shiro安全框架擴充套件教程–如何防止可執行檔案的入侵攻擊

        前面的教程有一章是講解如何突破上傳的,當被人通過上傳功能突破的防線那就杯具了,有點hack知識的人都知道,很多攻擊都是優先尋找上傳的功能,因為能突破

就會剩下很多的功夫,比如hack上傳了一個asp,php或者jsp檔案,然後通過抓包路徑獲取了檔案存放地址,然後直接請求就能通過這個可執行的檔案獲取到資料庫的資訊,

或者是遍歷目錄下載檔案,尋找檔案中的其他漏洞以獲得更高的許可權,下面我就演示下簡單的防範手段,就算被突破了上傳也會有下一堵牆在一定程度上防止執行指令碼

我主要是使用shiro寫了一個filter過濾需要請求資訊,如遇到黑名單則記錄資訊,看下面貼的程式碼

package com.silvery.security.shiro.filter;

import java.text.SimpleDateFormat;
import java.util.Date;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import org.apache.shiro.web.filter.authz.AuthorizationFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.silvery.utils.PatternUtils;
import com.silvery.utils.WebUtils;

/**
 * 
 * 黑名單可執行程式請求過濾器
 * 
 * @author shadow
 * 
 */
public class SimpleExecutiveFilter extends AuthorizationFilter {

	protected static final String[] blackUrlPathPattern = new String[] { "*.aspx*", "*.asp*", "*.php*", "*.exe*",
			"*.jsp*", "*.pl*", "*.py*", "*.groovy*", "*.sh*", "*.rb*", "*.dll*", "*.bat*", "*.bin*", "*.dat*",
			"*.bas*", "*.c*", "*.cmd*", "*.com*", "*.cpp*", "*.jar*", "*.class*", "*.lnk*" };

	private static final Logger log = LoggerFactory.getLogger(SimpleExecutiveFilter.class);

	@Override
	protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object obj) throws Exception {

		HttpServletRequest httpRequest = (HttpServletRequest) request;

		String reqUrl = httpRequest.getRequestURI().toLowerCase().trim();

		for (String pattern : blackUrlPathPattern) {
			if (PatternUtils.simpleMatch(pattern, reqUrl)) {
				log.error(new StringBuffer().append("unsafe request >>> ").append(" request time: ").append(
						new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(new Date())).append("; request ip: ")
						.append(WebUtils.getClientIP()).append("; request url: ").append(httpRequest.getRequestURI())
						.toString());
				return false;
			}
		}

		return true;

	}

}

下一步把剛剛寫的過濾器配置到shiro的過濾鏈中

<!-- 過濾鏈配置 -->
	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
		<property name="securityManager" ref="securityManager" />
		<property name="loginUrl" value="/" />
		<property name="successUrl" value="/cms/index.do" />
		<property name="unauthorizedUrl" value="/static/unauthorized.html" />
		<property name="filters">
			<map>
				<entry key="role">
					<bean
						class="com.silvery.security.shiro.filter.SimpleRoleAuthorizationFilter" />
				</entry>
				<entry key="authc">
					<bean
						class="com.silvery.security.shiro.filter.SimpleFormAuthenticationFilter" />
				</entry>
				<entry key="exec">
					<bean class="com.silvery.security.shiro.filter.SimpleExecutiveFilter" />
				</entry>
			</map>
		</property>
	</bean>

最後配置下我們需要過濾的請求目錄,一般都是全量過濾,但是有些靜態資源是不應該過濾的,所以應該注意順序,讓anon許可權的放到放到exec的前面

<!-- 許可權資源配置 -->
	<bean id="filterChainDefinitionsService"
		class="com.silvery.security.shiro.service.impl.SimpleFilterChainDefinitionsService">
		<property name="definitions">
			<value>
				/static/** = anon
				/** = exec
			</value>
		</property>
	</bean>

最後請求下php,jsp等那些檔案是返回到無許可權的頁面,我們的簡單防範已經達到目的了,下一章節可能講如何防範xss和csrf攻擊的防範