一行代碼引來的安全漏洞就讓我們丟失了整個服務器的控制權

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"之前在某廠的某次項目開發中，項目組同學設計和實現了一個“引以爲傲”，額，有點擴張，不過自認爲還說得過去的 feature，結果臨上線前被啪啪打臉，因爲實現過程中因爲"},{"type":"text","marks":[{"type":"strong"}],"text":"一行代碼"},{"type":"text","text":"（沒有標題黨，真的是一行代碼）帶來的安全漏洞讓我們丟失了整個服務器控制權（測試環境）。多虧了上線之前有公司安全團隊的人會對代碼進行掃描，才讓這個漏洞被扼殺在搖籃裏。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"下面我們就一起來看看這個事故，啊，不對，是故事。"}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/e8/e8fb37e6ec04221dc698459a4cc7b06e.png","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#ffffff","name":"user"}}],"text":"背景說明"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"我們的項目是一個面向全球用戶的 Web 項目，用 SpringBoot 開發。在項目開發過程中，離不開各種異常信息的處理，比如表單提交參數不符合預期，業務邏輯的處理時離不開各種異常信息（例如網絡抖動等）的處理。於是利用 SpringBoot 各種現成的組件支持，設計了一個統一的異常信息處理組件，統一管理各種業務流程中可能出現的錯誤碼和錯誤信息，通過國際化的資源配置文件進行統一輸出給用戶。"}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"統一錯誤信息配置管理"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"我們的用戶遍佈全球，爲了給各個國家用戶比較好的體驗會進行不同的翻譯。具體而言，實現的效果如下，爲了方便理解，以“找回登錄密碼”這樣一個業務場景來進行闡述說明。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"假設找回密碼時，需要用戶輸入手機或者郵箱驗證碼，假設這個時候用戶輸入的驗證碼通過後臺數據庫（可能是Redis）對比發現已經過期。在業務代碼中，只需要簡單的 "},{"type":"codeinline","content":[{"type":"text","text":"throw new ErrorCodeException(ErrorCodes.AUTHCODE_EXPIRED)"}]},{"type":"text","text":" 即可。具體而言，針對不同國家地區不同的語言看到的效果不一樣："}]},{"type":"bulletedlist","content":[{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"中文用戶看到的提示就是“您輸入的驗證碼已過期，請重新獲取”；"}]}]},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"歐美用戶看到的效果是“The verification code you input is expired, ...”；"}]}]},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"德國用戶看到的是：“Der von Ihnen eingegebene Verifizierungscode ist abgelaufen, bitte wiederholen” 。（我瞎找的翻譯，不一定準）"}]}]},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"……"}]}]}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"統一錯誤信息配置管理代碼實現"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"關鍵信息其實就在於一個 GlobalExceptionHandler，對所有Controller 入口進行 AOP 攔截，根據不同的錯誤信息，獲取相應資源文件配置的 key，並從語言資源文件中讀取不同國家的錯誤翻譯信息。"}]},{"type":"codeblock","attrs":{"lang":null},"content":[{"type":"text","text":"@ControllerAdvice\npublic class GlobalExceptionHandler {\n\n @ExceptionHandler(BadRequestException.class)\n @ResponseBody\n public ResponseEntity handle(HttpServletRequest request, BadRequestException e){\n String i18message = getI18nMessage(e.getKey(), request);\n return ResponseEntity.status(HttpStatus.BAD_REQUEST).body(Response.error(e.getCode(), i18message));\n }\n \n @ExceptionHandler(ErrorCodeException.class)\n @ResponseBody\n public ResponseEntity handle(HttpServletRequest request, ErrorCodeException e){\n String i18message = getI18nMessage(e.getKey(), request);\n return ResponseEntity.status(HttpStatus.OK).body(Response.error(e.getCode(), i18message));\n }\n}\n"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/3c/3c0f39e5e0dafd72390c250ad4a6b4ea.png","alt":"不同語言的資源文件示例","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"不同語言的資源文件示例"}]},{"type":"codeblock","attrs":{"lang":null},"content":[{"type":"text","text":"private