SQL注入，跨站脚本攻击(XSS)，跨站请求伪造（CSRF）
ApiRequestGlobalFilter api请求全局过滤器
ApiRequestXssSqllFilter api请求XssSql过滤器
ApiResponseGlobalFilter api返回全部过滤器
VerifyCondition 验证
CorsConfigration 跨域配置
WhiteListProperties 白名单配置
ManageGatewayProperties 网关配置
Exception
error 处理
jsonException 处理
package com.box.manage.gateway.filter;
import com.box.common.core.constant.RequestConstant;
import com.box.common.core.enums.ErrorCodeEnum;
import com.box.common.core.exception.AuthException;
import com.box.common.core.utils.GatewayUtils;
import com.box.common.core.utils.JwtUtils;
import com.box.common.core.utils.StringUtils;
import com.box.redis.service.RedisService;
import io.jsonwebtoken.Claims;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.core.Ordered;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.stereotype.Component;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;
import javax.annotation.Resource;
import java.io.UnsupportedEncodingException;
import java.net.URLEncoder;
import java.util.function.Consumer;
/**
* 授权认证 https://blog.csdn.net/zzxzzxhao/article/details/83381876
*
* @author yuan.dingwang
* @date 2020年11月26日 15:53
*/
@Slf4j
@Component
class ApiRequestGlobalFilter implements GlobalFilter, Ordered {
final static String METHOD = "POST";
@Autowired
RedisService redisService;
@Resource
VerifyCondition verify;
@Override
public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
String token = exchange.getRequest().getHeaders().getFirst(RequestConstant.HEADER_ACCESS_TOKEN);
log.info("ApiRequestGlobalFilter token:{}",token);
//platform用于区分不同的端
String platform = exchange.getRequest().getHeaders().getFirst(RequestConstant.HEADER_PLATFORM);
if (StringUtils.isBlank(platform)) {
platform = exchange.getRequest().getQueryParams().getFirst(RequestConstant.HEADER_PLATFORM);
}
String requestUrl = exchange.getRequest().getPath().toString();
String subject = "";
//回调地址直接过滤
if (requestUrl.contains("/v2/api-docs") || requestUrl.contains("/threeParties/notice/")) {
Consumer<HttpHeaders> headersConsumer = httpHeaders -> {
httpHeaders.set(RequestConstant.HEADER_SAFETY_LABEL_NAME,RequestConstant.HEADER_SAFETY_LABEL_VAL);
// httpHeaders.setContentType(MediaType.APPLICATION_JSON);
};
exchange.mutate().request(exchange.getRequest().mutate()
.headers(headersConsumer).build()).build();
return chain.filter(exchange);
}
//验证平台端编码是否正确
if (verify.checkPlatform(platform)) {
return GatewayUtils.responseError(exchange, ErrorCodeEnum.AUTH_PLATFORM);
}
//白名单验证
if (!verify.checkWhiteIsLogin(requestUrl)) {
//验证token是否有效
if (verify.checkToken(token, Integer.valueOf(platform))) {
log.info("ApiRequestGlobalFilter checkToken");
return GatewayUtils.responseError(exchange, ErrorCodeEnum.AUTH_TOKEN_INVALID);
}
//验证用户是在别的地方登陆
if (verify.checkRedis(token, Integer.valueOf(platform))) {
return GatewayUtils.responseError(exchange, ErrorCodeEnum.AUTH_TOKEN_SWITCH);
}
try {
Claims claims = JwtUtils.infoJWT(token, Integer.valueOf(platform));
subject = URLEncoder.encode(claims.getSubject(), "utf-8");
} catch (UnsupportedEncodingException e) {
log.error("[{}] 请求参数：{}, 网关解析参数encode错误:{}", requestUrl, token, e);
return GatewayUtils.responseError(exchange, ErrorCodeEnum.SERVER);
}
}
if (!verify.checkWhiteIsPer(requestUrl)) {
//验证用户是否有权限访问
if (!verify.checkPermissions(token, Integer.valueOf(platform), requestUrl)) {
return GatewayUtils.responseError(exchange, ErrorCodeEnum.AUTH_PERMISSIONS);
}
}
exchange.mutate().request(exchange.getRequest().mutate().header(RequestConstant.HEADER_USER_LOGIN_INFO, subject).build()).build();
exchange.mutate().request(exchange.getRequest().mutate().header(RequestConstant.HEADER_ACCESS_TOKEN, token).build()).build();
exchange.mutate().request(exchange.getRequest().mutate().header(RequestConstant.HEADER_PLATFORM, platform).build()).build();
exchange.mutate().request(exchange.getRequest().mutate().header(RequestConstant.HEADER_SAFETY_LABEL_NAME,
RequestConstant.HEADER_SAFETY_LABEL_VAL).build()).build();
return chain.filter(exchange);
}
@Override
