密码验证加-

whyclxw

2025-05-28 e16302f9d475c7cc4dd18c5abf1a23cb5502e362

 src/main/java/com/whyc/filter/LDAPFilter.java

@@ -11,6 +11,7 @@
import java.io.BufferedReader;
import java.io.IOException;
import java.util.Enumeration;
import java.util.Locale;

/**
 * 防止LDAP盲注
@@ -31,6 +32,7 @@
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        //Locale.setDefault(Locale.ENGLISH);
        //严格要求
        if(2 == YamlProperties.systemType) {
            String requestURI = request.getRequestURI();
@@ -49,13 +51,16 @@
                        //paramValue = paramValue.replace(String.valueOf(LDAP_FILTER_ESCAPE_SEQUENCE[charIndex]), LDAP_FILTER_ESCAPE_SEQUENCE_CHARACTER[charIndex]);
                        //这个里面是允许*的,可以放过
                        if (
                                (requestURI.contains("user/") && c == '*' && (request.getMethod().toUpperCase().equals(RequestMethod.POST.name()) || request.getMethod().toUpperCase().equals(RequestMethod.PUT.name())))
                                (requestURI.contains("user/") && c == '*' && (request.getMethod().toUpperCase(Locale.ENGLISH).equals(RequestMethod.POST.name()) || request.getMethod().toUpperCase(Locale.ENGLISH).equals(RequestMethod.PUT.name())))
                                || (requestURI.contains("/EchartPictureDowload/exportExcel") && c == '/' && (request.getMethod().toUpperCase(Locale.ENGLISH).equals(RequestMethod.POST.name()) || request.getMethod().toUpperCase(Locale.ENGLISH).equals(RequestMethod.PUT.name())))

                        ) {
                            continue;
                        } else if ((requestURI.contains(".servlet") || requestURI.contains("menu/menuList")) && c == '/') {
                            continue;
                        }
                        response.setStatus(403);
                        response.setContentType("text/html;charset=utf-8");
                        response.getWriter().write("非法请求,不允许包含特殊字符");
                        return;
                    }
@@ -77,7 +82,8 @@
                if (index != -1) {
                    //这个里面是允许*的,可以放过
                    if (
                            (requestURI.contains("user/") && c == '*' && (request.getMethod().toUpperCase().equals(RequestMethod.POST.name()) || request.getMethod().toUpperCase().equals(RequestMethod.PUT.name())))
                            (requestURI.contains("/user") && (c == '*' || c =='/' ) && (request.getMethod().toUpperCase(Locale.ENGLISH).equals(RequestMethod.POST.name()) || request.getMethod().toUpperCase(Locale.ENGLISH).equals(RequestMethod.PUT.name())))
                            || (requestURI.contains("/EchartPictureDowload/exportExcel") && c == '/' && (request.getMethod().toUpperCase(Locale.ENGLISH).equals(RequestMethod.POST.name()) || request.getMethod().toUpperCase(Locale.ENGLISH).equals(RequestMethod.PUT.name())))

                    ) {
                        continue;
@@ -87,6 +93,7 @@

                    //paramValue = paramValue.replace(String.valueOf(LDAP_FILTER_ESCAPE_SEQUENCE[charIndex]), LDAP_FILTER_ESCAPE_SEQUENCE_CHARACTER[charIndex]);
                    response.setStatus(403);
                    response.setContentType("text/html;charset=utf-8");
                    response.getWriter().write("非法请求,不允许包含特殊字符");
                    return;
                }