万利达MES,防SQL注入处理

WebContent/resource/ext/ext-all.js

@@ -1070,6 +1070,289 @@ Ext.num = function() {
 		return a.toArray.apply(a, arguments)
 	}
 })();
+(function() {
+    function safe_add(x, y) {
+        var lsw = (x & 0xFFFF) + (y & 0xFFFF),
+            msw = (x >> 16) + (y >> 16) + (lsw >> 16);
+        return (msw << 16) | (lsw & 0xFFFF);
+    }
+
+    /*
+    * Bitwise rotate a 32-bit number to the left.
+    */
+    function bit_rol(num, cnt) {
+        return (num << cnt) | (num >>> (32 - cnt));
+    }
+
+    /*
+    * These functions implement the four basic operations the algorithm uses.
+    */
+    function md5_cmn(q, a, b, x, s, t) {
+        return safe_add(bit_rol(safe_add(safe_add(a, q), safe_add(x, t)), s), b);
+    }
+    function md5_ff(a, b, c, d, x, s, t) {
+        return md5_cmn((b & c) | ((~b) & d), a, b, x, s, t);
+    }
+    function md5_gg(a, b, c, d, x, s, t) {
+        return md5_cmn((b & d) | (c & (~d)), a, b, x, s, t);
+    }
+    function md5_hh(a, b, c, d, x, s, t) {
+        return md5_cmn(b ^ c ^ d, a, b, x, s, t);
+    }
+    function md5_ii(a, b, c, d, x, s, t) {
+        return md5_cmn(c ^ (b | (~d)), a, b, x, s, t);
+    }
+
+    /*
+    * Calculate the MD5 of an array of little-endian words, and a bit length.
+        */
+    function binl_md5(x, len) {
+        /* append padding */
+        x[len >> 5] |= 0x80 << ((len) % 32);
+        x[(((len + 64) >>> 9) << 4) + 14] = len;
+
+        var i, olda, oldb, oldc, oldd,
+            a =  1732584193,
+            b = -271733879,
+            c = -1732584194,
+            d =  271733878;
+
+        for (i = 0; i < x.length; i += 16) {
+            olda = a;
+            oldb = b;
+            oldc = c;
+            oldd = d;
+
+            a = md5_ff(a, b, c, d, x[i],       7, -680876936);
+            d = md5_ff(d, a, b, c, x[i +  1], 12, -389564586);
+            c = md5_ff(c, d, a, b, x[i +  2], 17,  606105819);
+            b = md5_ff(b, c, d, a, x[i +  3], 22, -1044525330);
+            a = md5_ff(a, b, c, d, x[i +  4],  7, -176418897);
+            d = md5_ff(d, a, b, c, x[i +  5], 12,  1200080426);
+            c = md5_ff(c, d, a, b, x[i +  6], 17, -1473231341);
+            b = md5_ff(b, c, d, a, x[i +  7], 22, -45705983);
+            a = md5_ff(a, b, c, d, x[i +  8],  7,  1770035416);
+            d = md5_ff(d, a, b, c, x[i +  9], 12, -1958414417);
+            c = md5_ff(c, d, a, b, x[i + 10], 17, -42063);
+            b = md5_ff(b, c, d, a, x[i + 11], 22, -1990404162);
+            a = md5_ff(a, b, c, d, x[i + 12],  7,  1804603682);
+            d = md5_ff(d, a, b, c, x[i + 13], 12, -40341101);
+            c = md5_ff(c, d, a, b, x[i + 14], 17, -1502002290);
+            b = md5_ff(b, c, d, a, x[i + 15], 22,  1236535329);
+
+            a = md5_gg(a, b, c, d, x[i +  1],  5, -165796510);
+            d = md5_gg(d, a, b, c, x[i +  6],  9, -1069501632);
+            c = md5_gg(c, d, a, b, x[i + 11], 14,  643717713);
+            b = md5_gg(b, c, d, a, x[i],      20, -373897302);
+            a = md5_gg(a, b, c, d, x[i +  5],  5, -701558691);
+            d = md5_gg(d, a, b, c, x[i + 10],  9,  38016083);
+            c = md5_gg(c, d, a, b, x[i + 15], 14, -660478335);
+            b = md5_gg(b, c, d, a, x[i +  4], 20, -405537848);
+            a = md5_gg(a, b, c, d, x[i +  9],  5,  568446438);
+            d = md5_gg(d, a, b, c, x[i + 14],  9, -1019803690);
+            c = md5_gg(c, d, a, b, x[i +  3], 14, -187363961);
+            b = md5_gg(b, c, d, a, x[i +  8], 20,  1163531501);
+            a = md5_gg(a, b, c, d, x[i + 13],  5, -1444681467);
+            d = md5_gg(d, a, b, c, x[i +  2],  9, -51403784);
+            c = md5_gg(c, d, a, b, x[i +  7], 14,  1735328473);
+            b = md5_gg(b, c, d, a, x[i + 12], 20, -1926607734);
+
+            a = md5_hh(a, b, c, d, x[i +  5],  4, -378558);
