Java漏洞防护案例

wen java案例 2026-08-02 221

本文目录导读：

Java漏洞防护案例

项目基础设置
SQL注入防护案例
XSS攻击防护案例
CSRF防护配置
文件上传安全防护
认证与会话安全
输入验证与请求防护
安全API最佳实践
安全日志记录与监控
安全配置检查清单

我将通过一个完整案例展示Java常见漏洞的防护方法,涵盖OWASP Top 10中的关键风险。

项目基础设置

Maven依赖配置

<dependencies>
    <!-- Spring Security -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <!-- 参数校验 -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-validation</artifactId>
    </dependency>
    <!-- 数据库加密 -->
    <dependency>
        <groupId>org.jasypt</groupId>
        <artifactId>jasypt-spring-boot-starter</artifactId>
        <version>3.0.5</version>
    </dependency>
    <!-- XSS过滤 -->
    <dependency>
        <groupId>org.jsoup</groupId>
        <artifactId>jsoup</artifactId>
        <version>1.16.1</version>
    </dependency>
</dependencies>

SQL注入防护案例

不安全示例

// 不安全的SQL拼接
@GetMapping("/user/search")
public List<User> searchUser(String username) {
    String sql = "SELECT * FROM users WHERE username = '" + username + "'";
    return jdbcTemplate.query(sql, userRowMapper);
}

安全防护实现

@Repository
public class UserRepository {
    private final JdbcTemplate jdbcTemplate;
    @Autowired
    public UserRepository(JdbcTemplate jdbcTemplate) {
        this.jdbcTemplate = jdbcTemplate;
    }
    // 安全方式1：使用参数化查询
    public List<User> searchUserSafely(String username) {
        String sql = "SELECT * FROM users WHERE username = ?";
        return jdbcTemplate.query(sql, 
            new Object[]{username}, 
            (rs, rowNum) -> mapUser(rs));
    }
    // 安全方式2：使用JPA
    @Query("SELECT u FROM User u WHERE u.username = :username")
    List<User> findByUsername(@Param("username") String username);
    // 安全方式3：使用NamedParameterJdbcTemplate
    public List<User> searchUserWithNamedParams(String username) {
        String sql = "SELECT * FROM users WHERE username = :username";
        Map<String, Object> params = new HashMap<>();
        params.put("username", username);
        return namedParameterJdbcTemplate.query(sql, params, (rs, rowNum) -> mapUser(rs));
    }
    private User mapUser(ResultSet rs) throws SQLException {
        User user = new User();
        user.setId(rs.getLong("id"));
        user.setUsername(rs.getString("username"));
        return user;
    }
}

XSS攻击防护案例

全局XSS过滤器

@Component
public class XSSFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                         FilterChain chain) throws IOException, ServletException {
        XSSRequestWrapper xssRequestWrapper = new XSSRequestWrapper((HttpServletRequest) request);
        chain.doFilter(xssRequestWrapper, response);
    }
}
// XSS请求包装器
public class XSSRequestWrapper extends HttpServletRequestWrapper {
    public XSSRequestWrapper(HttpServletRequest request) {
        super(request);
    }
    @Override
    public String getParameter(String name) {
        String value = super.getParameter(name);
        return sanitizeInput(value);
    }
    @Override
    public String[] getParameterValues(String name) {
        String[] values = super.getParameterValues(name);
        if (values == null) {
            return null;
        }
        String[] sanitized = new String[values.length];
        for (int i = 0; i < values.length; i++) {
            sanitized[i] = sanitizeInput(values[i]);
        }
        return sanitized;
    }
    // 使用Jsoup进行输入清洗
    private String sanitizeInput(String input) {
        if (input == null) {
            return null;
        }
        // Jsoup清洗HTML
        return Jsoup.clean(input, Safelist.basic());
    }
}

CSRF防护配置

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            .and()
            .headers()
                .frameOptions().deny()
                .xssProtection()
                .and()
                .contentSecurityPolicy("script-src 'self'");
        // 其他安全配置
        http
            .sessionManagement()
            .sessionFixation().newSession()
            .invalidSessionUrl("/login");
    }
}
// 前端配合CSRF Token
@RestController
public class CSRFController {
    @GetMapping("/csrf-token")
    public CsrfToken getCsrfToken(CsrfToken csrfToken) {
        return csrfToken;
    }
}

