IBM Rational AppScan安全报告

1.会话cookie 中缺少HttpOnly 属性。
   修复任务: 向所有会话cookie 添加“HttpOnly”属性
  解决方案,过滤器中,
		HttpServletResponse response2 = (HttpServletResponse)response;
		//httponly是微软对cookie做的扩展,该值指定 Cookie 是否可通过客户端脚本访问, 
		//解决用户的cookie可能被盗用的问题,减少跨站脚本攻击
		response2.setHeader( "Set-Cookie", "name=value; HttpOnly"); 


2.跨站点请求伪造。修复任务: 拒绝恶意请求。
   解决方案,过滤器中
		//HTTP 头设置 Referer过滤
		String referer = request2.getHeader("Referer");   //REFRESH
		if(referer!=null && referer.indexOf(basePath)<0){						
			request2.getRequestDispatcher(request2.getRequestURI()).forward(request2, response);
		}	


3.Autocomplete HTML Attribute Not Disabled for Password Field
修复任务: Correctly set the "autocomplete" attribute to "off"
	密&nbsp;&nbsp;码:
					<input name="userinfo.userPwd" type="password"  autocomplete = "off"/>


4.HTML 注释敏感信息泄露。删除注释信息。
5.跨站点脚本编制,SQL 盲注,通过框架钓鱼,链接注入(便于跨站请求伪造)。修复任务: 过滤掉用户输入中的危险字符
 
	private String filterDangerString(String value) {
		if (value == null) {
			return null;
		}
		value = value.replaceAll("\\|", "");

		value = value.replaceAll("&", "&amp;");

		value = value.replaceAll(";", "");

		value = value.replaceAll("@", "");

		value = value.replaceAll("'", "");

		value = value.replaceAll("\"", "");

		value = value.replaceAll("\\'", "");

		value = value.replaceAll("\\\"", "");

		value = value.replaceAll("<", "&lt;");

		value = value.replaceAll(">", "&gt;");

		value = value.replaceAll("\\(", "");

		value = value.replaceAll("\\)", "");

		value = value.replaceAll("\\+", "");

		value = value.replaceAll("\r", "");

		value = value.replaceAll("\n", "");

		value = value.replaceAll("script", "");
		
		value = value.replaceAll("%27", "");
		value = value.replaceAll("%22", "");
		value = value.replaceAll("%3E", "");
		value = value.replaceAll("%3C", "");
		value = value.replaceAll("%3D", "");
		value = value.replaceAll("%2F", "");
		return value;

	}

你可能感兴趣的:(WEB安全)