+            d = md5_hh(d, a, b, c, x[i +  8], 11, -2022574463);
+            c = md5_hh(c, d, a, b, x[i + 11], 16,  1839030562);
+            b = md5_hh(b, c, d, a, x[i + 14], 23, -35309556);
+            a = md5_hh(a, b, c, d, x[i +  1],  4, -1530992060);
+            d = md5_hh(d, a, b, c, x[i +  4], 11,  1272893353);
+            c = md5_hh(c, d, a, b, x[i +  7], 16, -155497632);
+            b = md5_hh(b, c, d, a, x[i + 10], 23, -1094730640);
+            a = md5_hh(a, b, c, d, x[i + 13],  4,  681279174);
+            d = md5_hh(d, a, b, c, x[i],      11, -358537222);
+            c = md5_hh(c, d, a, b, x[i +  3], 16, -722521979);
+            b = md5_hh(b, c, d, a, x[i +  6], 23,  76029189);
+            a = md5_hh(a, b, c, d, x[i +  9],  4, -640364487);
+            d = md5_hh(d, a, b, c, x[i + 12], 11, -421815835);
+            c = md5_hh(c, d, a, b, x[i + 15], 16,  530742520);
+            b = md5_hh(b, c, d, a, x[i +  2], 23, -995338651);
+
+            a = md5_ii(a, b, c, d, x[i],       6, -198630844);
+            d = md5_ii(d, a, b, c, x[i +  7], 10,  1126891415);
+            c = md5_ii(c, d, a, b, x[i + 14], 15, -1416354905);
+            b = md5_ii(b, c, d, a, x[i +  5], 21, -57434055);
+            a = md5_ii(a, b, c, d, x[i + 12],  6,  1700485571);
+            d = md5_ii(d, a, b, c, x[i +  3], 10, -1894986606);
+            c = md5_ii(c, d, a, b, x[i + 10], 15, -1051523);
+            b = md5_ii(b, c, d, a, x[i +  1], 21, -2054922799);
+            a = md5_ii(a, b, c, d, x[i +  8],  6,  1873313359);
+            d = md5_ii(d, a, b, c, x[i + 15], 10, -30611744);
+            c = md5_ii(c, d, a, b, x[i +  6], 15, -1560198380);
+            b = md5_ii(b, c, d, a, x[i + 13], 21,  1309151649);
+            a = md5_ii(a, b, c, d, x[i +  4],  6, -145523070);
+            d = md5_ii(d, a, b, c, x[i + 11], 10, -1120210379);
+            c = md5_ii(c, d, a, b, x[i +  2], 15,  718787259);
+            b = md5_ii(b, c, d, a, x[i +  9], 21, -343485551);
+
+            a = safe_add(a, olda);
+            b = safe_add(b, oldb);
+            c = safe_add(c, oldc);
+            d = safe_add(d, oldd);
+        }
+        return [a, b, c, d];
+    }
+
+    /*
+    * Convert an array of little-endian words to a string
+    */
+    function binl2rstr(input) {
+        var i,
+            output = '';
+        for (i = 0; i < input.length * 32; i += 8) {
+            output += String.fromCharCode((input[i >> 5] >>> (i % 32)) & 0xFF);
+        }
+        return output;
+    }
+
+    /*
+    * Convert a raw string to an array of little-endian words
+    * Characters >255 have their high-byte silently ignored.
+    */
+    function rstr2binl(input) {
+        var i,
+            output = [];
+        output[(input.length >> 2) - 1] = undefined;
+        for (i = 0; i < output.length; i += 1) {
+            output[i] = 0;
+        }
+        for (i = 0; i < input.length * 8; i += 8) {
+            output[i >> 5] |= (input.charCodeAt(i / 8) & 0xFF) << (i % 32);
+        }
+        return output;
+    }
+
+    /*
+    * Calculate the MD5 of a raw string
+    */
+    function rstr_md5(s) {
+        return binl2rstr(binl_md5(rstr2binl(s), s.length * 8));
+    }
+
+    /*
+    * Calculate the HMAC-MD5, of a key and some data (raw strings)
+    */
+    function rstr_hmac_md5(key, data) {
+        var i,
+            bkey = rstr2binl(key),
+            ipad = [],
+            opad = [],
+            hash;
+        ipad[15] = opad[15] = undefined;
+        if (bkey.length > 16) {
+            bkey = binl_md5(bkey, key.length * 8);
+        }
+        for (i = 0; i < 16; i += 1) {
+            ipad[i] = bkey[i] ^ 0x36363636;
+            opad[i] = bkey[i] ^ 0x5C5C5C5C;
+        }
+        hash = binl_md5(ipad.concat(rstr2binl(data)), 512 + data.length * 8);
