Skip to content

Commit 590891b

Browse files
JoyChou93JoyChou93
committed
add csrf
1 parent 5b60e15 commit 590891b

File tree

8 files changed

+136
-8
lines changed

8 files changed

+136
-8
lines changed

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/JSONP.java)
2626
- [SPEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SPEL.java)
2727
- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/resources/logback.xml)
28+
- [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CSRF.java)
2829

2930
## 漏洞说明
3031

@@ -36,6 +37,7 @@
3637
- [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF)
3738
- [JSONP](https://github.com/JoyChou93/java-sec-code/wiki/JSONP)
3839
- [Actuators to RCE](https://github.com/JoyChou93/java-sec-code/wiki/Actuators-to-RCE)
40+
- [CSRF](https://github.com/JoyChou93/java-sec-code/wiki/CSRF)
3941
- [Others](https://github.com/JoyChou93/java-sec-code/wiki/others)
4042

4143

‎java-sec-code.iml

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
</configuration>
1313
</facet>
1414
</component>
15-
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_8">
15+
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_6">
1616
<output url="file://$MODULE_DIR$/target/classes" />
1717
<output-test url="file://$MODULE_DIR$/target/test-classes" />
1818
<content url="file://$MODULE_DIR$">
@@ -41,7 +41,6 @@
4141
<orderEntry type="library" name="Maven: org.slf4j:jcl-over-slf4j:1.7.22" level="project" />
4242
<orderEntry type="library" name="Maven: org.slf4j:jul-to-slf4j:1.7.22" level="project" />
4343
<orderEntry type="library" name="Maven: org.slf4j:log4j-over-slf4j:1.7.22" level="project" />
44-
<orderEntry type="library" name="Maven: org.springframework:spring-core:4.3.6.RELEASE" level="project" />
4544
<orderEntry type="library" scope="RUNTIME" name="Maven: org.yaml:snakeyaml:1.17" level="project" />
4645
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-tomcat:1.5.1.RELEASE" level="project" />
4746
<orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-core:8.5.11" level="project" />
@@ -55,11 +54,7 @@
5554
<orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-annotations:2.8.0" level="project" />
5655
<orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-core:2.8.6" level="project" />
5756
<orderEntry type="library" name="Maven: org.springframework:spring-web:4.3.6.RELEASE" level="project" />
58-
<orderEntry type="library" name="Maven: org.springframework:spring-aop:4.3.6.RELEASE" level="project" />
59-
<orderEntry type="library" name="Maven: org.springframework:spring-beans:4.3.6.RELEASE" level="project" />
60-
<orderEntry type="library" name="Maven: org.springframework:spring-context:4.3.6.RELEASE" level="project" />
6157
<orderEntry type="library" name="Maven: org.springframework:spring-webmvc:4.3.6.RELEASE" level="project" />
62-
<orderEntry type="library" name="Maven: org.springframework:spring-expression:4.3.6.RELEASE" level="project" />
6358
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-thymeleaf:1.5.1.RELEASE" level="project" />
6459
<orderEntry type="library" name="Maven: org.thymeleaf:thymeleaf-spring4:2.1.5.RELEASE" level="project" />
6560
<orderEntry type="library" name="Maven: org.thymeleaf:thymeleaf:2.1.5.RELEASE" level="project" />
@@ -125,7 +120,6 @@
125120
<orderEntry type="library" scope="RUNTIME" name="Maven: com.sun.jersey.contribs:jersey-apache-client4:1.19.1" level="project" />
126121
<orderEntry type="library" scope="RUNTIME" name="Maven: com.google.inject:guice:4.0" level="project" />
127122
<orderEntry type="library" scope="RUNTIME" name="Maven: javax.inject:javax.inject:1" level="project" />
128-
<orderEntry type="library" scope="RUNTIME" name="Maven: aopalliance:aopalliance:1.0" level="project" />
129123
<orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.governator:governator-api:1.12.10" level="project" />
130124
<orderEntry type="library" name="Maven: com.netflix.eureka:eureka-core:1.4.11" level="project" />
131125
<orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.governator:governator:1.12.10" level="project" />
@@ -165,5 +159,15 @@
165159
<orderEntry type="library" name="Maven: xmlpull:xmlpull:1.1.3.1" level="project" />
166160
<orderEntry type="library" name="Maven: xpp3:xpp3_min:1.1.4c" level="project" />
167161
<orderEntry type="library" name="Maven: com.fasterxml.uuid:java-uuid-generator:3.1.4" level="project" />
162+
<orderEntry type="library" name="Maven: org.springframework.security:spring-security-web:4.2.12.RELEASE" level="project" />
163+
<orderEntry type="library" name="Maven: aopalliance:aopalliance:1.0" level="project" />
164+
<orderEntry type="library" name="Maven: org.springframework.security:spring-security-core:4.2.1.RELEASE" level="project" />
165+
<orderEntry type="library" name="Maven: org.springframework:spring-beans:4.3.6.RELEASE" level="project" />
166+
<orderEntry type="library" name="Maven: org.springframework:spring-context:4.3.6.RELEASE" level="project" />
167+
<orderEntry type="library" name="Maven: org.springframework:spring-core:4.3.6.RELEASE" level="project" />
168+
<orderEntry type="library" name="Maven: org.springframework:spring-expression:4.3.6.RELEASE" level="project" />
169+
<orderEntry type="library" name="Maven: org.springframework.security:spring-security-config:4.2.12.RELEASE" level="project" />
170+
<orderEntry type="library" name="Maven: org.springframework:spring-aop:4.3.6.RELEASE" level="project" />
171+
<orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-security:2.1.5.RELEASE" level="project" />
168172
</component>
169173
</module>

