add csrf fix case

b4zinga · May 9, 2023 · b016389 · b016389
1 parent 61cf080
commit b016389
Show file tree

Hide file tree

Showing 3 changed files with 80 additions and 5 deletions.
diff --git a/README.md b/README.md
@@ -14,7 +14,7 @@
 | OGNL注入 | 1 | 1 |
 | SQL注入 | 4 | 8 |
 | SSRF | 1 | 5 |
-| CSRF | 1 | 1 |
+| CSRF | 1 | 2 |
 | 任意文件上传 | 1 | 2 |
 | XSS | 1 | 1 |
 | XXE | 1 | 1 |

diff --git a/src/main/java/com/example/vulnerablejava/controller/CSRFController.java b/src/main/java/com/example/vulnerablejava/controller/CSRFController.java
@@ -42,16 +42,15 @@ public String listUsers(){
     @GetMapping("1")
     public String addUser(User newUser, HttpServletRequest request) {
         User user = (User) request.getSession().getAttribute("user");
-        if (user != null && newUser != null) {
+        if (user != null) {
             userMapper.addUser(newUser);
             return "New user id: " + newUser.getId().toString();
         }
-        return "非法请求";
+        return "请登录";
     }
 
     /**
      * 修复CSRF漏洞，增加CSRF Token校验
-     * @throws IOException
      */
     @ApiOperation("修复CSRF漏洞")
     @GetMapping("safe")
@@ -60,17 +59,36 @@ public String safeAddUser(User newUser, HttpServletRequest request, HttpServletR
         String csrfSessionToken = (String) request.getSession().getAttribute("csrftoken");
         String csrfFormToken = request.getParameter("_csrf");
 
+        if (user == null) {
+            return "请登录";
+        }
+
         if (csrfSessionToken == null) {
             csrfSessionToken = CSRFUtil.generateToken();
             request.getSession().setAttribute("csrftoken", csrfSessionToken);
             Cookie cookie = new Cookie("_csrf", csrfSessionToken);
             response.addCookie(cookie);
         } else {
-            if (csrfSessionToken.equals(csrfFormToken) && user != null && newUser != null) {
+            if (csrfSessionToken.equals(csrfFormToken)) {
                     userMapper.addUser(newUser);
                     return "New user id: " + newUser.getId().toString();
             }
         }
         return "非法请求";
     }
+
+    /**
+     * 修复CSRF漏洞，通过filter校验CSRF Token
+     */
+    @ApiOperation("修复CSRF漏洞")
+    @GetMapping("safe2")
+    public String safeAddUser2(User newUser,  HttpServletRequest request) {
+        User user = (User) request.getSession().getAttribute("user");
+        if (user != null) {
+            userMapper.addUser(newUser);
+            return "New user id: " + newUser.getId().toString();
+        } else {
+            return "请登录";
+        }
+    }
 }
diff --git a/src/main/java/com/example/vulnerablejava/filter/CSRFFilter.java b/src/main/java/com/example/vulnerablejava/filter/CSRFFilter.java
@@ -0,0 +1,57 @@
+package com.example.vulnerablejava.filter;
+
+import java.io.IOException;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.stereotype.Component;
+
+import com.example.vulnerablejava.utils.CSRFUtil;
+
+@Component
+public class CSRFFilter implements Filter{
+
+    String[] checkUrlList = {"/csrf/safe2"};
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
+        HttpServletResponse httpServletResponse = (HttpServletResponse) response;
+        String url = httpServletRequest.getRequestURI();
+        if (!needTobeChecked(url)) {
+            chain.doFilter(request, response);
+            return;
+        }
+        String csrfFormToken = httpServletRequest.getParameter("_csrf");
+        String csrfSessionToken = (String) httpServletRequest.getSession().getAttribute("csrftoken");
+        if (csrfSessionToken == null) {
+            csrfSessionToken = CSRFUtil.generateToken();
+            httpServletRequest.getSession().setAttribute("csrftoken", csrfSessionToken);
+            Cookie cookie = new Cookie("_csrf", csrfSessionToken);
+            httpServletResponse.addCookie(cookie);
+        }
+        if (csrfFormToken != null && csrfFormToken.equals(csrfSessionToken)) {
+            chain.doFilter(request, response);
+        } else {
+            response.setContentType("text/html; charset=utf-8");
+            response.getWriter().write("非法请求, from csrf filter");
+        }
+    }
+
+    private boolean needTobeChecked(String uri) {
+        for (String url : checkUrlList) {
+            if (uri.startsWith(url, 0)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}