public int getOrder() {
return 1;
}
}
package com.box.manage.gateway.filter;
import com.alibaba.fastjson.JSONObject;
import com.box.common.core.enums.ErrorCodeEnum;
import com.box.common.core.rt.Result;
import com.box.common.core.utils.*;
import io.netty.buffer.ByteBufAllocator;
import lombok.extern.slf4j.Slf4j;
import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.core.Ordered;
import org.springframework.core.io.buffer.DataBuffer;
import org.springframework.core.io.buffer.DataBufferUtils;
import org.springframework.core.io.buffer.NettyDataBufferFactory;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
import org.springframework.http.MediaType;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.http.server.reactive.ServerHttpRequestDecorator;
import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.stereotype.Component;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Flux;
import reactor.core.publisher.Mono;
import java.io.UnsupportedEncodingException;
import java.net.URI;
import java.nio.charset.StandardCharsets;
import java.util.Optional;
/**
* 文件描述
*
* @author yuan.dingwang
* @date 2021年02月26日 15:35
*/
@Slf4j
@Component
public class ApiRequestXssSqllFilter implements GlobalFilter, Ordered {
private static final String START_TIME = "startTime";
@Override
public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
log.info("----自定义网关全局过滤器生效----");
ServerHttpRequest serverHttpRequest = exchange.getRequest();
HttpMethod method = serverHttpRequest.getMethod();
String contentType = serverHttpRequest.getHeaders().getFirst(HttpHeaders.CONTENT_TYPE);
URI uri = exchange.getRequest().getURI();
//记录请求开始时间
exchange.getAttributes().put(START_TIME, SystemClockUtils.millisClock().now());
// 排除流文件类型,比如上传的文件contentType.contains("multipart/form-data")
if (GatewayUtils.isUploadFile(serverHttpRequest.getHeaders().getContentType())) {
log.info("{} - [{}] 文件上传请求放行", method, uri.getPath());
return chain.filter(exchange);
}
//过滤get请求
if (method == HttpMethod.GET) {
String rawQuery = uri.getRawQuery();
log.info("{} - [{}] 请求参数：{}", method, uri.getPath(), rawQuery);
if (StringUtils.isBlank(rawQuery)) {
return chain.filter(exchange);
}
// 执行sql注入校验清理
boolean chkRet = false;
try {
rawQuery = XssCleanRuleUtils.xssGetClean(rawQuery);
chkRet = SqLinjectionRuleUtils.getRequestSqlKeyWordsCheck(rawQuery);
} catch (UnsupportedEncodingException e) {
log.error("{} - [{}] 请求参数：{}, 网关解析参数错误:{}", method, uri.getPath(), rawQuery, e);
return GatewayUtils.responseError(exchange, ErrorCodeEnum.SERVER);
}
//如果存在sql注入,直接拦截请求
if (chkRet) {
log.info("请求【" + uri.getRawPath() + uri.getRawQuery() + "】参数中包含不允许sql的关键词, 请求拒绝");
return GatewayUtils.responseError(exchange, ErrorCodeEnum.CHECK_SQL_ILLEGAL);
}
//透传参数，不对参数做任何处理
return chain.filter(exchange).then(Mono.fromRunnable(() -> {
Long startTime = exchange.getAttribute(START_TIME);
if (startTime != null) {
Long executeTime = (SystemClockUtils.millisClock().now() - startTime);
log.info("【{}】 耗时：{} ms", exchange.getRequest().getURI().getRawPath(), executeTime);
}
}));
} else if (method == HttpMethod.POST) {
//post请求时，如果是文件上传之类的请求，不修改请求消息体
return DataBufferUtils.join(serverHttpRequest.getBody()).flatMap(d -> Mono.just(Optional.of(d))).defaultIfEmpty(
Optional.empty())
.flatMap(optional -> {
// 取出body中的参数
String bodyString = "";
if (optional.isPresent()) {
byte[] oldBytes = new byte[optional.get().readableByteCount()];
optional.get().read(oldBytes);
bodyString = new String(oldBytes, StandardCharsets.UTF_8);
}
HttpHeaders httpHeaders = serverHttpRequest.getHeaders();
// 执行XSS清理
boolean chkRet = false;
log.info("{} - [{}] 请求参数：{}", method, uri.getPath(), bodyString);
if (MediaType.APPLICATION_JSON_VALUE.equals(contentType)) {
//如果MediaType是json才执行json方式验证
bodyString = XssCleanRuleUtils.xssPostClean(bodyString);
chkRet = SqLinjectionRuleUtils.postRequestSqlKeyWordsCheck(bodyString);
} else {
//form表单方式，需要走get请求
try {
bodyString = XssCleanRuleUtils.xssGetClean(bodyString);
chkRet = SqLinjectionRuleUtils.getRequestSqlKeyWordsCheck(bodyString);
