漏洞:不安全的http请求方法,tomcat 禁用http method。代码解决
问题描述:通过fiddler,使用raw重现HTTP请求,修改GET为TRACE重新请求。tomcat返回405,head 包含
Allow:POST,GET,DELETE,OPTIONS,PUT,HEAD
解决方法:使用filter进行过滤和处理。
1.修改tomcat的server.xml,允许trace方法:<Connector allowTrace="true"
2.修改web.xml,添加filter
<filter> <filter-name>filterUtil</filter-name> <filter-class>com.utils.FilterUtil</filter-class> </filter> <filter-mapping> <filter-name>filterUtil</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>
3.添加filter类
package com.utils; import java.io.IOException; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.slf4j.Logger; import org.slf4j.LoggerFactory; public class FilterUtil implements Filter { Logger log=LoggerFactory.getLogger(this.getClass()); @Override public void destroy() { } @Override public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) arg0; HttpServletResponse response = ((HttpServletResponse) arg1); String m=request.getMethod(); if(!"GET".equals(m)&&!"POST".equals(m)){ System.out.println("GET or POST only "); response.setHeader("Allow", "GET,POST"); response.setStatus(405); return; } arg2.doFilter(arg0, arg1); } @Override public void init(FilterConfig arg0) throws ServletException { } }
按错误的method请求即可看到效果: