OWASP Top 10 详解#

// 漏洞代码：用户可以查看其他用户的订单
public Order getOrder(Long orderId) {
    // 错误：没有验证订单是否属于当前用户
    return orderRepository.findById(orderId);
}

// 攻击：用户 A 通过修改 orderId 参数访问用户 B 的订单
// GET /api/orders/12345  (用户 A 原本访问自己的订单 12344)
// GET /api/orders/12345  (用户 A 修改参数访问用户 B 的订单 12345)

// 漏洞代码：普通用户可以访问管理员功能
@RequestMapping("/admin")
public class AdminController {
    
    @GetMapping("/users")
    // 错误：没有检查用户角色
    public List<User> getAllUsers() {
        return userService.findAll();
    }
    
    @PostMapping("/users")
    // 错误：没有检查用户权限
    public User createUser(@RequestBody User user) {
        return userService.create(user);
    }
}

public class SecureOrderController {
    
    private final OrderService orderService;
    private final AuthorizationService authService;
    
    // 正确的水平越权防护
    @GetMapping("/orders/{orderId}")
    public Order getOrder(@PathVariable Long orderId) {
        // 1. 从安全上下文获取当前用户
        User currentUser = authService.getCurrentUser();
        
        // 2. 验证订单归属
        Order order = orderService.findById(orderId);
        
        // 3. 明确检查所有权
        if (!order.getUserId().equals(currentUser.getId())) {
            throw new AccessDeniedException("无权访问此订单");
        }
        
        return order;
    }
}

// 使用 Spring Security 注解
public class SecureAdminController {
    
    @PreAuthorize("hasRole('ADMIN')")
    @GetMapping("/users")
    public List<User> getAllUsers() {
        return userService.findAll();
    }
    
    @PreAuthorize("hasAuthority('USER_CREATE')")
    @PostMapping("/users")
    public User createUser(@RequestBody User user) {
        return userService.create(user);
    }
}

// 漏洞：不使用 HTTPS 或使用了过时的 TLS 版本
@Configuration
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        // 漏洞：允许不安全的 TLS 版本
        http.requiresChannel(channels -> channels
            .anyRequest().requiresSecure()
        );
        
        // 漏洞：未配置 HSTS
        return http.build();
    }
}

// 漏洞：在 HTTP 响应头中泄露敏感信息
@Controller
public class UserController {
    @GetMapping("/users")
    public User getUser(HttpServletResponse response) {
        // 漏洞：设置了不必要的敏感 cookie
        response.addHeader("Set-Cookie", 
            "sessionId=xxx; Domain=example.com; Secure; HttpOnly");
        
        // 漏洞：泄露服务器版本信息
        response.addHeader("X-Powered-By", "Apache/2.4.1");
        response.addHeader("Server", "Apache");
        
        return currentUser;
    }
}

// 漏洞：使用 MD5 存储密码
public class UnsafePasswordStorage {
    public String hashPassword(String password) {
        // 危险：MD5 不安全，可被彩虹表破解
        return MD5(password);
    }
}

// 漏洞：使用没有盐值的哈希
public class UnsafeSaltStorage {
    public String hashPassword(String password) {
        // 危险：没有盐值，容易被彩虹表攻击
        return SHA256(password);
    }
}

// 正确：使用 BCrypt
public class SafePasswordStorage {
    public String hashPassword(String password) {
        // 好：BCrypt 自动处理盐值，且有自适应成本因子
        return BCrypt.hashpw(password, BCrypt.gensalt(12));
    }
    
    public boolean verifyPassword(String password, String hash) {
        return BCrypt.checkpw(password, hash);
    }
}

@Configuration
public class CryptoConfig {
    
    // 1. TLS 配置
    @Bean
    public SSLContext sslContext() throws NoSuchAlgorithmException {
        SSLContext sslContext = SSLContext.getInstance("TLSv1.3");
        sslContext.init(
            getKeyManagerFactory().getKeyManagers(),
            getTrustManagerFactory().getTrustManagers(),
            new SecureRandom()
        );
        return sslContext;
    }
    
