当前位置：首页 > news >正文

安全漏洞防护完全指南

news 2026/5/24 21:37:25

安全漏洞防护完全指南

前言

本文介绍常见的安全漏洞及其防护措施，确保系统安全。

一、常见漏洞防护

1.1 SQL注入防护

@Service @RequiredArgsConstructor public class UserRepository { private final JdbcTemplate jdbcTemplate; // 使用参数化查询防止SQL注入 public User findByUsername(String username) { String sql = "SELECT * FROM users WHERE username = ?"; return jdbcTemplate.queryForObject(sql, new Object[]{username}, new UserRowMapper()); } }

1.2 XSS防护

@Component public class XssFilter implements Filter { @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest httpRequest = (HttpServletRequest) request; chain.doFilter(new XssHttpServletRequestWrapper(httpRequest), response); } } public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper { @Override public String getParameter(String name) { String value = super.getParameter(name); return xssEncode(value); } private String xssEncode(String value) { if (value == null) return null; return value.replaceAll("<", "&lt;") .replaceAll(">", "&gt;") .replaceAll("\"", "&quot;") .replaceAll("'", "&#x27;") .replaceAll("/", "&#x2F;"); } }

1.3 CSRF防护

@Configuration @EnableWebSecurity public class CsrfSecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http .csrf(csrf -> csrf .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()) .ignoringRequestMatchers("/api/public/**") ); return http.build(); } }

二、安全响应头

@Component public class SecurityHeadersFilter implements Filter { @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletResponse httpResponse = (HttpServletResponse) response; httpResponse.setHeader("X-Content-Type-Options", "nosniff"); httpResponse.setHeader("X-Frame-Options", "DENY"); httpResponse.setHeader("X-XSS-Protection", "1; mode=block"); httpResponse.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains"); httpResponse.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline'"); httpResponse.setHeader("Referrer-Policy", "strict-origin-when-cross-origin"); chain.doFilter(request, response); } }