‎pom.xml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,25 @@
136136
<version>3.1.4</version>
137137
</dependency>
138138

139+
<!-- 5.x的spring-security版本不适配springboot 1.5，因为1.5的springboot的spring-core版本是4.x，所以spring-security改为4.x即可适配。 -->
140+
<dependency>
141+
<groupId>org.springframework.security</groupId>
142+
<artifactId>spring-security-web</artifactId>
143+
<version>4.2.12.RELEASE</version>
144+
</dependency>
145+
146+
<dependency>
147+
<groupId>org.springframework.security</groupId>
148+
<artifactId>spring-security-config</artifactId>
149+
<version>4.2.12.RELEASE</version>
150+
</dependency>
151+
152+
<dependency>
153+
<groupId>org.springframework.boot</groupId>
154+
<artifactId>spring-boot-starter-security</artifactId>
155+
<version>2.1.5.RELEASE</version>
156+
</dependency>
157+
139158
</dependencies>
140159

141160
<dependencyManagement>

‎src/main/java/org/joychou/Application.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99

1010
@SpringBootApplication
11-
@EnableEurekaClient
11+
// @EnableEurekaClient // 测试Eureka请打开注释，防止控制台一直有warning
1212
public class Application extends SpringBootServletInitializer {
1313

1414
@Override

‎src/main/java/org/joychou/WebSecurityConfig.java

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
package org.joychou;
2+
3+
import org.springframework.context.annotation.Configuration;
4+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
5+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
6+
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
7+
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
8+
9+
@EnableWebSecurity
10+
@Configuration
11+
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
12+
13+
@Override
14+
protected void configure(HttpSecurity http) throws Exception {
15+
// http.csrf().disable() // 去掉csrf校验
16+
// 默认token存在session里，现在改为token存在cookie里。但存在后端多台服务器情况，session不能同步的问题，所以一般使用cookie模式。
17+
http.csrf().csrfTokenRepository(new CookieCsrfTokenRepository());
18+
// http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
19+
}
20+
}

‎src/main/java/org/joychou/controller/CSRF.java

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
package org.joychou.controller;
2+
3+
import org.springframework.stereotype.Controller;
4+
import org.springframework.web.bind.annotation.GetMapping;
5+
import org.springframework.web.bind.annotation.PostMapping;
6+
import org.springframework.web.bind.annotation.RequestMapping;
7+
import org.springframework.web.bind.annotation.ResponseBody;
8+
9+
/**
10+
* @author: JoyChou (joychou@joychou.org)
11+
* @date: 2019.05.31
12+
* @desc: check csrf using spring-security
13+
* @using: access http://localhost:8080/csrf/ -> click submit
14+
*/
15+
16+
17+
@Controller
18+
@RequestMapping("/csrf")
19+
public class CSRF {
20+
21+
@GetMapping("/")
22+
public String index() {
23+
return "csrfTest";
24+
}
25+
26+
@PostMapping("/post")
27+
@ResponseBody
28+
public String post() {
29+
return "CSRF passed.";
30+
}
31+
}

‎src/main/java/org/joychou/controller/Test.java

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
package org.joychou.controller;
2+
3+
import org.springframework.stereotype.Controller;
4+
import org.springframework.web.bind.annotation.RequestMapping;
5+
import org.springframework.web.bind.annotation.ResponseBody;
6+
7+
import javax.servlet.http.Cookie;
8+
import javax.servlet.http.HttpServletResponse;
9+
10+
@Controller
11+
@RequestMapping("/test")
12+
public class Test {
13+
14+
@RequestMapping(value = "/")
15+
@ResponseBody
16+
private String Index(HttpServletResponse response) {
17+
18+
Cookie cookie = new Cookie("XSRF-TOKEN", "123");
19+
cookie.setDomain("taobao.com");
20+
cookie.setMaxAge(-1); // forever time
21+
response.addCookie(cookie);
22+
return "success";
23+
}
24+
25+
}

‎src/main/resources/templates/csrfTest.html

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
2+
<html xmlns:th="http://www.thymeleaf.org" lang="en">
3+
4+
<body>
5+
6+
7+
<div>
8+
<form name="f" th:action="@{/csrf/post}" method="post">
9+
<input type="text" name="input" />
10+
<input type="submit" value="Submit" />
11+
</form>
12+
</div>
13+
14+
15+
</body>
16+
17+
18+
<!-- <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}" /> -->
19+
20+
<!--<script>-->
21+
<!--window.csrfToken = {-->
22+
<!--tokenName: "${_csrf.parameterName}",-->
23+
<!--tokenValue: "${_csrf.token}"-->
24+
<!--};-->
25+
<!--</script>-->
26+
27+
</html>

0 commit comments

Comments
 (0)