文件上传安全防护

@Component
public class SafeFileUploadService {
    private static final long MAX_FILE_SIZE = 5 * 1024 * 1024; // 5MB
    private static final Set<String> ALLOWED_EXTENSIONS = 
        Set.of("jpg", "png", "gif", "pdf", "doc", "docx");
    public String uploadFile(MultipartFile file, String uploadDir) {
        // 1. 验证文件大小
        if (file.getSize() > MAX_FILE_SIZE) {
            throw new FileUploadException("文件大小超过限制");
        }
        // 2. 验证文件扩展名
        String originalFilename = file.getOriginalFilename();
        if (originalFilename == null || originalFilename.isEmpty()) {
            throw new FileUploadException("文件名为空");
        }
        String extension = getExtension(originalFilename).toLowerCase();
        if (!ALLOWED_EXTENSIONS.contains(extension)) {
            throw new FileUploadException("不支持的文件类型: " + extension);
        }
        // 3. 验证MIME类型
        String mimeType = file.getContentType();
        if (!isValidMimeType(mimeType, extension)) {
            throw new FileUploadException("MIME类型不匹配");
        }
        // 4. 生成安全的文件名（使用UUID）
        String safeFileName = UUID.randomUUID().toString() + "." + extension;
        // 5. 验证路径安全
        Path uploadPath = Paths.get(uploadDir).toAbsolutePath().normalize();
        File uploadDirectory = uploadPath.toFile();
        if (!uploadDirectory.exists()) {
            uploadDirectory.mkdirs();
        }
        // 6. 保存文件
        try {
            InputStream inputStream = file.getInputStream();
            Path targetPath = uploadPath.resolve(safeFileName);
            // 确保目标路径在允许的目录内
            if (!targetPath.normalize().startsWith(uploadPath)) {
                throw new FileUploadException("非法路径");
            }
            Files.copy(inputStream, targetPath, StandardCopyOption.REPLACE_EXISTING);
            return safeFileName;
        } catch (IOException e) {
            throw new FileUploadException("文件保存失败", e);
        }
    }
    private String getExtension(String filename) {
        int lastDotIndex = filename.lastIndexOf('.');
        if (lastDotIndex >= 0) {
            return filename.substring(lastDotIndex + 1);
        }
        return "";
    }
    private boolean isValidMimeType(String mimeType, String extension) {
        if (mimeType == null) {
            return false;
        }
        Map<String, String> validMimeTypes = Map.of(
            "jpg", "image/jpeg",
            "jpeg", "image/jpeg",
            "png", "image/png",
            "gif", "image/gif",
            "pdf", "application/pdf",
            "doc", "application/msword",
            "docx", "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
        );
        String expectedMimeType = validMimeTypes.get(extension);
        return mimeType.equals(expectedMimeType);
    }
}

认证与会话安全

@Service
public class SecureAuthService {
    private final PasswordEncoder passwordEncoder;
    @Autowired
    public SecureAuthService(PasswordEncoder passwordEncoder) {
        this.passwordEncoder = passwordEncoder;
    }
    // 安全密码存储
    public User registerUser(String username, String password) {
        // 密码强度校验
        if (!isStrongPassword(password)) {
            throw new WeakPasswordException("密码强度不足");
        }
        User user = new User();
        user.setUsername(username);
        // 使用BCrypt加密（自动添加salt）
        user.setPassword(passwordEncoder.encode(password));
        return userRepository.save(user);
    }
    // 登录限流
    public LoginResult login(String username, String password, String ipAddress) {
        // 简单速率限制
        if (!rateLimiter.tryAcquire(ipAddress)) {
            throw new TooManyRequestsException("登录尝试过于频繁");
        }
        Optional<User> user = userRepository.findByUsername(username);
        if (user.isPresent() && passwordEncoder.matches(password, user.get().getPassword())) {
            return LoginResult.success();
        }
        return LoginResult.failed("用户名或密码错误");
    }
    private boolean isStrongPassword(String password) {
        // 至少8位，包含大写、小写、数字和特殊字符
        return password.length() >= 8 &&
               password.matches(".*[A-Z].*") &&
               password.matches(".*[a-z].*") &&
               password.matches(".*\\d.*") &&
               password.matches(".*[!@#$%^&*()].*");
    }
}
@Configuration
public class PasswordConfig {
    @Bean
    public PasswordEncoder passwordEncoder() {
        // BCrypt自带随机salt，是推荐的做法
        return new BCryptPasswordEncoder(12); // 12次哈希
    }
}

输入验证与请求防护

// DTO验证
public class UserInputValidator {
    public static class UserDTO {
        @NotNull(message = "用户名不能为空")
        @Size(min = 3, max = 50, message = "用户名长度必须在3-50之间")
        @Pattern(regexp = "^[a-zA-Z0-9_]+$", message = "用户名只能包含字母、数字和下划线")
        private String username;
        @Email(message = "邮箱格式不正确")
        @NotBlank(message = "邮箱不能为空")
        private String email;
        @Pattern(regexp = "^\\+?[0-9. ()-]{10,25}$", message = "电话号码格式不正确")
        private String phone;
        // getters and setters
    }
}
// 控制器使用
@RestController
public class UserController {
    @PostMapping("/users")
    public ResponseEntity<?> createUser(@Valid @RequestBody UserDTO userDTO) {
        // 业务逻辑
        return ResponseEntity.ok("用户创建成功");
    }
}
// JSON处理时的额外校验
@Configuration
public class JacksonConfig {
    @Bean
    public Jackson2ObjectMapperBuilderCustomizer jsonCustomizer() {
        return builder -> {
            // 防止JSON类型混淆攻击
            builder.deserializerByType(String.class, 
                new JsonDeserializer<String>() {
                    @Override
                    public String deserialize(JsonParser p, DeserializationContext ctxt) 
                        throws IOException {
                        String value = p.getValueAsString();
                        if (value != null && value.length() > 1000) {
                            throw new IOException("输入字符串过长");
                        }
                        return value;
                    }
                });
        };
    }
}

