安全漏洞扫描，风险原因分析及解决方案

request.getSession().invalidate() ;         //清空session 

if (request.getCookies()!=null) { 
   Cookie cookie = request.getCookies()[0];     // 获取cookie 
   cookie.setMaxAge(0);                    // 让cookie过期 
} 

statement := "SELECT * FROM users WHERE name = ‘" + userName + "‘; " 

SELECT * FROM DATA WHERE id = 1; DROP TABLE users; 

SELECT booktitle FROM booklist WHERE bookId = ‘OOk14cd‘ AND 1=1 

SELECT 1/0 FROM users WHERE username=‘Ralph‘

PreparedStatement prep = conn.prepareStatement("SELECT * FROM USERS WHERE PASSWORD=?"); 

prep.setString(1, pwd); 

package com.apusic.portal.sso; 
import java.io.IOException; 
import javax.servlet.Filter; 
import javax.servlet.FilterChain; 
import javax.servlet.FilterConfig; 
import javax.servlet.ServletException; 
import javax.servlet.ServletRequest; 
import javax.servlet.ServletResponse; 
import javax.servlet.http.*; 
import java.util.*; 
/** 
* Servlet Filter implementation class SqlEscapeFilter 
*/ 
public class SqlEscapeFilter implements Filter { 
    /** 
     * Default constructor. 
     */ 
    public SqlEscapeFilter() { 
        // TODO Auto-generated constructor stub 
    } 
    /** 
     * @see Filter#destroy() 
     */ 
    public void destroy() { 
        // TODO Auto-generated method stub 
    } 
    /** 
     * @see Filter#doFilter(ServletRequest, ServletResponse, FilterChain) 
     */ 
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { 
        // TODO Auto-generated method stub 
        // place your code here 
        HttpServletRequest hreq = (HttpServletRequest)request; 
        Map map = hreq.getParameterMap(); 
        Iterator itr = map.keySet().iterator(); 
        while( itr.hasNext() ) 
        { 
            String key = itr.next().toString(); 
            String [] values = hreq.getParameterValues(key); 
            if( values != null ) 
            { 
                for( int i = 0; i < values.length; i++ ) 
                { 
                    values[i] = cleanXSS(values[i]); 
                } 
            } 
            hreq.setAttribute(key, values); 
        } 
        // pass the request along the filter chain 
        chain.doFilter(request, response); 
    } 
    /** 
     * @see Filter#init(FilterConfig) 
     */ 
    public void init(FilterConfig fConfig) throws ServletException { 
        // TODO Auto-generated method stub 
    } 
    private String cleanXSS(String value) 
    { 
        value = value.replaceAll("<", "& lt;").replaceAll(">", "& gt;"); 
        value = value.replaceAll("\\(", "& #40;").replaceAll("\\)", "&#41;"); 
        value = value.replaceAll("‘", "& #39;"); 
        value = value.replaceAll("eval\\((.*)\\)", ""); 
        value = value.replaceAll("[\\\"\\\‘][\\s]*javascript:(.*)[\\\"\\\‘]", "\"\""); 
        value = value.replaceAll("script", ""); 
        return value; 
    } 
} 

<filter> 
     <display-name>SqlEscapeFilter</display-name> 
     <filter-name>SqlEscapeFilter</filter-name> 
     <filter-class>com.apusic.portal.sso.SqlEscapeFilter</filter-class> 
</filter> 
<filter-mapping> 
     <filter-name>SqlEscapeFilter</filter-name> 
     <url-pattern>*.jsp</url-pattern> 
</filter-mapping> 

 <input type="text" id="password1"  style="width:195px; height:25px; line-height:25px;border: solid 1px #89B4D6;color:#999" value="10086密码" onfocus="javascript:clearPass();"  onkeyup="this.value=this.value.replace(/./g,‘*‘);" onkeypress="javascript:hiddenPass()"/> 
     <input id="password" type="hidden" name="password"  class="inputs_dl" value="" /> 
将type为password的改为text,然后用JS做一个假的密码输入框，AppScan会扫描type为password的控件。 
   function hiddenPass(){ 
        var pass = document.getElementById("password1"); 
    var j_pass = document.getElementById("password"); 
      if(event.keyCode==13){ 
      check(); 
      } 
       var keycode=event.keyCode;                 
        var keychar=String.fromCharCode(keycode); 
      j_pass.value=j_pass.value+keychar; 
      j_pass.value=j_pass.value.substring(0,pass.length);    
  } 
    
   function clearPass(){ 
       $("#password1").val(""); 
       $("#password").val(""); 
  } 

password = base64encode(password); 

1.    <?xml version="1.0" encoding="UTF-8"?> 
2.    <web-app xmlns="http://java.sun.com/xml/ns/j2ee" 
3.    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
4.    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" 
5.    version="2.4"> 

1.    <security-constraint> 
2.    <web-resource-collection> 
3.    <url-pattern>/*</url-pattern> 
4.    <http-method>PUT</http-method> 
5.    <http-method>DELETE</http-method> 
6.    <http-method>HEAD</http-method> 
7.    <http-method>OPTIONS</http-method> 
8.    <http-method>TRACE</http-method> 
9.    </web-resource-collection> 
10.    <auth-constraint> 
11.    </auth-constraint> 
12.    </security-constraint> 
13.    <login-config> 
14.    <auth-method>BASIC</auth-method> 
15.    </login-config> 

 response.setHeader("Cache-Control", "no-cache"); //只是请求或响应消息不缓存 
  response.setHeader("Cache-Control", "no-store"); //在请求消息中发送将使得请求和响应消息都不使用缓存                                                                                            
response.setDateHeader("Expires", 0); //缓存距离过期的时间为0毫秒，即缓存立即过期 
  response.setHeader("Pragma", "no-cache"); //页面不缓存 

<html><head><title>Apache Tomcat/5.5.28 - Error report</title><style><!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 500 - </h1><HR size="1" noshade="noshade"><p><b>type</b> Exception report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>The server encountered an internal error () that prevented it from fulfilling this request.</u></p><p><b>exception</b> <pre>javax.servlet.ServletException: org.hibernate.HibernateException: java.sql.SQLException: ORA-12899: value too large for column &quot;QCSMS&quot;.&quot;T_SYS_LOGON_LOG&quot;.&quot;USER_CODE&quot; (actual: 24, maximum: 20)