ibatis Order By注入问题

Posted 2020-10-22 有梦就能实现

上周六单位被扫描出SQL注入漏洞 经过检查,发现ibatis框架都可能出现这个问题.
如果有需求,让你实现页面grid所有字段都能排序,你会怎么做呢？ 最简单的做法就是从页面把字段名,排序类型传回来,然后拼接在SQL里面.(在使用EasyUI前端框架的时候,这样做非常容易) 然后修改ibatis框架,将order by #排序字段# #排序类型#改为 order by $排序字段$ $排序类型$ 实现所谓的动态查询,就像下面的链接所写的 http://blog.sina.com.cn/s/blog_4dacfb0101016y6b.html
实验模拟这个过程, create table t (id int primary key ,name varchar(20),grade int); insert into t values(1,‘edmond‘,1); insert into t values(2,‘edmond‘,2); insert into t values(3,‘edmond‘,1); insert into t values(4,‘edmond‘,3); insert into t values(5,‘edmond‘,1); insert into t values(6,‘edmond‘,5);

1. public class Test {
2.     private static String URL = "jdbc:mysql://127.0.0.1:3306/mvbox";
3.     private static String USERNAME = "xx";
4.     private static String PWD = "xx";
6.     public static void main(String[] args) throws Exception {
7.         //模拟从页面传输过来的参数
8.         String name = "edmond";
9.         String sort = "grade";
10.         String order = "desc";
11.         dao(name, sort, order);
12.     }
14.     private static void dao(String name, String sort, String order) throws Exception {
15.         Class.forName("com.mysql.jdbc.Driver");
16.         Connection con = DriverManager.getConnection(URL, USERNAME, PWD);
17.         PreparedStatement ps = con.prepareStatement("select id,name,grade from t where name=? order by " + sort + " " + order);
18.         ps.setString(1, name);
19.         ResultSet rs = ps.executeQuery();
20.         while (rs.next()) {
21.             System.out.println(rs.getInt(1) + "\t" + rs.getString(2) + "\t" + rs.getInt(3));
22.         }
23.         con.close();
24.     }
25. }

上面的代码模拟了ibatis使用$符号实现动态排序查询的场景.运行结果如下 可以看到上述代码存在注入漏洞 如果对参数order注入如下内容,即可以作为暴力攻破帐号密码的方式,又可以使用sleep挂起数据库. String order = "desc,(select if(substring(user(),1,2)=‘xx‘,sleep(4),-1))";
攻击方式参考: http://www.jxcm.net/shujuku/64.html
如何避免注入攻击,并且用ibatis实现动态排序查询呢? 我感觉可以使用受控注入的方式.(自己想的一个名词) 在监听器中获取数据库所有的列名称,然后使用AOP拦截DAO层的方法, 将前台传入的参数,对比监听器中获取的数据库列名称,如果没有任何匹配,则直接报错,或者给一个默认的排序 ibatis的SQL还是使用$符号的方式.
模拟代码如下

1. import java.sql.Connection;
2. import java.sql.DriverManager;
3. import java.sql.PreparedStatement;
4. import java.sql.ResultSet;
5. import java.sql.SQLException;
6. import java.util.ArrayList;
7. import java.util.List;
9. public class Test {
10.     private static String URL = "jdbc:mysql://127.0.0.1:3306/mvbox";
11.     private static String USERNAME = "xx";
12.     private static String PWD = "xx";
14.     private static List<String> fieldList = new ArrayList<String>();
16.     private static void getAllField() throws Exception {
17.         Class.forName("com.mysql.jdbc.Driver");
18.         Connection con = DriverManager.getConnection(URL, USERNAME, PWD);
19.         PreparedStatement ps = con
20.                 .prepareStatement("select column_name from information_schema.columns where table_schema not in (‘information_schema‘,‘test‘,‘mysql‘,‘information_schema‘)");
21.         ResultSet rs = ps.executeQuery();
22.         while (rs.next()) {
23.             fieldList.add(rs.getString(1));
24.         }
25.         rs.close();
26.         ps.close();
27.         con.close();
28.     }
30.     public static void main(String[] args) throws Exception {
31.         // 模拟监听器启动
32.         getAllField();
33.         // 模拟从页面传输过来的参数
34.         String name = "edmond";
35.         String sort = "grade";
36.         String order ="desc,(select if(substring(user(),1,2)=‘xx‘,sleep(4),-1))";
37.         daoProxy(name, sort, order);
38.     }
40.     private static void daoProxy(String name, String sort, String order)
41.             throws Exception {
42.         if (fieldList.contains(sort)
43.                 && (order.toLowerCase().equals("desc") || order.toLowerCase()
44.                         .equals("asc"))) {
45.             dao(name, sort, order);
46.         } else {
47.             // 记录日志,进行错误处理
48.             System.out.println("黑客,你妈妈喊你回家吃饭");
49.         }
50.     }
52.     private static void dao(String name, String sort, String order)
53.             throws Exception {
54.         Class.forName("com.mysql.jdbc.Driver");
55.         Connection con = DriverManager.getConnection(URL, USERNAME, PWD);
56.         PreparedStatement ps = con
57.                 .prepareStatement("select id,name,grade from t where name=? order by "
58.                         + sort + " " + order);
59.         ps.setString(1, name);
60.         ResultSet rs = ps.executeQuery();
61.         while (rs.next()) {
62.             System.out.println(rs.getInt(1) + "\t" + rs.getString(2) + "\t"
63.                     + rs.getInt(3));
64.         }
65.         con.close();
66.     }
67. }

可以看到,在DAO层拦截之后,在daoProxy中已经过滤了注入攻击. 这样即可以保证安全,又可以让代码优雅.