String getI18nMessage(String key, HttpServletRequest request) {\n try {\n return messageSource.getMessage(key, null, LanguaggeUtils.currentLocale(request));\n } catch (Exception e) {\n // log\n return key;\n }\n}\n"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"詳細代碼實現可以參考本人之前寫的這篇文章"},{"type":"link","attrs":{"href":"/blog/custom-validator-and-i18n-error-message-in-springboot.html","title":null},"content":[{"type":"text","text":"一文教你實現 SpringBoot 中的自定義 Validator 和錯誤信息國際化配置"}],"marks":[{"type":"strong"}]},{"type":"text","text":"，上面有附完整的代碼實現。"}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"基於註解的表單校驗（含自定義註解）"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"還有一種常見的業務場景就是後端接口需要對用戶提交的表單進行校驗。以“註冊用戶”這樣的場景舉例說明， 註冊用戶時，往往會提交暱稱，性別，郵箱等信息進行註冊，簡單起見，就以這 3 個屬性爲例。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"定義的表單如下："}]},{"type":"codeblock","attrs":{"lang":null},"content":[{"type":"text","text":"public class UserRegForm {\n private String nickname;\n private String gender;\n private String email;\n}\n"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"對於表單的約束，我們有："}]},{"type":"bulletedlist","content":[{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"暱稱字段：“nickname” 必填，長度必須是 6 到 20 位；"}]}]},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"性別字段：“gender” 可選，如果填了，就必須是“Male/Female/Other/”中的一種。說啥，除了男女還有其他？對，是的。畢竟全球用戶嘛，你去看看非死不可，還有更多。"}]}]},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"郵箱： “email”，必填，必須滿足郵箱格式。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"對於以上約束，我們只需要在對應的字段上添加如下註解即可。"}]},{"type":"codeblock","attrs":{"lang":null},"content":[{"type":"text","text":"public class UserRegForm {\n @Length(min = 6, max = 20, message = \"validate.userRegForm.nickname\")\n private String nickname;\n\n @Gender(message=\"validate.userRegForm.gender\")\n private String gender;\n\n @NotNull\n @Email(message=\"validate.userRegForm.email\")\n private String email;\n}\n"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"然後在各個語言資源文件中配置好相應的錯誤信息提示即可。其中， "},{"type":"codeinline","content":[{"type":"text","text":"@Gender"}]},{"type":"text","text":" 就是一個自定義的註解。"}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"基於含自定義註解的表單校驗關鍵代碼"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"自定義註解的實現主要的其實就是一個自定義註解的定義以及一個校驗邏輯。例如定義一個自定義註解 "},{"type":"codeinline","content":[{"type":"text","text":"CustomParam"}]},{"type":"text","text":"："}]},{"type":"codeblock","attrs":{"lang":null},"content":[{"type":"text","text":"@Documented\n@Constraint(validatedBy = CustomValidator.class)\n@Target({FIELD, METHOD, PARAMETER, ANNOTATION_TYPE})\n@Retention(RetentionPolicy.RUNTIME)\npublic @interface CustomParam {\n String message() default \"name.tanglei.www.validator.CustomArray.defaultMessage\";\n\n Class>[] groups() default {};\n Class extends Payload>[] payload() default { };\n\n @Documented\n @Retention(RetentionPolicy.RUNTIME)\n @Target({FIELD, METHOD, PARAMETER, ANNOTATION_TYPE})\n @interface List {\n CustomParam[] value();\n }\n}\n"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"校驗邏輯的實現 "},{"type":"codeinline","content":[{"type":"text","text":"CustomValidator"}]},{"type":"text","text":"："}]},{"type":"codeblock","attrs":{"lang":null},"content":[{"type":"text","text":"public class CustomValidator implements ConstraintValidator {\n @Override\n public boolean isValid(String s, ConstraintValidatorContext constraintValidatorContext) {\n if (null == s || s.isEmpty()) {\n return true;\n }\n if (s.equals(\"tanglei\")) {\n return true;\n } else {\n error(constraintValidatorContext, \"Invalid params: \" + s);\n return false;\n }\n }\n\n @Override\n public void initialize(CustomParam constraintAnnotation) {\n }\n\n private static void error(ConstraintValidatorContext context, String message) {\n context.disableDefaultConstraintViolation();\n context.buildConstraintViolationWithTemplate(message).addConstraintViolation();\n }\n}\n"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"上面例子只爲了闡述說明問題，其中校驗邏輯沒有實際意義，這樣，如果輸入參數不滿足條件，就會明確提示用戶輸入的哪個參數不滿足條件。例如輸入參數 "},{"type":"codeinline","content":[{"type":"text","text":"xx"}]},{"type":"text","text":"，則會直接提示："},{"type":"codeinline","content":[{"type":"text","text":"Invalid params: xx"}]},{"type":"text","text":"。"}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/c9/c992ab878b2772ab909c7faf284031e2.png","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這個跟第一部分的處理方式類似，因爲現有的 validator 組件實現中，如果違反相應的約束也是一種拋異常的方式實現的，因此只需要在上述的 "},{"type":"codeinline","content":[{"type":"text","text":"GlobalExceptionHandler"}]},{"type":"text","text":"中添加相應的異常信息即可，這裏就不詳述了。 這不是本文的重點，這裏就不詳細闡述了。 詳細代碼實現可以參考本人之前寫的這篇文章"},{"type":"link","attrs":{"href":"/blog/custom-validator-and-i18n-error-message-in-springboot.html","title":null},"content":[{"type":"text","text":"一文教你實現 SpringBoot 中的自定義 Validator 和錯誤信息國際化配置"}],"marks":[{"type":"strong"}]},{"type":"text","text":"，上面有附完整的代碼實現。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#ffffff","name":"user"}}],"text":"場景重現"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"一切都顯得很完美，直到上線前代碼提交至安全團隊掃描，就被“啪啪打臉”，掃描報告反饋了一個嚴重的安全漏洞。而這個安全漏洞，屬於很高危的遠程代碼執行漏洞。"}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/d7/d75a17ce0d58dc297091a50cb9089307.gif","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"用前文提到的自定義 Validator，輸入的參數用： “1+1=${1+1}”，看看效果："}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/de/dee29148805b6c25d0b40648cd517763.png","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"太 TM 神奇了，居然幫我運算出來了，返回 "},{"type":"codeinline","content":[{"type":"text","text":"\"message\": \"Invalid params: 1+1=2\""}]},{"type":"text","text":"。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"問題就出現在實現自定義註解進行校驗的這行代碼（如下圖所示）："}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/a7/a7968c4cc1b12588e2a92d7fa45a96f6.png","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"其實，最開始的時候，這裏直接返回了“Invalid params”，當初爲了更好的用戶體驗，要明確告訴用戶哪個參數沒有通過校驗，因此在輸出的提示上加上了用戶輸入的字段，也就是上面的"},{"type":"codeinline","content":[{"type":"text","text":"\"Invalid params: \" + s"}]},{"type":"text","text":"，沒想到，這闖了大禍了（回過頭來想，感覺這裏沒必要這麼詳細啊，因爲前端已經有相應的校驗了，正常情況下回攔住，針對不守規矩的用非常規手段來的接口請求，直接返回校驗不通過就行了，畢竟不是對外提供的 OpenAPI 服務）。