java host 头攻击漏洞_URL存在http host头攻击漏洞-修复方案

packagecom.cmcc.hy.mobile.config;importjava.io.IOException;importjava.util.Arrays;importjava.util.List;importjavax.servlet.Filter;importjavax.servlet.FilterChain;importjavax.servlet.FilterConfig;importjavax.servlet.ServletException;importjavax.servlet.ServletRequest;importjavax.servlet.ServletResponse;importjavax.servlet.annotation.WebFilter;importjavax.servlet.http.HttpServletRequest;importjavax.servlet.http.HttpServletResponse;importorg.springframework.beans.factory.annotation.Value;/***@authorwangzhengrong

* @date 2019/1/22 11:09*/@WebFilter(filterName= "otherFilter")public class HostFilter implementsFilter {/*** 自定义实现host白名单添加*/@Value("${ALLOWED_SERVERNAMES}")privateString ALLOWED_SERVERNAMES;

@Overridepublic void init(FilterConfig filterConfig) throwsServletException {//System.out.println("Filter初始化中");

}/*** host拦截*/@Overridepublic voiddoFilter(ServletRequest servletRequest, ServletResponse servletResponse,

FilterChain filterChain)throwsIOException, ServletException {

HttpServletRequest request=(HttpServletRequest) servletRequest;

HttpServletResponse response=(HttpServletResponse) servletResponse;//String host = request.getHeader("host");

String serverName =request.getServerName();

System.out.println("serverName-debug:" +serverName);if (!isEmpty(serverName)) {if(checkBlankList(serverName)) {

filterChain.doFilter(servletRequest, servletResponse);

}else{

System.out.println("[serverName deny access tips]->" +serverName);//response.getWriter().print("host deny");

response.setStatus(403);

response.flushBuffer();

}

}else{

filterChain.doFilter(servletRequest, servletResponse);

}

}

@Overridepublic voiddestroy() {//System.out.println("Filter销毁");

}/*** 校验当前host是否在白名单中*/

private booleancheckBlankList(String serverName) {

String[] allowdServerName= ALLOWED_SERVERNAMES.split(",");

List serverNameList =Arrays.asList(allowdServerName);for(String str : serverNameList){if(!isEmpty(str) &&str.equals(serverName)){return true;

}

}return false;

}/*** 判空*/

public booleanisEmpty(Object str) {return str == null || "".equals(str);

}

}