Web漏洞处理--http host头攻击漏洞处理方案/检测到目标URL存在宽字节跨站漏洞/ 检测到目标URL存在SQL注入漏洞

1.配置web 拦截器 <filter>
<filter-name>XssSqlFilter</filter-name>
<filter-class>com.modules.sys.security.SessionFilter</filter-class> //拦截器的位置
</filter>
<filter-mapping>
<filter-name>XssSqlFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>2.拦截器代码package com.todaytech.yth.gdsd.base.Filter;

import java.io.IOException;
import java.util.Iterator;
import java.util.Map;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang.StringUtils;
import org.apache.log4j.Logger;

public class SessionFilter implements Filter {
private static Logger log = Logger.getLogger(SessionFilter.class);

public void destroy() { }

public void doFilter(ServletRequest servletRequest,
ServletResponse servletResponse, FilterChain filterChain)
throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) servletRequest;
HttpServletResponse response = (HttpServletResponse) servletResponse;
String requestStr = getRequestString(request);
System.out.println("requestStr： ======================== " + requestStr);
System.out.println("完整的地址是====" + request.getRequestURL().toString());
System.out.println("提交的方式是========" + request.getMethod());
log.info("requestStr： ======================== " + requestStr);
log.info("完整的地址是====" + request.getRequestURL().toString());
log.info("提交的方式是========" + request.getMethod());

if ("bingo".equals(guolv2(requestStr))
|| "bingo".equals(guolv2(request.getRequestURL().toString()))) {
System.out.println("======访问地址发现非法字符，已拦截======");
log.info("======访问地址发现非法字符，已拦截======其非法地址为："+guolv2(request.getRequestURL().toString()));
response.sendRedirect(request.getContextPath() + "/login.jsp");
return;
}
// 主机ip和端口 或 域名和端口
String myhosts = request.getHeader("host");
if (!StringUtils.equals(myhosts, "xx.xx.xxx.xxx:xxxx")
&& !StringUtils.equals(myhosts, "xx.xx.xxx.xxx:xxxx")
&& !StringUtils.equals(myhosts, "xx.xx.xxx.xxx:xxxx")
&& !StringUtils.equals(myhosts, "xx.xx.xxx.xxx")
&& !StringUtils.equals(myhosts, "xx.xx.xxx.xxx")
&& !StringUtils.equals(myhosts, "xx.xx.xxx.xxx")) {
System.out.println("======访问host非法，已拦截======其非法host为:"+myhosts);
log.info("======访问host非法，已拦截======其非法host为:"+myhosts);
response.sendRedirect(request.getContextPath() + "/login.jsp"); //或者response.setStatus(403);
return;
}

String currentURL = request.getRequestURI();
// add by wangsk 过滤请求特殊字符，扫描跨站式漏洞
Map parameters = request.getParameterMap();
if (parameters != null && parameters.size() > 0) {
for (Iterator iter = parameters.keySet().iterator(); iter.hasNext();) {
String key = (String) iter.next();
String[] values = (String[]) parameters.get(key);
for (int i = 0; i < values.length; i++) {
values[i] = guolv(values[i]);
System.out.println(values[i]);
}
}
}
     filterChain.doFilter(servletRequest, servletResponse);return;
}

public void init(FilterConfig filterConfig) throws ServletException {

}

public static String guolv(String a) {
a = a.replaceAll("%22", "");
a = a.replaceAll("%27", "");
a = a.replaceAll("%3E", "");
a = a.replaceAll("%3e", "");
a = a.replaceAll("%3C", "");
a = a.replaceAll("%3c", "");
a = a.replaceAll("<", "");
a = a.replaceAll(">", "");
a = a.replaceAll("\"", "");
a = a.replaceAll("'", "");
a = a.replaceAll("\\+", "");
a = a.replaceAll("\\(", "");
a = a.replaceAll("\\)", "");
a = a.replaceAll(" and ", "");
a = a.replaceAll(" or ", "");
a = a.replaceAll(" 1=1 ", "");
return a;
}

private String getRequestString(HttpServletRequest req) {
String requestPath = req.getServletPath().toString();
String queryString = req.getQueryString();
if (queryString != null)
return requestPath + "?" + queryString;
else
return requestPath;
}

public String guolv2(String a) {
if (StringUtils.isNotEmpty(a)) {
if (a.contains("%22") || a.contains("%3E") || a.contains("%3e")
|| a.contains("%3C") || a.contains("%3c")
|| a.contains("<") || a.contains(">") || a.contains("\"")
|| a.contains("'") || a.contains("+") || /*
* a.contains("%27")
* ||
*/
a.contains(" and ") || a.contains(" or ")
|| a.contains("1=1") || a.contains("(") || a.contains(")")) {
return "bingo";
}
}
return a;
}

}