OWASP API Security Top 10#

@Service
public class OrderAccessService {
    
    @Autowired
    private OrderRepository orderRepository;
    
    /**
     * 获取订单前的权限验证
     */
    public Order getOrder(Long orderId, Long userId) {
        Order order = orderRepository.findById(orderId)
            .orElseThrow(() -> new OrderNotFoundException(orderId));
        
        // 关键：验证当前用户是否有权访问此订单
        if (!order.getOwnerId().equals(userId)) {
            // 检查是否是共享订单
            if (!orderShareRepository.isShared(orderId, userId)) {
                throw new UnauthorizedAccessException(
                    "用户 " + userId + " 无权访问订单 " + orderId
                );
            }
        }
        
        return order;
    }
    
    /**
     * 通用授权检查方法
     */
    private void verifyObjectAccess(Object resource, Long userId, 
                                   Function<Object, Long> getOwnerId) {
        Long resourceOwnerId = getOwnerId.apply(resource);
        
        if (!resourceOwnerId.equals(userId)) {
            log.warn("检测到越权访问: user={}, resource={}, owner={}", 
                userId, resource, resourceOwnerId);
            
            // 可以选择记录但不拒绝（蜜罐策略）
            if (securityConfig.isHoneyPotEnabled()) {
                return;
            }
            
            throw new UnauthorizedAccessException("无权访问此资源");
        }
    }
}

@Configuration
public class JwtAuthenticationConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            // 禁用 CSRF（API 使用 Token）
            .csrf(csrf -> csrf.disable())
            
            // 禁用不安全的认证方式
            .httpBasic(basic -> basic.disable())
            .formLogin(form -> form.disable())
            
            // 配置 JWT 过滤器
            .addFilterBefore(jwtAuthenticationFilter(), 
                UsernamePasswordAuthenticationFilter.class)
            
            // 账户锁定配置
            .userDetailsService(userDetailsService())
                .passwordEncoder(passwordEncoder())
            
            .build();
    }
}

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    
    private final JwtTokenProvider tokenProvider;
    
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                   HttpServletResponse response,
                                   FilterChain chain) {
        
        String token = extractToken(request);
        
        if (StringUtils.hasText(token)) {
            try {
                // 1. 验证 Token 签名
                Claims claims = tokenProvider.validateToken(token);
                
                // 2. 验证 Token ID（jti）未被撤销
                String jti = claims.getId();
                if (tokenRevocationService.isRevoked(jti)) {
                    throw new TokenRevokedException();
                }
                
                // 3. 验证 Token 主题
                String subject = claims.getSubject();
                if (subject == null || subject.isEmpty()) {
                    throw new InvalidTokenException("Token subject is missing");
                }
                
                // 4. 验证 Token 类型
                String tokenType = claims.get("type", String.class);
                if (!"access".equals(tokenType)) {
                    throw new InvalidTokenException("Invalid token type");
                }
                
                // 5. 提取权限并设置认证上下文
                setAuthenticationContext(claims);
                
            } catch (ExpiredJwtException e) {
                handleExpiredToken(response);
            } catch (JwtException e) {
                handleInvalidToken(response, e);
            }
        }
        
        chain.doFilter(request, response);
    }
}

@RestController
public class UserController {
    
    @Autowired
    private FieldAuthorizationService fieldAuthService;
    
    /**
     * 用户查询，统一处理字段过滤
     */
    @GetMapping("/api/v1/users/{id}")
    public UserDto getUser(@PathVariable Long id,
                           @RequestParam(required = false) String fields) {
        
        User user = userService.findById(id);
        
        // 获取当前用户
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        
        // 确定允许返回的字段
        Set<String> allowedFields = fieldAuthService.getReadableFields(
            auth, user, "User"
        );
        
        // 如果请求指定了字段，验证是否在允许范围内
        if (fields != null) {
            Set<String> requestedFields = parseFields(fields);
            if (!allowedFields.containsAll(requestedFields)) {
                throw new UnauthorizedFieldAccessException();
            }
            return user.toDto(requestedFields);
        }
        
        return user.toDto(allowedFields);
    }
    
    /**
     * 用户更新，统一处理字段写入权限
     */
    @PutMapping("/api/v1/users/{id}")
    public UserDto updateUser(@PathVariable Long id, 
                              @RequestBody Map<String, Object> updates) {
        
        User user = userService.findById(id);
        
        // 获取可写字段
        Set<String> writableFields = fieldAuthService.getWritableFields(
            auth, user, "User"
        );
        
        // 过滤不允许修改的字段
        Map<String, Object> filteredUpdates = updates.entrySet().stream()
            .filter(e -> writableFields.contains(e.getKey()))
            .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
        