    // 2. HTTPS 强制配置
    @Bean
    public TomcatServletWebServerFactory tomcatServletWebServerFactory() {
        TomcatServletWebServerFactory factory = 
            new TomcatServletWebServerFactory();
        factory.addConnectorCustomizers(connector -> {
            Connector configured = connector;
            configured.setScheme("https");
            configured.setSecure(true);
        });
        return factory;
    }
    
    // 3. 安全响应头
    @Bean
    public FilterRegistrationBean<SecurityHeadersFilter> 
            securityHeadersFilter() {
        return new FilterRegistrationBean<>(new SecurityHeadersFilter());
    }
}

public class SecurityHeadersFilter implements Filter {
    @Override
    public void doFilter(ServletRequest req, ServletResponse res, 
                         FilterChain chain) {
        HttpServletResponse response = (HttpServletResponse) res;
        
        // 严格传输安全
        response.setHeader("Strict-Transport-Security", 
            "max-age=31536000; includeSubDomains; preload");
        
        // 内容安全策略
        response.setHeader("Content-Security-Policy", 
            "default-src 'self'; script-src 'self'");
        
        // 防止点击劫持
        response.setHeader("X-Frame-Options", "DENY");
        
        // XSS 保护
        response.setHeader("X-XSS-Protection", "1; mode=block");
        
        // 内容类型嗅探保护
        response.setHeader("X-Content-Type-Options", "nosniff");
    }
}

// 漏洞代码
public User findByUsername(String username) {
    String sql = "SELECT * FROM users WHERE username = '" + username + "'";
    return jdbcTemplate.queryForObject(sql);
}

// 攻击：输入 username = "admin' OR '1'='1"
// 实际执行：SELECT * FROM users WHERE username = 'admin' OR '1'='1'
// 结果：返回所有用户

// 攻击：输入 username = "'; DROP TABLE users; --"
// 实际执行：SELECT * FROM users WHERE username = ''; DROP TABLE users; --
// 结果：users 表被删除

// 攻击：输入 username = "1' UNION SELECT * FROM passwords; --"
// 结果：可能泄露密码表

public class SecureUserRepository {
    
    private final JdbcTemplate jdbcTemplate;
    
    // 正确：使用参数化查询
    public User findByUsername(String username) {
        String sql = "SELECT * FROM users WHERE username = ?";
        return jdbcTemplate.queryForObject(sql, 
            (rs, rowNum) -> mapToUser(rs), 
            username);
    }
    
    // 正确：使用 MyBatis #{} 语法
    // Mapper 接口
    public interface UserMapper {
        @Select("SELECT * FROM users WHERE username = #{username}")
        User findByUsername(@Param("username") String username);
    }
    
    // 正确：使用 JPA 参数化查询
    public interface UserRepository extends JpaRepository<User, Long> {
        @Query("SELECT u FROM User u WHERE u.username = :username")
        User findByUsername(@Param("username") String username);
    }
}

public class SecureCommandExecutor {
    
    // 危险：不使用用户输入执行命令
    public String executePredefinedCommand(String commandName) {
        // 好：只允许预定义的命令
        Map<String, String[]> allowedCommands = Map.of(
            "list", new String[]{"ls", "-la"},
            "status", new String[]{"systemctl", "status", "myapp"}
        );
        
        String[] command = allowedCommands.get(commandName);
        if (command == null) {
            throw new IllegalArgumentException("不允许的命令");
        }
        
        return executeCommand(command);
    }
    
    // 好：使用 ProcessBuilder 且参数被严格验证
    private String executeCommand(String[] command) {
        ProcessBuilder pb = new ProcessBuilder(command);
        pb.redirectErrorStream(true);
        
        try {
            Process process = pb.start();
            return new String(process.getInputStream().readAllBytes());
        } catch (IOException e) {
            throw new RuntimeException("命令执行失败", e);
        }
    }
}