安全API最佳实践

@RestController
@RequestMapping("/secure")
public class SecureAPIController {
    // 1. 统一错误处理
    @ExceptionHandler(Exception.class)
    public ResponseEntity<ErrorResponse> handleException(Exception e) {
        // 日志记录详细错误信息
        log.error("Internal error", e);
        // 只返回通用错误信息给客户端
        return ResponseEntity
            .status(HttpStatus.INTERNAL_SERVER_ERROR)
            .body(new ErrorResponse("服务器内部错误", "请联系管理员"));
    }
    // 2. 敏感信息过滤
    @Jacksonized
    @Data
    public class UserDTO {
        private String username;
        @JsonIgnore
        private String password;  // JSON响应中不显示
        private String email;
    }
    // 3. 安全的CORS配置
    @Bean
    public WebMvcConfigurer corsConfigurer() {
        return new WebMvcConfigurer() {
            @Override
            public void addCorsMappings(CorsRegistry registry) {
                registry.addMapping("/api/**")
                    .allowedOrigins("https://trusted-domain.com")
                    .allowedMethods("GET", "POST")
                    .allowedHeaders("Content-Type", "Authorization")
                    .allowCredentials(true)
                    .maxAge(3600);
            }
        };
    }
    // 4. 安全的文件下载
    @GetMapping("/download/{fileName}")
    public ResponseEntity<Resource> downloadFile(@PathVariable String fileName) {
        // 验证文件名，防止路径遍历
        if (fileName.contains("..") || fileName.contains("/") || fileName.contains("\\")) {
            return ResponseEntity.badRequest().build();
        }
        Path filePath = Paths.get("uploads").resolve(fileName).normalize();
        Resource resource = new FileSystemResource(filePath);
        return ResponseEntity.ok()
            .contentType(MediaType.parseMediaType("application/octet-stream"))
            .header(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=\"" + 
                safeFileName(fileName) + "\"")
            .body(resource);
    }
    private String safeFileName(String originalFileName) {
        // 清理文件名中的特殊字符
        return originalFileName.replaceAll("[^a-zA-Z0-9.-]", "_");
    }
}

安全日志记录与监控

package com.example.security;
@Aspect
@Component
public class SecurityAuditAspect {
    private static final Logger securityLog = 
        LoggerFactory.getLogger("SECURITY_AUDIT");
    @Around("@annotation(AuditTrail)")
    public Object audit(ProceedingJoinPoint joinPoint) throws Throwable {
        // 获取方法参数
        Object[] args = joinPoint.getArgs();
        // 脱敏处理
        Object[] sanitizedArgs = sanitizeArgs(args);
        // 记录请求
        securityLog.info("Security access: method={}, args={}", 
            joinPoint.getSignature(), sanitizedArgs);
        try {
            Object result = joinPoint.proceed();
            // 记录成功响应
            securityLog.info("Operation successful: {}", joinPoint.getSignature());
            return result;
        } catch (Exception e) {
            // 记录失败情况
            securityLog.error("Security violation: {}", 
                joinPoint.getSignature(), e);
            throw e;
        }
    }
    private Object[] sanitizeArgs(Object[] args) {
        // 对敏感数据进行脱敏
        return Arrays.stream(args)
            .map(arg -> {
                if (arg instanceof String && 
                    arg.toString().contains("password")) {
                    return "***";
                }
                return arg;
            })
            .toArray();
    }
}
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface AuditTrail {
    String action() default "";
}

安全配置检查清单

# application.properties 安全配置
# 严格会话管理
server.servlet.session.timeout=30m
server.servlet.session.cookie.http-only=true
server.servlet.session.cookie.secure=true
server.servlet.session.cookie.same-site=lax
# 数据源加密
jasypt.encryptor.password=${ENCRYPTION_KEY}
jasypt.encryptor.algorithm=PBEWithMD5AndDES
# 安全headers
security.headers.cache-control=true
security.headers.x-frame-options=DENY
security.headers.x-content-type-options=nosniff
security.headers.strict-transport-security=max-age=31536000
# 输入验证
spring.mvc.favicon.enabled=false

这个完整案例展示了Java Web应用中的关键安全防护措施，实际项目中需要根据具体需求选择合适的防护方案，并定期进行安全测试和代码审计。

本文地址： https://www.bmjup.com/post/36170.html