        // 拒绝敏感字段修改
        Set<String> sensitiveFields = Set.of("role", "permissions", "password");
        for (String sensitiveField : sensitiveFields) {
            if (updates.containsKey(sensitiveField)) {
                log.warn("尝试修改敏感字段 {}，已拒绝", sensitiveField);
                throw new SensitiveFieldModificationException(sensitiveField);
            }
        }
        
        return userService.update(id, filteredUpdates);
    }
}

@Configuration
public class ResourceLimitConfig {
    
    @Bean
    public FilterRegistrationBean<ResourceLimitFilter> resourceLimitFilter() {
        FilterRegistrationBean<ResourceLimitFilter> registration = 
            new FilterRegistrationBean<>();
        
        registration.setFilter(new ResourceLimitFilter());
        registration.addUrlPatterns("/api/*");
        
        return registration;
    }
}

public class ResourceLimitFilter implements Filter {
    
    // 资源配置
    private static final int MAX_PAGE_SIZE = 100;
    private static final int MAX_UPLOAD_SIZE = 10 * 1024 * 1024;  // 10MB
    private static final int MAX_SEARCH_RESULTS = 1000;
    private static final int MAX_NESTING_DEPTH = 3;
    private static final int MAX_STRING_LENGTH = 10000;
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
                        FilterChain chain) throws IOException, ServletException {
        
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        
        // 1. 限制分页大小
        String pageSize = httpRequest.getParameter("size");
        if (pageSize != null) {
            int size = Integer.parseInt(pageSize);
            if (size > MAX_PAGE_SIZE) {
                sendError(httpResponse, 400, "PAGE_SIZE_EXCEEDED", 
                    "每页最多 " + MAX_PAGE_SIZE + " 条");
                return;
            }
        }
        
        // 2. 限制查询结果数
        String limit = httpRequest.getParameter("limit");
        if (limit != null) {
            int l = Integer.parseInt(limit);
            if (l > MAX_SEARCH_RESULTS) {
                sendError(httpResponse, 400, "SEARCH_LIMIT_EXCEEDED",
                    "查询最多返回 " + MAX_SEARCH_RESULTS + " 条");
                return;
            }
        }
        
        // 3. 限制 include 嵌套深度
        String include = httpRequest.getParameter("include");
        if (include != null && countNestingDepth(include) > MAX_NESTING_DEPTH) {
            sendError(httpResponse, 400, "NESTING_DEPTH_EXCEEDED",
                "嵌套深度最多 " + MAX_NESTING_DEPTH + " 层");
            return;
        }
        
        chain.doFilter(request, response);
    }
}

@Configuration
@EnableMethodSecurity
public class AuthorizationConfig {
    
    /**
     * 配置端点级别的访问控制
     */
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .authorizeHttpRequests(auth -> auth
                // 公开端点
                .requestMatchers("/api/v1/public/**").permitAll()
                .requestMatchers("/api/v1/auth/**").permitAll()
                .requestMatchers("/health").permitAll()
                
                // 用户端点 - 需要认证
                .requestMatchers("/api/v1/users/me/**")
                    .access(new AuthorizationManager<HttpServletRequest>() {
                        @Override
                        public AuthorizationDecision check(
                                Authentication authentication,
                                HttpServletRequest request) {
                            return new AuthorizationDecision(
                                authentication.isAuthenticated()
                            );
                        }
                    })
                
                // 管理员端点 - 需要 ADMIN 角色
                .requestMatchers("/api/v1/admin/**")
                    .hasRole("ADMIN")
                
                // 内部端点 - 需要 SYSTEM 或 INTERNAL_SERVICE 角色
                .requestMatchers("/api/v1/internal/**")
                    .hasAnyRole("SYSTEM", "INTERNAL_SERVICE")
                
                // 调试端点 - 生产环境禁用
                .requestMatchers("/api/debug/**")
                    .access((authentication, object) -> {
                        HttpServletRequest request = 
                            object.getRequest();
                        if ("prod".equals(getCurrentEnvironment())) {
                            return new AuthorizationDecision(false);
                        }
                        return new AuthorizationDecision(true);
                    })
                
                // 默认拒绝
                .anyRequest().authenticated()
            )
            .build();
    }
    
    /**
     * 方法级别的权限检查
     */
    @Bean
    public MethodSecurityExpressionHandler methodSecurityExpressionHandler(
            PermissionEvaluator permissionEvaluator) {
        
        DefaultMethodSecurityExpressionHandler handler = 
            new DefaultMethodSecurityExpressionHandler();
        handler.setPermissionEvaluator(permissionEvaluator);
        
        return handler;
    }
}

@Service
public class AdminUserService {
    
    /**
     * 删除用户 - 需要明确授权检查
     */
    @PreAuthorize("hasRole('ADMIN') and " +
                  "@permissionEvaluator.hasPermission('USER', 'DELETE')")
    public void deleteUser(Long userId) {
        // 实现删除逻辑
    }
    