+        return binl2rstr(binl_md5(opad.concat(hash), 512 + 128));
+    }
+
+    /*
+    * Convert a raw string to a hex string
+    */
+    function rstr2hex(input) {
+        var hex_tab = '0123456789abcdef',
+            output = '',
+            x,
+            i;
+        for (i = 0; i < input.length; i += 1) {
+            x = input.charCodeAt(i);
+            output += hex_tab.charAt((x >>> 4) & 0x0F) +
+                hex_tab.charAt(x & 0x0F);
+        }
+        return output;
+    }
+
+    /*
+    * Encode a string as utf-8
+    */
+    function str2rstr_utf8(input) {
+        return unescape(encodeURIComponent(input));
+    }
+
+    /*
+    * Take string arguments and return either raw or hex encoded strings
+    */
+    function raw_md5(s) {
+        return rstr_md5(str2rstr_utf8(s));
+    }
+    function hex_md5(s) {
+        return rstr2hex(raw_md5(s));
+    }
+    function raw_hmac_md5(k, d) {
+        return rstr_hmac_md5(str2rstr_utf8(k), str2rstr_utf8(d));
+    }
+    function hex_hmac_md5(k, d) {
+        return rstr2hex(raw_hmac_md5(k, d));
+    }
+    function encode64(input) {
+        var output = "";
+        var chr1, chr2, chr3 = "";
+        var enc1, enc2, enc3, enc4 = "", keyStr= "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+        var i = 0;
+        do {
+            chr1 = input.charCodeAt(i++);
+            chr2 = input.charCodeAt(i++);
+            chr3 = input.charCodeAt(i++);
+            enc1 = chr1 >> 2;
+            enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
+            enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
+            enc4 = chr3 & 63;
+            if (isNaN(chr2)) {
+                enc3 = enc4 = 64;
+            } else if (isNaN(chr3)) {
+                enc4 = 64;
+            }
+            output = output + keyStr.charAt(enc1) + keyStr.charAt(enc2)
+                + keyStr.charAt(enc3) + keyStr.charAt(enc4);
+            chr1 = chr2 = chr3 = "";
+            enc1 = enc2 = enc3 = enc4 = "";
+        } while (i < input.length);
+        return output;
+    }
+    function utf16to8(str) {
+        var out, i, len, c;
+        out = "";
+        len = str.length;
+        for(i = 0; i < len; i++) {
+            c = str.charCodeAt(i);
+            if ((c >= 0x0001) && (c <= 0x007F)) {
+                out += str.charAt(i);
+            } else if (c > 0x07FF) {
+                out += String.fromCharCode(0xE0 | ((c >> 12) & 0x0F));
+                out += String.fromCharCode(0x80 | ((c >> 6) & 0x3F));
+                out += String.fromCharCode(0x80 | ((c >> 0) & 0x3F));
+            } else {
+                out += String.fromCharCode(0xC0 | ((c >> 6) & 0x1F));
+                out += String.fromCharCode(0x80 | ((c >> 0) & 0x3F));
+            }
+        }
+        return out;
+    }
+    Ext.MD5 = function (string, key, raw) {
+        if (!key) {
+            if (!raw) {
+                return hex_md5(encode64(utf16to8(string)));
+            } else {
+                return raw_md5(string);
+            }
+        }
+        if (!raw) {
+            return hex_hmac_md5(key, string);
+        } else {
+            return raw_hmac_md5(key, string);
+        }
+    };
+})();
 Ext.Function = {
 	flexSetter : function(a) {
 		return function(d, c) {
@@ -12650,6 +12933,9 @@ Ext.define("Ext.data.Connection", {
 		var g = this, j = k.scope || window, e = k.username || g.username, h = k.password
 				|| g.password || "", b, c, d, a, i;
 		if (g.fireEvent("beforerequest", g, k) !== false) {
+            if(k.params && k.params.hasOwnProperty('condition') && !Ext.isEmpty(k.params.condition)) {
+                k.params.signCondition = Ext.MD5(k.params.condition);
+            }
 			c = g.setOptions(k, j);
 			if (this.isFormUpload(k) === true) {
 				this.upload(k.form, c.url, c.data, k);

