如何防止java对象的反射XSS

Question

我在Checkmarx中扫描了我的项目，它显示为一个java对象的反射XSS，该对象是下面方法中的一个参数，这是checkmarx报告的错误:

方法读取数据使用查询对象位于 /src/main/java/com/认知/hap/核心/控制器/数据控制器的第 743 行.java获取查询元素的用户输入。然后，此元素的值在未经正确清理或验证的情况经代码，并最终在方法读取数据使用QueryObject 中显示在 /src/main/java/com/认知/hap/核心/控制器/数据控制器.java的第 743 行中。这可能会导致跨站点脚本攻击。

方法是以下方法：

@RequestMapping(value = { "/readGraph/{iLakeId}/{dataPoolName}/{dataspaceName}/{datasetName}" }, headers = "Accept=*/*", method = RequestMethod.POST, produces = "application/json;charset=UTF-8")
    @ResponseBody
    public ResponseEntity<DataLakeGraph> readGraph(
            @ApiParam(name = "iLakeId", value = "int", required = true) @PathVariable int iLakeId,
            @ApiParam(name = "dataPoolName", value = "Datapool name", required = true) @PathVariable String dataPoolName,
            @ApiParam(name = "dataspaceName", value = "Dataspace name", required = true) @PathVariable String dataspaceName,
            @ApiParam(name = "datasetName", value = "Graph Dataset name", required = true) @PathVariable String datasetName,
            @ApiParam(name = "query", value = "Query model", required = true) @RequestBody(required = false) Query query,
            HttpServletResponse servRes) {
      DataLakeGraph dataLake = iLakeService.readGraph(iLakeId,
                    dataPoolName, dataspaceName, datasetName, query);
            return HAPUtil.createResponseEntity(dataLake, HttpStatus.OK);
}

下面是班级：

public class Query {

    private int size;
    private int offset;
    private String queryString;
    private List<Field> select;
    private List<Filter> filters;
    private String filterString;
    private SortOn sortOn;
    private List<Aggregation> aggregations;
    private Histogram histogram;
    private GraphQuery graphQuery;
    private boolean highlight;

   //setters and getters
}

你能让我知道如何净化或验证这个方法中的参数查询对象吗？

Answer 1

您没有说明您在DataController.java.的查询调用行743中包含了哪些代码行。SAST Checkmarx工具找到了一个路径，用户的查询在响应中被发回，但它不在您发布的代码片段中。一般来说，对于反映的跨站点脚本，您应该对以后可以发回给用户的任何用户输入进行肯定或白名单验证（例如接受已知的商品）。用户查询应该是众所周知的模式，所以这应该是可能的。

这里有一个用户输入的完整白名单验证的例子，后面是精确匹配(或花名册)验证。在这种情况下，这是检查用户输入是马来西亚国家的13个州之一。mState是用户输入。

private static final String stateFormatMy = "^[A-Z]{3}$";  // three upppercase alpha characters   
private static final Pattern pattern = Pattern.compile(stateFormatMy);  
public boolean validateStateMy()
{   
    // always check the length of any string before you do any regex operations
    // to protect against ReDoS 
    if(mState.length() != 3)
    {
        System.err.println("State abbreviations in Malaysia are three characters");
        return false;  
    }

    // Whtelist validation ensures three uppercase alpha characters 
    Matcher matcher = pattern.matcher(mState);
    if(!matcher.matches())
    {
        System.err.println("State abbreviations in Malaysia are three uppercase alpha characters");
        return false;  
    }

    // Exact match or roster validation    
    boolean bValid = true; 
    switch(mState)
    {
    case "JHR": break; 
    case "KDH": break;
    case "KTN": break;
    case "MLK": break;
    case "NSN": break;
    case "PHG": break;
    case "PLS": break;
    case "PRK": break;
    case "PNG": break;
    case "SBH": break;
    case "SWK": break;
    case "SGR": break;
    case "TRG": break;
    default:
        System.err.println("The abbreviation does not indicate a state (according to Wikipedia)");
        bValid = false; 
        break;  
    }
    return bValid ;