Web应用防火墙（WAF）#

// 简化示例：基于速率的异常检测
public class RateLimitDetector {
    private final Map<String, RateWindow> clientStats = new ConcurrentHashMap<>();
    private static final int MAX_REQUESTS_PER_MINUTE = 100;
    
    public DetectionResult detect(String clientIp, String requestUri) {
        RateWindow window = clientStats.computeIfAbsent(
            clientIp, k -> new RateWindow()
        );
        
        if (window.incrementAndGet() > MAX_REQUESTS_PER_MINUTE) {
            return DetectionResult.builder()
                .threat(true)
                .reason("Rate limit exceeded")
                .score(0.9)
                .build();
        }
        
        // 检测异常扫描行为
        if (window.getUniqueUris().size() > 1000) {
            return DetectionResult.builder()
                .threat(true)
                .reason("Possible directory scanning")
                .score(0.8)
                .build();
        }
        
        return DetectionResult.builder().threat(false).build();
    }
}

// 攻击示例
// 正常查询: SELECT * FROM users WHERE id = 1
// 注入攻击: SELECT * FROM users WHERE id = 1 OR 1=1

// WAF 检测点
public class SqlInjectionDetector {
    // 检测常见的 SQL 注入模式
    public boolean isSqlInjection(String input) {
        String[] sqlKeywords = {
            "union", "select", "insert", "update", "delete",
            "drop", "exec", "execute", "script", "javascript"
        };
        
        String lowerInput = input.toLowerCase();
        for (String keyword : sqlKeywords) {
            if (lowerInput.contains(keyword)) {
                // 进一步分析上下文，区分正常内容和注入
                if (looksLikeInjection(lowerInput, keyword)) {
                    return true;
                }
            }
        }
        return false;
    }
}

// CSRF Token 验证
public class CsrfProtectionFilter {
    public boolean validateRequest(HttpRequest request) {
        String csrfToken = request.getHeader("X-CSRF-Token");
        String sessionToken = sessionManager.getCsrfToken(request.getSessionId());
        
        // Token 存在且匹配
        if (csrfToken != null && csrfToken.equals(sessionToken)) {
            // 验证 Referer/Origin 头
            String referer = request.getHeader("Referer");
            String origin = request.getHeader("Origin");
            return isValidOrigin(referer, origin, request.getHost());
        }
        
        return false;
    }
}