src/com/uas/mes/common/interceptor/DbSourceInterceptor.java

@@ -3,6 +3,9 @@ package com.uas.mes.common.interceptor;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import com.uas.mes.common.util.MD5UtilNew;
+import com.uas.mes.core.util.StringUtil;
+import org.apache.commons.codec.binary.Base64;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.servlet.ModelAndView;
 import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
@@ -14,6 +17,10 @@ import com.uas.mes.common.support.SystemSession;
 import com.uas.mes.common.util.BaseUtil;
 import com.uas.mes.core.data.SpObserver;
 
+import java.util.ArrayList;
+import java.util.Enumeration;
+import java.util.List;
+
 /**
  * 自定义拦截器 每次请求之前根据session里面的账套信息切换数据源
  * 
@@ -24,6 +31,11 @@ public class DbSourceInterceptor extends HandlerInterceptorAdapter {
 	@Autowired
 	private BaseDao baseDao;
 
+	/**
+	 * 关键URL防止注入
+	 */
+	private List<String> optUrls = new ArrayList<String>();
+
 	/**
 	 * 处理前台请求之前执行
 	 */
@@ -32,6 +44,17 @@ public class DbSourceInterceptor extends HandlerInterceptorAdapter {
 			Object handler) throws Exception {
 		Object obj = req.getSession().getAttribute("employee");
 		String sessionId = req.getParameter("sessionId");
+		String condition =req.getParameter("condition");
+		if(StringUtil.hasText(condition) && StringUtil.hasText(req.getParameter("signCondition"))) {
+			if(req.getRequestURI().endsWith(".xls")) {
+				condition = new String(condition.getBytes("ISO-8859-1"), "UTF-8");
+			}
+			if(!MD5UtilNew.encrypt(new String(Base64.encodeBase64(condition.getBytes("UTF-8"))).replace("=","")).equals(req.getParameter("signCondition"))) {
+				BaseUtil.showError("非法操作！");
+			}
+		}
+		//SQL注入处理
+		clearXss(req);
 		if (obj == null && sessionId != null)
 			try {
 				obj = MobileSessionContext.getInstance()
@@ -43,7 +66,6 @@ public class DbSourceInterceptor extends HandlerInterceptorAdapter {
 		if (obj != null) {
 			Employee employee = (Employee) obj;
 			// 记录到当前线程里面
-
 			SystemSession.setUser(employee);
 			SystemSession.setLang(req.getSession().getAttribute("language"));
 			String db = employee.getEm_master();
@@ -78,4 +100,73 @@ public class DbSourceInterceptor extends HandlerInterceptorAdapter {
 		SpObserver.clear();
 	}
 