    /**
     * 查看审计日志 - 双重检查
     */
    @PreAuthorize("hasRole('AUDITOR') or hasRole('ADMIN')")
    @PreAuthorize("@permissionEvaluator.hasPermission('AUDIT_LOG', 'READ')")
    public List<AuditLog> getAuditLogs(Date startDate, Date endDate) {
        // 实现查询逻辑
    }
}

@Service
public class UrlValidator {
    
    private static final Set<String> BLOCKED_HOSTS = Set.of(
        "localhost",
        "127.0.0.1",
        "0.0.0.0",
        "::1",
        "metadata.google.internal",  // GCP 元数据
        "169.254.169.254",           // AWS 元数据
        "metadata.azure.com"
    );
    
    private static final Set<String> ALLOWED_SCHEMES = Set.of(
        "http", "https"
    );
    
    private static final Set<String> BLOCKED_PROTOCOLS = Set.of(
        "file", "ftp", "gopher"
    );
    
    /**
     * 验证 URL 是否安全
     */
    public ValidationResult validateUrl(String urlString) {
        try {
            URL url = new URL(urlString);
            
            // 1. 检查协议
            if (!ALLOWED_SCHEMES.contains(url.getProtocol().toLowerCase())) {
                return ValidationResult.rejected("不允许的协议: " + url.getProtocol());
            }
            
            // 2. 检查主机名
            String host = url.getHost().toLowerCase();
            if (BLOCKED_HOSTS.contains(host)) {
                return ValidationResult.rejected("不允许的主机: " + host);
            }
            
            // 3. 检查 IP 地址（防止绕过）
            String ip = resolveHost(host);
            if (isPrivateIp(ip)) {
                return ValidationResult.rejected("不允许访问内网 IP: " + ip);
            }
            
            // 4. 检查 DNS 重绑定
            InetAddress address = InetAddress.getByName(host);
            if (address.isLoopbackAddress() || address.isSiteLocalAddress()) {
                return ValidationResult.rejected("DNS 重绑定检测: " + host);
            }
            
            // 5. 检查端口
            int port = url.getPort() != -1 ? url.getPort() : url.getDefaultPort();
            if (isBlockedPort(port)) {
                return ValidationResult.rejected("不允许的端口: " + port);
            }
            
            // 6. 发出实际请求前再次检查
            HttpURLConnection connection = (HttpURLConnection) url.openConnection();
            connection.setRequestMethod("HEAD");
            connection.setConnectTimeout(5000);
            connection.setReadTimeout(5000);
            
            // 验证实际连接的地址
            String actualHost = connection.getURL().getHost();
            if (BLOCKED_HOSTS.contains(actualHost.toLowerCase())) {
                return ValidationResult.rejected("重定向到阻止的主机");
            }
            
            return ValidationResult.approved();
            
        } catch (MalformedURLException e) {
            return ValidationResult.rejected("无效的 URL 格式");
        } catch (IOException e) {
            return ValidationResult.rejected("无法验证 URL: " + e.getMessage());
        }
    }
    
    private boolean isPrivateIp(String ip) {
        try {
            InetAddress address = InetAddress.getByName(ip);
            return address.isLoopbackAddress() 
                || address.isSiteLocalAddress()
                || address.isLinkLocalAddress()
                || address.isAnyLocalAddress();
        } catch (UnknownHostException e) {
            return true;
        }
    }
    
    private boolean isBlockedPort(int port) {
        // 阻止常见危险端口
        Set<Integer> dangerousPorts = Set.of(
            22,    // SSH
            23,    // Telnet
            445,   // SMB
            3389,  // RDP
            5432,  // PostgreSQL
            6379,  // Redis
            27017  // MongoDB
        );
        return dangerousPorts.contains(port);
    }
}

@Configuration
public class SecurityHeadersConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            // 禁用调试模式相关的端点
            .addFilterBefore(debugEndpointFilter(), ChannelProcessingFilter)
            
            // 配置安全响应头
            .headers(headers -> headers
                // 防止点击劫持
                .frameOptions(frame -> frame.deny())
                
                // XSS 防护
                .xssProtection(xss -> xss.enable())
                
                // 内容类型嗅探防护
                .contentTypeOptions(contentType -> contentType.strict())
                
                // 内容安全策略
                .contentSecurityPolicy(csp -> csp
                    .policyDirectives("default-src 'self'; " +
                                     "script-src 'self'; " +
                                     "object-src 'none'; " +
                                     "base-uri 'self';")
                )
                
                // Referrer 策略
                .referrerPolicy(referrer -> 
                    referrer.policy(ReferrerPolicy.StrictOriginWhenCrossOrigin)
                )
                
                // 权限策略
                .permissionsPolicy(permissions -> 
                    permissions.policy("geolocation=(), microphone=(), camera=()")
                )
            )
            
