Java Web: Proactive and passive way to detect secure frameworks

For some sensitive systems such as payments, transactions need to be reinforced, it is necessary to take into account possible attack situations to prevent, so there is such a simple security framework. In the code of the predecessor (see: http://blog.csdn.net/zhongweijian/article/details/8680737) I greatly refactor to better understand Java Web security implementation measures.

Source code: Http://git.oschina.net/sp42/ajaxjs/tree/master/ajaxjs-security?dir=1&filepath=ajaxjs-security

The framework adds some input and output filtering based on the Sevlet filter and several httpservletrequest/httpservletresponse overrides. The following table shows which attacks can be supported.

function	corresponding class name	Load Mode	Init-param
XSS filtering	Com.ajaxjs.web.security.wrapper.xss_request/xss_response	Wrapper	Enablexssfilter
Header CLRF Filter	Com.ajaxjs.web.security.wrapper.CLRF_Response	Wrapper	Enableclrf_filter
Cookie Key verification and size verification	Com.ajaxjs.web.security.wrapper.cookierequest/cookieresponse	Wrapper	Cookiewhitelist (Configure white list)
File Upload suffix verification	Com.ajaxjs.web.security.wrapper.UploadRequest	Wrapper	Uploadfilewhitelist (Configure white list)
CSRF attack	Com.ajaxjs.web.security.filter.CSRF	Filter	Encrycookiekey (config key)
Session is stored in a cookie via encryption	Com.ajaxjs.web.security.filter.EncrySessionInCookie	Filter	Encrycookiekey (config key)
POST Whitelist/blacklist mechanism verification	Com.ajaxjs.web.security.filter.Post	Filter	Postwhitelist/postblacklist (Configure Whitelist/blacklist)
Referer Route Detection	Com.ajaxjs.web.security.filter.RefererFilter	Filter	Refererfilter (config key)

All detections are handled by Configloader for read configuration and startup. Whether or not a feature is started depends on whether it is configured or not, and if so, the function point takes effect and is not enabled. The Init-param on the table corresponds to what is configured in Web. Xml.

Load mode refers to the active detection in the filter, generally the execution of the check () method, the incoming request/response can be, and wrapper refers to the passive way detection, filtering, specifically, the Java API way to cover to include detection means, similar to the design mode Te The Mplate template method allows the caller to add new logic without changing the API. In particular, you can learn about the Httpservletrequestwrapper/httpservletresponsewrapper two native APIs.

How to use: Introduce a JAR package and add the Web. XML configuration.

[HTML]View Plaincopy print?

2. <!--Defense--
4. <filter>
6. <filter-name>securityfilter</filter-name>
8. <filter-class>com.ajaxjs.web.security.configloader</filter-class>
12. <!--whether to start XSS filtering --
14. <init-param>
16. <param-name>enablexssfilter</param-name>
18. <param-value>true</param-value>
20. </init-param>
24. <!--whether to start CLRF filter --
26. <init-param>
28. <param-name>enableclrf_filter</param-name>
30. <param-value>true</param-value>
32. </init-param>
36. <!--Session is stored encrypted to a cookie --
38. <init-param>
40. <param-name>encrycookiekey</param-name>
42. <param-value>1234567887654321</param-value>
44. </init-param>
48. <!--Cookies White list mechanism verification and size verification --
50. <init-param>
52. <param-name>cookiewhitelist</param-name>
54. <param-value>id,jessionid,name,clrf</param-value>
56. </init-param>
60. <!--file Upload suffix white list filter --
62. <init-param>
64. <param-name>uploadfilewhitelist</param-name>
66. <param-value>jpg,png,doc,xls</param-value>
68. </init-param>
72. <!--CSRF attack filter --
74. <init-param>
76. <param-name>csrf_filter</param-name>
78. <param-value>true</param-value>
80. </init-param>
84. <!--POST Whitelist/blacklist mechanism validation (regular match supported)--
86. <init-param>
88. <param-name>postwhitelist</param-name>
90. <param-value>/d/sssecurity,/user/aaa/name*</param-value>
92. </init-param>
94. <init-param>
96. <param-name>postblacklist</param-name>
98. <param-value>true</param-value>
100. </init-param>
104. <!--Configure Security exception after the jump URL parameter --
106. <init-param>
108. <param-name>redirecturlt</param-name>
110. <param-value>http://localhost:8080/[0-9a-za-z]*,http://www.taobao.com/[0-9a-za-z]*</ param-value>
112. </init-param>
114. </filter>
118. <filter-mapping>
120. <filter-name>securityfilter</filter-name>
122. <url-pattern>/*</url-pattern>
124. </filter-mapping>
126. <!--//-

<!--defense--><filter><filter-name>securityfilter</filter-name><filter-class> com.ajaxjs.web.security.configloader</filter-class><!--Whether to start XSS filtering--><init-param>< Param-name>enablexssfilter</param-name><param-value>true</param-value></init-param> <!--whether to start CLRF filter--><init-param><param-name>enableclrf_filter</param-name><param-value >true</param-value></init-param><!--Session encrypted to Cookie--><init-param>< param-name>encrycookiekey</param-name><param-value>1234567887654321</param-value></ init-param><!--Cookies white list mechanism validation and size verification--><init-param><param-name>cookiewhitelist</ param-name><param-value>id,jessionid,name,clrf</param-value></init-param><!--file upload suffix white list Filter--><init-param><param-name>uploadfilewhitelist</param-name><param-value>jpg,png, Doc,xls</param-value></init-param><!--CSRF Attack filter--><init-param><param-name>csrf_filter</param-name>< param-value>true</param-value></init-param><!--POST Whitelist/blacklist mechanism validation (regular match support)--><init-param ><param-name>postwhitelist</param-name><param-value>/d/sssecurity,/user/aaa/name*</ param-value></init-param><init-param><param-name>postblacklist</param-name>< param-value>true</param-value></init-param><!--Configure Security exception after the jump URL parameter--><init-param ><param-name>redirecturlt</param-name><param-value>http://localhost:8080/[0-9a-za-z]*, Http://www.taobao.com/[0-9a-za-z]*</param-value></init-param></filter><filter-mapping> <filter-name>securityfilter</filter-name><url-pattern>/*</url-pattern></ filter-mapping><!--//-

Specific defense principles can be found in my previous blog "Network Information system security detection scheme design (upper and lower)".

It is important to note that SQL injection is not considered in this scenario because SQL injection is done at the DAO level.

Java Web: Proactive and passive way to detect secure frameworks