fix： xss漏洞修复:Saas层增加Xss转义中间件 #844
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wklken
reviewed
Dec 15, 2022
| self.__escape_param_list = [] | ||
| super(CheckXssMiddleware, self).__init__(*args, **kwargs) | ||
|
|
||
| def process_view(self, request, view, args, kwargs): |
There was a problem hiding this comment.
# 支持豁免
if getattr(view, 'escape_exempt', False):
return None
# if method not match, return
if request.method not in ["....]
return
# check if is json
is_json = False
try:
json.loads(....)
is_json = True
except:
is_json = False
if not is_json:
return
try:
......
except Exception:
logger.exception() # 不要用log.error
|
|
||
| def _transfer(self, _get_value): | ||
| if isinstance(_get_value, list): | ||
| return [escape_name(_value) for _value in _get_value if isinstance(_value, str)] |
There was a problem hiding this comment.
如果不是字符串就被丢弃了? ["a", 1, "b"]
| an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the | ||
| specific language governing permissions and limitations under the License. | ||
| """ | ||
|
|
| input_str = input_str.replace(">", "") | ||
| input_str = input_str.replace('"', "") | ||
| input_str = input_str.replace("'", "") | ||
| return input_str |
There was a problem hiding this comment.
没法证明这个中间件是正确的, 因为没有单侧, 并且即使有, 也无法覆盖到所有输入场景
There was a problem hiding this comment.
虽然现在都是json, 但是不保证未来不会有其他提交方式; 这个实现过于定制
|
无法证明中间件正确, 无法覆盖所有场景, 引入风险太高 #796 的处理
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.