serverWhiteHost = new ArrayList<>();
        serverWhiteHost.add("localhost:8083");
        serverWhiteHost.add("127.0.0.1:8083");
        serverWhiteHost.add("xxx.xxx.xxx.xxx:8083");
//        log.info("配置白名单{}", serverWhiteHost.toString());

        if (serverWhiteHost == null || serverWhiteHost.size() == 0) {
            return true;
        }
        for (String str : serverWhiteHost) {
            if (str != null && str.equals(host)) {
                return true;
            }
        }
        return false;
    }
}

2.配置过滤器初始化

package com.nl.controller.common.config;

import com.nl.controller.common.filter.HostFilter;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

/**
 * TODO
 *
 * @author songtianxiong
 * @version 1.0
 * @date 2022/4/27 14:22
 */
@Configuration
public class FilterConfig {
    @Bean
    public FilterRegistrationBean registrationBean() {
        FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean(new HostFilter());
        filterRegistrationBean.addUrlPatterns("/*");
        // 指定过滤器顺序，数值越小越先执行
        filterRegistrationBean.setOrder(1);
        return filterRegistrationBean;
    }
}

二。nginx方式

!~:不等于
*：任意字符
^XXXX$：前尾固定
^:固定开头
$:固定结尾