// 漏洞：未验证促销规则
public class PromotionService {
    
    public Order applyPromotion(Order order, String promoCode) {
        Promotion promo = promoRepository.findByCode(promoCode);
        
        // 漏洞：未检查用户是否已使用过该促销码
        // 攻击：同一用户多次使用促销码
        order.setDiscount(promo.getDiscount());
        return order;
    }
}

// 漏洞：并发导致超卖
public class InventoryService {
    
    public boolean decreaseStock(Long productId, int quantity) {
        // 危险：在检查和更新之间没有原子性保证
        Product product = productRepository.findById(productId);
        if (product.getStock() >= quantity) {
            product.setStock(product.getStock() - quantity);
            productRepository.save(product);
            return true;
        }
        return false;
    }
}

// 正确：使用乐观锁或悲观锁
public class SecureInventoryService {
    
    @Transactional
    public boolean decreaseStock(Long productId, int quantity) {
        // 方法 1：乐观锁
        int updated = productRepository.decreaseStockWithVersion(
            productId, quantity);
        return updated > 0;
    }
    
    // 方法 2：悲观锁
    @Transactional
    public boolean decreaseStockWithLock(Long productId, int quantity) {
        Product product = productRepository.findByIdWithLock(productId);
        if (product.getStock() >= quantity) {
            product.setStock(product.getStock() - quantity);
            productRepository.save(product);
            return true;
        }
        return false;
    }
}

public class SecureDesignPatterns {
    
    // 1. 防御式编程：验证所有输入
    public void processOrder(OrderRequest request) {
        // 前置条件验证
        validateOrderRequest(request);
        
        // 业务规则验证
        validateBusinessRules(request);
        
        // 幂等性验证
        if (!isIdempotent(request.getId())) {
            throw new DuplicateOrderException();
        }
        
        // 执行订单处理
        doProcessOrder(request);
    }
    
    // 2. 事务边界：确保原子性
    @Transactional(isolation = Isolation.SERIALIZABLE)
    public void criticalOperation() {
        // 所有相关操作在同一个事务中
    }
    
    // 3. 审计日志：记录所有敏感操作
    @Audited
    public void sensitiveOperation() {
        // 记录操作人、时间、操作内容、结果
    }
}

// 漏洞：允许所有来源
@Configuration
public class UnsafeCorsConfig implements WebMvcConfigurer {
    
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**")
            .allowedOrigins("*")  // 危险：允许所有来源
            .allowedMethods("*")
            .allowedHeaders("*")
            .allowCredentials(true);  // 危险：credentials 需要具体 origin
    }
}

// 正确：明确允许的来源
@Configuration
public class SecureCorsConfig implements WebMvcConfigurer {
    
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**")
            .allowedOrigins(
                "https://www.example.com",
                "https://admin.example.com"
            )
            .allowedMethods("GET", "POST", "PUT", "DELETE")
            .allowedHeaders("Content-Type", "Authorization")
            .exposedHeaders("X-Request-Id")
            .allowCredentials(true)
            .maxAge(3600);
    }
}

public class DependencyManagement {
    
    // 依赖版本策略
    public static final DependencyStrategy STRATEGY = 
        new DependencyStrategy()
        // 优先使用最新稳定版
        .preferLatestStable(true)
        // 定期更新依赖
        .updateFrequency(Duration.ofDays(7))
        // 记录所有依赖变更
        .trackChanges(true)
        // 自动更新补丁版本
        .autoUpdatePatch(true)
        // 人工审核次版本和主版本更新
        .autoUpdateMinor(false)
        .autoUpdateMajor(false);
}

@Configuration
public class SessionSecurityConfig {
    
    @Bean
    public SessionRegistry sessionRegistry() {
        return new SpringSessionRegistry();
    }
    