} catch (UnsupportedEncodingException e) {
log.error("{} - [{}] 请求参数：{}, 网关解析参数错误:{}", method, uri.getPath(), bodyString, e);
return GatewayUtils.responseError(exchange, ErrorCodeEnum.SERVER);
}
}
// 如果存在sql注入,直接拦截请求
if (chkRet) {
log.info("{} - [{}] 参数：{}, 包含不允许sql的关键词，请求拒绝", method, uri.getPath(), bodyString);
return GatewayUtils.responseError(exchange, ErrorCodeEnum.CHECK_SQL_ILLEGAL);
}
ServerHttpRequest newRequest = serverHttpRequest.mutate().uri(uri).build();
// 重新构造body
byte[] newBytes = bodyString.getBytes(StandardCharsets.UTF_8);
DataBuffer bodyDataBuffer = GatewayUtils.toDataBuffer(newBytes);
Flux<DataBuffer> bodyFlux = Flux.just(bodyDataBuffer);
// 重新构造header
HttpHeaders headers = new HttpHeaders();
headers.putAll(httpHeaders);
// 由于修改了传递参数，需要重新设置CONTENT_LENGTH，长度是字节长度，不是字符串长度
int length = newBytes.length;
headers.remove(HttpHeaders.CONTENT_LENGTH);
headers.setContentLength(length);
headers.set(HttpHeaders.CONTENT_TYPE, serverHttpRequest.getHeaders().getFirst(HttpHeaders.CONTENT_TYPE));
// 重写ServerHttpRequestDecorator，修改了body和header，重写getBody和getHeaders方法
newRequest = new ServerHttpRequestDecorator(newRequest) {
@Override
public Flux<DataBuffer> getBody() {
return bodyFlux;
}
@Override
public HttpHeaders getHeaders() {
return headers;
}
};
exchange.getResponse();
return chain.filter(exchange.mutate().request(newRequest).build()).then(Mono.fromRunnable(() -> {
Long startTime = exchange.getAttribute(START_TIME);
if (startTime != null) {
Long executeTime = (SystemClockUtils.millisClock().now() - startTime);
log.info("【{}】 耗时：{} ms", exchange.getRequest().getURI().getRawPath(), executeTime);
}
}));
});
} else {
return GatewayUtils.responseError(exchange, ErrorCodeEnum.SERVER_NOT_METHOD);
}
}
@Override
public int getOrder() {
return 0;
}
}
package com.box.manage.gateway.filter;
import lombok.extern.slf4j.Slf4j;
import org.reactivestreams.Publisher;
import org.springframework.cloud.gateway.filter.GatewayFilterChain;
import org.springframework.cloud.gateway.filter.GlobalFilter;
import org.springframework.core.Ordered;
import org.springframework.core.io.buffer.DataBuffer;
import org.springframework.core.io.buffer.DataBufferFactory;
import org.springframework.core.io.buffer.DataBufferUtils;
import org.springframework.http.HttpMethod;
import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.http.server.reactive.ServerHttpResponseDecorator;
import org.springframework.stereotype.Component;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Flux;
import reactor.core.publisher.Mono;
import java.net.URI;
import java.nio.charset.Charset;
/**
* 文件描述
*
* @author yuan.dingwang
* @date 2021年04月14日 10:26
*/
@Slf4j
@Component
public class ApoResponseGlobalFilter implements GlobalFilter, Ordered {
@Override
public int getOrder() {
// -1 is response write filter, must be called before that
return -2;
}
@Override
public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
ServerHttpResponse originalResponse = exchange.getResponse();
DataBufferFactory bufferFactory = originalResponse.bufferFactory();
HttpMethod method = exchange.getRequest().getMethod();
URI uri = exchange.getRequest().getURI();
ServerHttpResponseDecorator decoratedResponse = new ServerHttpResponseDecorator(originalResponse) {
@Override
public Mono<Void> writeWith(Publisher<? extends DataBuffer> body) {
if (body instanceof Flux) {
Flux<? extends DataBuffer> fluxBody = (Flux<? extends DataBuffer>) body;
return super.writeWith(fluxBody.map(dataBuffer -> {
// probably should reuse buffers
byte[] content = new byte[dataBuffer.readableByteCount()];
dataBuffer.read(content);
//释放掉内存
DataBufferUtils.release(dataBuffer);
String data = new String(content, Charset.forName("UTF-8"));
log.info("{} - [{}] 响应数据：{}", method, uri.getPath(), data);
//TODO，data就是response的值，想修改、查看就随意而为了
byte[] uppedContent = new String(content, Charset.forName("UTF-8")).getBytes();
return bufferFactory.wrap(uppedContent);
}));
}
// if body is not a flux. never got there.