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"仔細看，這個方法實際上是 "},{"type":"codeinline","content":[{"type":"text","text":"ConstraintValidatorContext"}]},{"type":"text","text":"這個接口中聲明的，看方法名字其實能知道輸入參數是一個字符串模板，內部會進行解析替換的（這其實也符合“見名知意”的良好編程習慣）。（教訓："},{"type":"text","marks":[{"type":"strong"}],"text":"大家應該把握好自己寫的每一行代碼背後實際在做什麼"},{"type":"text","text":"。）"}]},{"type":"codeblock","attrs":{"lang":null},"content":[{"type":"text","text":"/* ......\n * @param messageTemplate new un-interpolated constraint message\n * @return returns a constraint violation builder\n */\nConstraintViolationBuilder buildConstraintViolationWithTemplate(String messageTemplate);\n"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這個 case，源碼調試進去之後，就能跟蹤到執行翻譯階段，在如下方法中： "},{"type":"codeinline","content":[{"type":"text","text":"org.hibernate.validator.messageinterpolation.AbstractMessageInterpolator.interpolateMessage"}]},{"type":"text","text":"。"}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/a7/a7968c4cc1b12588e2a92d7fa45a96f6.png","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"再往後，就是表達式求值了。"}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/a7/a7968c4cc1b12588e2a92d7fa45a96f6.png","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"以爲就這樣就完了嗎？"}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/0e/0edac034ada4801a0f187b757fa72334.jpeg","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"剛開始感覺，能幫忙算簡單的運算規則也就完了吧，你還能把我怎麼樣？其實這個相當於暴露了一個入口，支持用戶輸入任意 EL 表達式進行執行。網上通過關鍵字 “SpEL表達式注入漏洞” 找找，就能發現事情並沒有想象中那麼簡單。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"我們構造恰當的 EL 表達式（注意各種轉義，下文的輸入參數相對比較明顯在做什麼了，實際上還有更多黑科技，比如各種二進制轉義編碼啊等等），就能直接執行輸入代碼，例如：可以直接執行命令，“ls -al”， 返回了一個 UNIXProcess 實例，命令已經被執行過了。"}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/d8/d896cf46a8dc6631da5e203e3f7f146f.png","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"比如，我們執行個打開計算器的命令，搞個計算器玩玩~"}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/57/57c7f4aa82ea6aebff9e8887b0c365fd.png","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"我錄製了一個動圖，來個演示可能更生動一些。"}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/23/238cc2fabe679a761203342e286642a1.gif","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這還得了嗎？這相當於提供了一個 webshell 的功能呀，你看想運行啥命令就能運行啥命令，例如 ping 本人博客地址（"},{"type":"codeinline","content":[{"type":"text","text":"ping www.tanglei.name"}]},{"type":"text","text":"），下面動圖演示一下整個過程（從運行 ping 到 kill ping）。"}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/0b/0ba253bb8a6308e246e0da88e25c600d.gif","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"我錄製了一個視頻，點擊"},{"type":"link","attrs":{"href":"http://mp.weixin.qq.com/s?__biz=MzI3OTUzMzcwNw==&mid=100001493&idx=1&sn=d8d2374d8afa76e55bd37650c7ccde45&chksm=6b4707315c308e273f4eb62799c65677d849104125bb6e7a56fbded981554fb92e97c289804e#rd","title":null},"content":[{"type":"text","text":"這裏"}],"marks":[{"type":"strong"}]},{"type":"text","text":"可以訪問。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"豈不是直接創建一個用戶，然後遠程登錄就可以了。