    @Bean
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
        
        // 安全 Cookie 配置
        serializer.setUseHttpOnlyCookie(true);    // 防止 XSS
        serializer.setUseSecureCookie(true);      // 仅 HTTPS
        serializer.setCookieSameSite("Strict");  // CSRF 防护
        serializer.setCookieName("SESSION");
        serializer.setCookiePath("/");
        serializer.setDomainName("example.com");
        serializer.setCookieMaxAge(Duration.ofHours(2));
        
        return serializer;
    }
}

@Component
public class SessionManagementService {
    
    // 会话 fixation 防护
    public void login(HttpServletRequest request, HttpSession session) {
        // 登录成功后创建新会话
        session.invalidate();
        HttpSession newSession = request.getSession(true);
        newSession.setAttribute("USER_ID", user.getId());
        
        // 生成新的会话 ID
        String newSessionId = newSession.getId();
        
        // 将会话 ID 存储在安全 Cookie 中
        response.setHeader("Set-Cookie", 
            "SESSION=" + newSessionId + 
            "; HttpOnly; Secure; SameSite=Strict");
    }
}

public class PasswordValidator {
    
    private static final int MIN_LENGTH = 12;
    private static final int MAX_LENGTH = 128;
    
    // OWASP 密码规则
    public ValidationResult validate(String password) {
        ValidationResult result = new ValidationResult();
        List<String> errors = new ArrayList<>();
        
        // 长度检查
        if (password.length() < MIN_LENGTH) {
            errors.add("密码长度至少 " + MIN_LENGTH + " 位");
        }
        if (password.length() > MAX_LENGTH) {
            errors.add("密码长度不能超过 " + MAX_LENGTH + " 位");
        }
        
        // 复杂度检查
        if (!password.matches(".*[a-z].*")) {
            errors.add("必须包含小写字母");
        }
        if (!password.matches(".*[A-Z].*")) {
            errors.add("必须包含大写字母");
        }
        if (!password.matches(".*\\d.*")) {
            errors.add("必须包含数字");
        }
        if (!password.matches(".*[!@#$%^&*()_+\\-=\\[\\]{};':\"\\\\|,.<>/?].*")) {
            errors.add("必须包含特殊字符");
        }
        
        // 常见密码检查
        if (isCommonPassword(password)) {
            errors.add("密码过于简单，请使用更复杂的密码");
        }
        
        // 用户信息关联检查
        if (containsUserInfo(password)) {
            errors.add("密码不能包含用户名或个人信息");
        }
        
        result.setValid(errors.isEmpty());
        result.setErrors(errors);
        return result;
    }
}

public class SecureDeserialization {
    
    // 危险：使用不安全的反序列化
    public Object unsafeDeserialize(byte[] data) 
            throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(
            new ByteArrayInputStream(data));
        return ois.readObject();  // 危险：可以执行任意代码
    }
    
    // 正确：使用白名单
    public Object safeDeserialize(byte[] data, 
                                  Set<Class<?>> allowedClasses) 
            throws IOException, ClassNotFoundException {
        ByteArrayInputStream bais = new ByteArrayInputStream(data);
        
        // 使用自定义 ObjectInputStream
        ValidatingObjectInputStream vois = 
            new ValidatingObjectInputStream(bais);
        vois.accept(allowedClasses.toArray(new Class[0]));
        
        return vois.readObject();
    }
    
    // 最佳实践：使用 JSON 代替 Java 序列化
    public String serializeToJson(Object obj) {
        ObjectMapper mapper = new ObjectMapper();
        mapper.registerModule(new JavaTimeModule());
        return mapper.writeValueAsString(obj);
    }
    
    public <T> T deserializeFromJson(String json, Class<T> clazz) {
        ObjectMapper mapper = new ObjectMapper();
        mapper.registerModule(new JavaTimeModule());
        return mapper.readValue(json, clazz);
    }
}

@Slf4j
@Component
public class SecurityAuditLogger {
    
    // 用户登录审计
    public void logLoginAttempt(String username, String ip, 
                                 boolean success, String reason) {
        log.info("AUTH_LOGIN - user: {}, ip: {}, success: {}, reason: {}, " +
                 "timestamp: {}, sessionId: {}",
            username, ip, success, reason, 
            Instant.now(), SecurityContext.getSessionId());
    }
    