            // 错误处理
            .exceptionHandling(exceptions -> exceptions
                .authenticationEntryPoint((request, response, authException) -> {
                    response.setStatus(401);
                    response.setContentType("application/json");
                    response.getWriter().write(
                        "{\"error\":\"UNAUTHORIZED\",\"message\":\"认证失败\"}"
                    );
                })
                .accessDeniedHandler((request, response, accessDeniedException) -> {
                    response.setStatus(403);
                    response.setContentType("application/json");
                    response.getWriter().write(
                        "{\"error\":\"FORBIDDEN\",\"message\":\"权限不足\"}"
                    );
                })
            )
            
            // CORS 配置
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
            
            .build();
    }
}

@Configuration
public class CorsConfig {
    
    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        
        // 限制允许的来源
        configuration.setAllowedOrigins(List.of("https://example.com"));
        
        // 限制允许的方法
        configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));
        
        // 限制允许的头部
        configuration.setAllowedHeaders(List.of(
            "Authorization", "Content-Type", "X-Request-ID"
        ));
        
        // 允许凭证
        configuration.setAllowCredentials(true);
        
        // 预检请求缓存时间
        configuration.setMaxAge(3600L);
        
        // 暴露响应头
        configuration.setExposedHeaders(List.of("X-Total-Count"));
        
        UrlBasedCorsConfigurationSource source = 
            new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/api/**", configuration);
        
        return source;
    }
}

@Service
public class SafeQueryService {
    
    /**
     * 参数化查询（防止 SQL 注入）
     */
    public List<User> searchUsers(String keyword) {
        // 使用参数化查询
        String sql = "SELECT * FROM users WHERE name LIKE ?";
        return jdbcTemplate.query(sql, 
            preparedStatement -> {
                preparedStatement.setString(1, "%" + escapeWildcards(keyword) + "%");
            },
            userRowMapper
        );
    }
    
    /**
     * 输入转义
     */
    private String escapeWildcards(String input) {
        // 只转义通配符，防止 LIKE 注入
        return input
            .replace("\\", "\\\\")
            .replace("%", "\\%")
            .replace("_", "\\_");
    }
}

@Service
public class MongoQueryService {
    
    /**
     * NoSQL 注入防护
     */
    public List<Document> safeFind(String username) {
        // 使用 Document 构造而非字符串解析
        Document filter = new Document();
        
        // 用户名字段必须是字符串，不是操作符
        if (username.contains("$")) {
            throw new IllegalArgumentException("输入包含非法字符");
        }
        
        filter.put("username", username);
        
        // 限制返回字段
        Bson projection = new Document("_id", 1)
            .append("username", 1)
            .append("email", 1);
        
        return collection.find(filter)
            .projection(projection)
            .limit(100)  // 限制返回数量
            .into(new ArrayList<>());
    }
}

@Configuration
public class GraphQLSecurityConfig {
    
    @Bean
    public RuntimeWiringConfigurer runtimeWiringConfigurer(
            DataFetcherInterceptor interceptor) {
        
        return wiringBuilder -> wiringBuilder
            // 添加复杂度限制
            .type("Query", builder -> builder
                .dataFetcher("users", environment -> {
                    // 检查查询深度
                    if (environment.getFragmentsByRoot().size() > 5) {
                        throw new SecurityException("查询复杂度超限");
                    }
                    return userService.getUsers();
                })
            )
            // 限制字段数量
            .field(new FieldVisibilityStrategy() {
                @Override
                public List<GraphQLFieldDefinition> getVisibleFields(
                        List<GraphQLFieldDefinition> fields) {
                    return fields.stream()
                        .filter(f -> !isSensitiveField(f.getName()))
                        .collect(Collectors.toList());
                }
                
                private boolean isSensitiveField(String name) {
                    return Set.of("password", "ssn", "creditCard")
                        .contains(name.toLowerCase());
                }
            })
            .build();
    }
}

@Component
public class ApiVersionFilter extends OncePerRequestFilter {
    
    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain) {
        
        String path = request.getRequestURI();
        ApiVersion version = extractVersion(path);
        
        if (version != null) {
            VersionConfig config = versionConfig.get(version);
            
            if (config == null) {
                sendError(response, 404, "VERSION_NOT_FOUND");
                return;
            }
            
            if (config.isDeprecated() && !config.isAllowed()) {
                response.setHeader("Deprecation", "true");
                response.setHeader("Sunset", config.getSunsetDate());
                
                if (isPastSunsetDate(config.getSunsetDate())) {
                    sendError(response, 410, "VERSION_DEPRECATED",
                        "此 API 版本已停用，请迁移到最新版本");
                    return;
                } else {
                    response.setHeader("Warning", 
                        "版本即将停用，请尽快迁移");
                }
            }
        }
        
        chain.doFilter(request, response);
    }
}