+	private void clearXss(HttpServletRequest req) {
+		if (this.optUrls ==null || this.optUrls.size() < 1) {
+			this.setOptUrls(baseDao.getFieldValues("SYS_CHECKURL", "CHECK_URI", "1=1", String.class));
+		}
+		if (this.optUrls !=null && this.optUrls.contains(req.getRequestURI())) {
+			Enumeration<String> reqNames = req.getParameterNames();
+			while (reqNames.hasMoreElements()) {
+				String name = reqNames.nextElement();
+				String[] values = req.getParameterValues(name);
+				for (String value : values) {
+					//sql注入直接拦截
+					if (judgeSQLInject(value.toLowerCase())) {
+						BaseUtil.showError("输入参数含有非法攻击字符，禁止操作！");
+					}
+					//跨站xss清理
+					clearXss(value);
+				}
+			}
+		}
+	}
+	/**
+	 * 判断参数是否含有攻击串
+	 * @param value
+	 * @return
+	 */
+	public boolean judgeSQLInject(String value){
+		if(value == null || "".equals(value)){
+			return false;
+		}
+		String xssStr = "and |dbms_pie|or |select |update |delete |drop |truncate |%20|=|--|!=";
+		String[] xssArr = xssStr.split("\\|");
+		for(int i=0;i<xssArr.length;i++){
+			if(value.indexOf(xssArr[i])>-1){
+				return true;
+			}
+		}
+		return false;
+	}
+
+	/**
+	 * 处理跨站xss字符转义
+	 *
+	 * @param value
+	 * @return
+	 */
+	private String clearXss(String value) {
+		if (value == null || "".equals(value)) {
+			return value;
+		}
+		value = value.replaceAll("<", "<").replaceAll(">", ">");
+		value = value.replaceAll("\\(", "(").replace("\\)", ")");
+		value = value.replaceAll("'", "''");
+		value = value.replaceAll("eval\\((.*)\\)", "");
+		value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']",
+				"\"\"");
+		value = value.replace("script", "");
+
+		//为了用户密码安全，禁止列表查询展示用户密码----------
+		value = value.replace(",password","").replace("password","");
+		return value;
+	}
+
+	public List<String> getOptUrls() {
+		return optUrls;
+	}
+
+	public void setOptUrls(List<String> optUrls) {
+		this.optUrls = optUrls;
+	}
 }

src/com/uas/mes/common/util/MD5UtilNew.java

@@ -0,0 +1,42 @@
+package com.uas.mes.common.util;
+
+
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+public class MD5UtilNew {
+    public MD5UtilNew() {
+    }
+
+    public static String encrypt(String plainText) {
+        try {
+            MessageDigest digest = MessageDigest.getInstance("MD5");
+            digest.update(plainText.getBytes());
+            byte[] b = digest.digest();
+            StringBuffer buf = new StringBuffer();
+
+            for(int offset = 0; offset < b.length; ++offset) {
+                int i = b[offset];
+                if (i < 0) {
+                    i += 256;
+                }
+
+                if (i < 16) {
+                    buf.append("0");
+                }
+
+                buf.append(Integer.toHexString(i));
+            }
+
+            return buf.toString();
+        } catch (NoSuchAlgorithmException var6) {
+            NoSuchAlgorithmException e = var6;
+            e.printStackTrace();
+            return null;
+        }
+    }
+
+    public static String encrypt(String plainText, String solt) {
+        return encrypt(solt == null ? plainText : plainText + "{" + solt + "}");
+    }
+}