    // 访问控制审计
    public void logAccessDenied(String username, String resource, 
                                 String action, String reason) {
        log.warn("ACCESS_DENIED - user: {}, resource: {}, action: {}, " +
                 "reason: {}, timestamp: {}, requestId: {}",
            username, resource, action, reason,
            Instant.now(), RequestContext.getRequestId());
    }
    
    // 敏感操作审计
    public void logSensitiveAction(String username, String action, 
                                    Map<String, Object> details) {
        log.info("SENSITIVE_ACTION - user: {}, action: {}, details: {}, " +
                 "timestamp: {}, ip: {}",
            username, action, JsonUtils.toJson(details),
            Instant.now(), RequestContext.getClientIp());
    }
    
    // 异常审计（不泄露敏感信息）
    public void logSecurityException(Exception e, HttpRequest request) {
        // 不记录堆栈信息
        log.error("SECURITY_EXCEPTION - type: {}, message: {}, " +
                  "timestamp: {}, requestId: {}, uri: {}",
            e.getClass().getSimpleName(),
            sanitizeMessage(e.getMessage()),  // 净化消息
            Instant.now(),
            RequestContext.getRequestId(),
            request.getRequestURI());
    }
}

// 漏洞：用户可以指定要获取的 URL
@RestController
public class UnsafeUrlController {
    
    @GetMapping("/fetch")
    public String fetchUrl(@RequestParam String url) {
        // 漏洞：直接使用用户输入的 URL
        return restTemplate.getForObject(url, String.class);
    }
    
    // 攻击示例
    // GET /fetch?url=http://169.254.169.254/latest/meta-data/
    // 攻击者可能获取云服务器的 IAM 凭证
    
    // GET /fetch?url=file:///etc/passwd
    // 攻击者可能读取本地文件
    
    // GET /fetch?url=http://internal-server/admin
    // 攻击者可能访问内部管理系统
}

public class SecureUrlFetcher {
    
    private final RestTemplate restTemplate;
    private final Set<String> allowedHosts;
    private final Set<String> blockedHosts;
    
    public SecureUrlFetcher() {
        this.allowedHosts = Set.of(
            "api.example.com",
            "cdn.example.com"
        );
        this.blockedHosts = Set.of(
            "localhost",
            "127.0.0.1",
            "169.254.169.254",  // 云元数据端点
            "0.0.0.0",
            "metadata.google.internal"
        );
    }
    
    public String fetchUrl(String userUrl) {
        // 1. 解析 URL
        URL parsedUrl = parseUrl(userUrl);
        
        // 2. 验证协议
        if (!"http".equals(parsedUrl.getProtocol()) && 
            !"https".equals(parsedUrl.getProtocol())) {
            throw new IllegalArgumentException("不允许的协议");
        }
        
        // 3. 验证主机
        String host = parsedUrl.getHost().toLowerCase();
        if (isBlockedHost(host)) {
            throw new SecurityException("不允许访问该主机");
        }
        
        if (!allowedHosts.isEmpty() && !allowedHosts.contains(host)) {
            throw new SecurityException("主机不在白名单中");
        }
        
        // 4. 解析 DNS 防止 DNS 重绑定
        String resolvedIp = dnsResolver.resolve(host);
        if (isPrivateIp(resolvedIp)) {
            throw new SecurityException("解析到内网 IP");
        }
        
        // 5. 执行请求（带超时）
        return restTemplate.getForObject(userUrl, String.class);
    }
    
    private boolean isPrivateIp(String ip) {
        InetAddress address;
        try {
            address = InetAddress.getByName(ip);
        } catch (UnknownHostException e) {
            return true;
        }
        
        // 检查私有 IP 范围
        return address.isSiteLocalAddress() ||
               address.isLinkLocalAddress() ||
               address.isLoopbackAddress() ||
               address.isAnyLocalAddress();
    }
}