shiro安全框架扩展教程--设计数据对象校验器,如何防止xss以及csrf攻击

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
package com.silvery.plugin.validator;

/**
 * 数据校验器接口
 * 
 * @author shadow
 * 
 * @param <R>
 *            视图类型
 * @param <T>
 *            校验对象
 */
public interface FormValidator<R, T> {

	public R validate(T t) throws FormValidateException;

}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
package com.silvery.plugin.validator;

import java.util.Map;

/**
 * 数据校验结果视图
 * 
 * @author shadow
 * 
 */
public class FormValidateResult {

	private boolean success; // true=成功;false=失败
	private Map<String, Object> errorMap; // 失败对应信息

	public FormValidateResult() {
		this(false);
	}

	public FormValidateResult(boolean success) {
		this.success = success;
	}

	public boolean isSuccess() {
		return success;
	}

	public void setSuccess(boolean success) {
		this.success = success;
	}

	public Map<String, Object> getErrorMap() {
		return errorMap;
	}

	public void setErrorMap(Map<String, Object> errorMap) {
		this.errorMap = errorMap;
	}

}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
package com.silvery.plugin.validator;

import java.lang.reflect.Method;
import java.util.List;

import com.silvery.utils.ReflectUtils;

/**
 * 
 * 数据校验器执行类
 * 
 * @author shadow
 * 
 */
public class SimpleFormValidator<T> {

	/**
	 * 表单校验方法
	 * 
	 * @param t
	 *            校验数据对象
	 * @return 数据校验视图
	 * @throws FormValidateException
	 *             校验异常
	 */
	public FormValidateResult validate(T t) throws FormValidateException {
		return validate(null, t);
	}

	/**
	 * 表单校验方法
	 * 
	 * @param validator
	 *            用户自定义校验器
	 * @param t
	 *            校验数据对象
	 * @return 数据校验视图
	 * @throws FormValidateException
	 *             校验异常
	 */
	public FormValidateResult validate(FormValidator<FormValidateResult, T> validator, T t)
			throws FormValidateException {
		FormValidateResult validateResult = new FormValidateResult();
		// 优先执行用户自定义校验器,如不通过则跳出
		if (validator != null) {
			validateResult = validator.validate(t);
			if (!validateResult.isSuccess()) {
				return validateResult;
			}
		}
		return validateForXSS(t);
	}

	/** 校验是否存在XSS攻击脚本,当前只检测String类型声明字段 */
	private FormValidateResult validateForXSS(T t) {
		List<Method> methods = ReflectUtils.getMethods(t.getClass());
		for (Method method : methods) {
			if (method.getName().startsWith("set")) {
				Class<?>[] parameterClass = method.getParameterTypes();
				// 参数不能为null, 参数只有一个, 参数类型只能是String
				if (parameterClass != null && parameterClass.length == 1 && parameterClass[0].equals(String.class)) {
					// ReflectUtils.writeValueByMethod(t, method, "test");
				}
			}
		}
		return new FormValidateResult(true);
	}

}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
package com.silvery.project.cms.validator;

import java.util.HashMap;
import java.util.Map;

import com.silvery.plugin.validator.FormValidateException;
import com.silvery.plugin.validator.FormValidateResult;
import com.silvery.plugin.validator.FormValidator;
import com.silvery.project.cms.model.Authority;

/**
 * 权限实体数据校验器实现
 * 
 * @author shadow
 * 
 */
public class AuthorityFormValidator implements FormValidator<FormValidateResult, Authority> {

	@Override
	public FormValidateResult validate(Authority t) throws FormValidateException {
		// TODO do some validate operate
		FormValidateResult formValidateResult = new FormValidateResult();
		Map<String, Object> errorFieldMap = new HashMap<String, Object>();
		formValidateResult.setSuccess(true);
		formValidateResult.setErrorMap(errorFieldMap);
		return formValidateResult;
	}

}

1
2
3
4
5
6
7
8
9
/** 校验对象数据合法性 */
	protected ServiceResult<T> validateForm(ServiceResult<T> serviceResult, T t) throws FormValidateException {
		FormValidateResult formValidateResult = new SimpleFormValidator<T>().validate(initFormValidator(), t);
		if (formValidateResult.isSuccess()) {
			return serviceResult.setSuccess(true);
		} else {
			return formValidateResult2ViewResult(serviceResult, formValidateResult);
		}
	}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
@Override
	public ServiceResult<T> insert(T model) {
		ServiceResult<T> serviceResult = createServiceResult();
		try {
			serviceResult = validateForm(serviceResult, model);
			if (!serviceResult.isSuccess()) {
				return serviceResult;
			}
			int count = getDefaultDao().insert(model);
			if (count > 0) {
				serviceResult.setSuccess(true).setMessage(
						new StringBuffer("成功保存[").append(count).append("]条记录").toString());
			} else {
				serviceResult.setMessage("没有保存到任何记录");
			}
		} catch (Exception e) {
			logErrorResult(serviceResult, e);
		}
		return serviceResult;
	}