OWASP安全编码建议课件.ppt

* windows：( ) * ‘ | = ? ; [ ] ^ ~ ! . ” % @ / \ : + , ` Linux：{ } ( ) * ‘ | = ? ; [ ] $ – # ~ ! . ” % / \ : + , ` * * public void doPost(ServletRequest request, ServletResponse response) { try { User user = ESAPI.authenticator().login(request, response); // continue with authenticated user } catch (AuthenticationException e) { // handle failed authentication (its already been logged) } * DOM XSS防护需要进一步加强 * -- amp; -- lt; -- gt; -- quot; -- #x27; apos; not recommended because its not in the HTML spec (See: section 24.4.1) apos; is in the XML and XHTML specs. / -- #x2F; forward slash is included as it helps end an HTML entity * WAF支持较弱，研究不够深入 * * WAF支持较弱，后续会加强 收集错误配置有哪些，不同层次上的，不同产品 该怎么解决 * SSL卸载结合重定向，强制用户加密传输 * 以后加强想法：WAF提供登录验证，会话管理功能 白环境模型 * OWASP安全编码 OWASP OWASP Open：开放的、多人维护的 Web Application Security Project : Top 10/Webgoat/Webscarab etc. https OWASP-Top10 OWASP Top10 风险等级计算方法 A1-Injection 原理：数据被当作代码执行 方式：SQL注入、命令注入等 示例： /app/accountView?id=1 or 1=1 代码：String query = SELECT * FROM accounts WHERE custID= + request.getParameter(id) + ; http://sensitive/cgi-bin/userData.pl?doc=user1.txt%3B/bin/ls 代码：Runtime.exec(“cat user1.txt;/bin/ls”); 危害：窃取数据、控制服务器 安全编码 安全API 禁止动态拼接、禁止使用系统shell ESAPI: /index.php/Category:OWASP_Enterprise_Security_API 参数化查询： https Java - Standard String custname = request.getParameter(customerName); String query = SELECT account_balance FROM user_data WHERE user_name =?? ; PreparedStatement pstmt = connection.prepareStatement( query ); pstmt.setString( 1, custname); ResultSet results = pstmt.executeQuery( ); PHP - PDO $stmt = $dbh-prepare(INSERT INTO REGISTRY (name, value) VALUES (:name,?:value)); $stmt-bindParam(:name, $name); $stmt-bindParam(:value, $value); .NET/C# String query = SELECT account_balance FROM user_data WHERE user_name =??; try { OleDbCommand command = new OleDbCommand(query, connection); command.Parameters.Add(new OleDbParameter(customerName, CustomerName Name.Text)); OleDbDataReader reader