return super.writeWith(body);
}
};
return chain.filter(exchange.mutate().response(decoratedResponse).build());
}
}
package com.box.manage.gateway.filter;
import com.box.common.core.constant.CacheKeyConstant;
import com.box.common.core.enums.PlatformEnum;
import com.box.common.core.utils.JwtUtils;
import com.box.common.core.utils.StringUtils;
import com.box.manage.gateway.config.WhiteListProperties;
import com.box.redis.service.RedisService;
import io.jsonwebtoken.Claims;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import javax.annotation.Resource;
/**
* 验证类
*
* @author yuan.dingwang
* @date 2020年12月16日 16:54
*/
@Component
public class VerifyCondition {
@Autowired
RedisService redisService;
@Resource
WhiteListProperties whiteListProperties;
/**
* 验证平台端访问参数
*
* @param platform
* @return
*/
public boolean checkPlatform(String platform) {
//验证平台端编码是否正确
if (StringUtils.isBlank(platform)) {
return true;
}
//验证平台端编码是否正确
if (!PlatformEnum.isCheck(Integer.valueOf(platform))) {
return true;
}
return false;
}
/**
* 不需要登录的地址
*
* @param path
* @return
*/
public boolean checkWhiteIsLogin(String path) {
return whiteListProperties.loginVerify(path);
}
/**
* 不需要登录的地址
*
* @param path
* @return
*/
public boolean checkWhiteIsPer(String path) {
return whiteListProperties.perVerify(path);
}
/**
* 验证token是否有效
*
* @param token
* @return
*/
public boolean checkToken(String token, Integer platform) {
//验证token是否有效
if (StringUtils.isBlank(token)) {
return true;
}
//验证token是否有效
if (!JwtUtils.checkJWT(token, platform)) {
return true;
}
//验证用户是否过期
Claims claims = JwtUtils.infoJWT(token, platform);
if (StringUtils.isNull(claims) || StringUtils.isNull(claims.getId())
|| StringUtils.isNull(claims.get("roles"))) {
return true;
}
return false;
}
/**
* 验证用户是否在别处登录
*
* @param token
* @return
*/
public boolean checkRedis(String token, Integer platform) {
Claims claims = JwtUtils.infoJWT(token, platform);
//验证用户是否过期
StringBuffer key = new StringBuffer(CacheKeyConstant.CECHE_MANAGE_USER_TOKEN).append(platform).append(":").append(claims.getId());
Object dbToken = redisService.get(key.toString());
if (StringUtils.isNull(dbToken)) {
return true;
}
//验证用户是在别的地方登陆
if (!token.equals(dbToken.toString())) {
return true;
}
return false;
}
/**
* 验证权限
*
* @param token
* @param platform
* @param path
* @return
* /merchants/merchants/manage/getMerchantByPage 20210528000000191240
*/
public boolean checkPermissions(String token, Integer platform, String path) {
path = newPath(path);
Claims claims = JwtUtils.infoJWT(token, platform);
String roles = claims.get("roles").toString();
StringBuffer key = new StringBuffer(CacheKeyConstant.CECHE_MANAGE_PERMISSION).append(platform);
Object dbRoles = redisService.hget(key.toString(), path);
String[] roleArray = roles.split(",");
for (String role : roleArray) {
if (roles.equals("000000")){
//系统端超级管理员
return true;
}
}
if (StringUtils.isNull(dbRoles)) {
return false;
}
//当前用户角色id是否在dbRoles内
Boolean bool = false;
for (String role : roleArray) {
if (dbRoles.toString().contains(role)) {
bool = true;
break;
}
}
return bool;
}
public static void main(String[] args) {
//System.out.println("66666,22222".contains("66666,1111"));
String aa = "/open/manage/scoreBanck/openDeails";
String url = "/manage/scoreBanck/openDeails";
String r = "20210615000000462987,20210603000000384153,20210525000000128275,20210603000000446357,20210615000000368119,20210608000001015766,20210607000000578123,20210525000000128174";
VerifyCondition v = new VerifyCondition();
aa = aa.substring(5);
System.out.println(aa);
System.out.println(aa.equals(url));
}
private String newPath(String path) {
//return path.replace("/open", "");
return path.substring(5);
}
}
