Java恶意请求案例如何拦截

wen java案例 2026-06-28 273

本文目录导读：

Java恶意请求案例如何拦截

SQL注入攻击
XSS跨站脚本攻击
CSRF跨站请求伪造
文件上传攻击
SSRF服务端请求伪造
综合拦截方案 - 使用过滤器
推荐的安全框架

针对Java应用中的恶意请求拦截,以下是一些常见的案例和对应的拦截方案：

SQL注入攻击

案例

// 恶意请求：?id=1 OR 1=1
String id = request.getParameter("id");
String sql = "SELECT * FROM users WHERE id = " + id; // 危险！

拦截方案

// 使用预编译语句（推荐）
String sql = "SELECT * FROM users WHERE id = ?";
PreparedStatement pstmt = conn.prepareStatement(sql);
pstmt.setString(1, id);
// 或使用参数化查询框架
// MyBatis：#{id} 而不是 ${id}

XSS跨站脚本攻击

案例

// 恶意请求：?name=<script>alert('xss')</script>
String name = request.getParameter("name");
response.getWriter().write("Hello " + name); // 危险！

拦截方案

// 1. HTML转义
String safeName = StringEscapeUtils.escapeHtml4(name);
// 2. 使用Spring框架的输入过滤
@Component
public class XssFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                         FilterChain chain) {
        chain.doFilter(new XssHttpServletRequestWrapper(request), response);
    }
}
// 3. 使用ESAPI库
String safeInput = ESAPI.encoder().encodeForHTML(input);

CSRF跨站请求伪造

案例

// 恶意网站发起转账请求
// <img src="http://bank.com/transfer?to=hacker&amount=10000">

拦截方案

// 1. Token验证
@Controller
public class TransferController {
    @PostMapping("/transfer")
    public String transfer(@RequestParam String token) {
        if (!validateToken(token)) {
            throw new SecurityException("CSRF攻击");
        }
        // 处理转账
    }
}
// 2. Spring Security配置
http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());

文件上传攻击

案例

// 上传恶意JSP文件或超大文件
MultipartFile file = request.getFile("file");
file.transferTo(new File("/upload/" + file.getOriginalFilename())); // 危险！

拦截方案

// 1. 文件类型检查
String[] allowedTypes = {"jpg", "png", "pdf"};
String extension = getFileExtension(file.getOriginalFilename());
if (!Arrays.asList(allowedTypes).contains(extension)) {
    throw new SecurityException("不允许的文件类型");
}
// 2. 文件内容检测（绕过扩展名检查）
String mimeType = Files.probeContentType(file.toPath());
if (!"image/jpeg".equals(mimeType)) {
    throw new SecurityException("文件内容不匹配");
}
// 3. 大小限制
if (file.getSize() > 10 * 1024 * 1024) { // 10MB
    throw new SecurityException("文件过大");
}

SSRF服务端请求伪造

案例

// 恶意请求：?url=http://internal-service/admin
String url = request.getParameter("url");
URLConnection connection = new URL(url).openConnection(); // 危险！

拦截方案

// 1. IP白名单
private boolean isAllowedHost(String host) {
    List<String> allowedHosts = Arrays.asList("api.example.com", "trusted-api.com");
    return allowedHosts.contains(host);
}
// 2. 禁止内网IP
private boolean isInternalIP(String ip) {
    return ip.startsWith("10.") || ip.startsWith("172.16.") 
           || ip.startsWith("192.168.") || ip.equals("127.0.0.1");
}
// 3. 使用URL白名单
if (!url.startsWith("https://trusted-domain.com/")) {
    throw new SecurityException("不允许的URL");
}

综合拦截方案 - 使用过滤器

@WebFilter("/*")
@Component
public class SecurityFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                         FilterChain chain) {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        // 1. 请求频率限制
        RateLimiter rateLimiter = new RateLimiter();
        if (!rateLimiter.tryAcquire(httpRequest.getRemoteAddr())) {
            response.setStatus(429); // Too Many Requests
            return;
        }
        // 2. 输入验证
        String queryString = httpRequest.getQueryString();
        if (containsSQLInjection(queryString) || containsXSS(queryString)) {
            response.setStatus(400); // Bad Request
            return;
        }
        // 3. 路径遍历防护
        String requestURI = httpRequest.getRequestURI();
        if (requestURI.contains("..") || requestURI.contains("//")) {
            response.setStatus(400);
            return;
        }
        chain.doFilter(request, response);
    }
    private boolean containsSQLInjection(String input) {
        // 简单的SQL注入检测
        String[] patterns = {"'", "\"", "--", ";", "/*", "*/", "union", "select"};
        for (String pattern : patterns) {
            if (input.toLowerCase().contains(pattern)) {
                return true;
            }
        }
        return false;
    }
    private boolean containsXSS(String input) {
        // XSS检测
        String[] patterns = {"<script>", "<iframe>", "onerror=", "onload=", "javascript:"};
        for (String pattern : patterns) {
            if (input.toLowerCase().contains(pattern)) {
                return true;
            }
        }
        return false;
    }
}

推荐的安全框架

<!-- pom.xml 依赖 -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>org.owasp.encoder</groupId>
    <artifactId>encoder</artifactId>
    <version>1.2.3</version>
</dependency>
<dependency>
    <groupId>com.google.guava</groupId>
    <artifactId>guava</artifactId>
    <version>32.0.1-jre</version> <!-- RateLimiter -->
</dependency>