後果很嚴重啊，別人想幹嘛就幹嘛了。"}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/8c/8c1a54b2ca0478284b89d39a90c7b445.gif","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"我們跟蹤下對應的代碼，看看內部實現，就會“恍然大悟”了。"}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/55/55e7fe990f5f612d17fc47bf27aa95b3.png","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/9f/9f208fb6c3542f494090442713b2b623.png","alt":"","title":null,"style":null,"href":null,"fromPaste":true,"pastePass":true}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#ffffff","name":"user"}}],"text":"經驗教訓"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"幸虧這個漏洞被扼殺在搖籃裏，否則後果還真的挺嚴重的。通過這個案例，我們有啥經驗和教訓呢？那就是作爲程序員，"},{"type":"text","marks":[{"type":"strong"}],"text":"我們要對每一行代碼都保持“敬畏”之心"},{"type":"text","text":"。也許就是因爲你的不經意的一行代碼就帶來了嚴重的安全漏洞，要是不小心被壞人利用，輕則……重則……（自己想象吧）"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"此外，我們也應該看到，程序員需要對常見的安全漏洞（例如XSS/CSRF/SQL注入等等）有所瞭解，並且要有足夠的安全意識（其實有時候研究一些安全問題還挺好玩的，比如這篇"},{"type":"link","attrs":{"href":"http://mp.weixin.qq.com/s?__biz=MzI3OTUzMzcwNw==&mid=2247483759&idx=1&sn=9b37547a51ac99a8d3d50cb9cf54a99a&chksm=eb47008bdc30899dace5743edfc071d97d37764ed69bd9cebbfe32c14727a7407a6b8b76a433&scene=21#wechat_redirect","title":null},"content":[{"type":"text","text":"《RSA算法及一種\"旁門左道\"的攻擊方式》"}],"marks":[{"type":"strong"}]},{"type":"text","text":"就比較有趣）。例如："}]},{"type":"bulletedlist","content":[{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"用戶權限分離：運行程序的用戶不應該用 root，例如新建一個“web”或者“www”之類的用戶，並設置該用戶的權限，比如不能有可執行 xx 的權限之類的。本文 case，如果權限進行了分離（遵循最小權限原則），應該也不會這麼嚴重。（本文就剛好是因爲是測試環境，所以沒有強制實施）"}]}]},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"任何時候都不要相信用戶的輸入，必須對用戶輸入的進行校驗和過濾，又特別是針對公網上的應用。"}]}]},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"敏感信息加密保存。退一萬步講，假設攻擊者攻入了你的服務器，如果這個時候，你的數據庫賬戶信息等配置都直接明文保存在服務器中。那數據庫也被脫走了。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"如果可能的話，需要對開發者的代碼進行漏洞掃描。一些常見的安全漏洞現在應該是有現成的工具支持的。另外，讓專業的人做專業的事情，例如要有安全團隊，可能你會說你們公司沒有不也活的好好的，哈哈，只不過可能還沒有被壞人盯上而已，壞人也會考慮到他們的成本和預期收益的，當然這就更加對我們開發者提高了要求。一些敏感權限盡量控制在少部分人手中，配合相應的流程來支撐（不得不說，大公司繁瑣的流程還是有一定道理的）。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"畢竟我不是專業研究Web安全的，以上說得可能也不一定對，如果你有不同意見或者更好的建議歡迎留言參與討論。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這篇文章從寫代碼做實驗，到錄屏做視頻動圖等等耗時還蠻久的（好幾個週末的時間呢），原創真心不易，希望你能幫我個小忙唄，如果本文內容你覺得有所啓發，有所收穫，請幫忙點個“在看”唄，或者轉發分享讓更多的小夥伴看到。"}]},{"type":"heading","attrs":{"align":null,"level":5},"content":[{"type":"text","text":"精彩推薦"}]},{"type":"bulletedlist","content":[{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"http://mp.weixin.qq.com/s?__biz=MzI3OTUzMzcwNw==&mid=2247483933&idx=1&sn=69b1be012cf37ccb5ce6f3a091f57f5b&chksm=eb4703f9dc308aef5834a6abf72255edd1767e633330531f817d7b4774c65c33f5910cd9ea75&scene=21#wechat_redirect","title":null},"content":[{"type":"text","text":"一個由跨平臺產生的浮點數bug | 有你意想不到的結果。"}],"marks":[{"type":"strong"}]}]}]},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"http://mp.weixin.qq.com/s?__biz=MzI3OTUzMzcwNw==&mid=2247483759&idx=1&sn=9b37547a51ac99a8d3d50cb9cf54a99a&chksm=eb47008bdc30899dace5743edfc071d97d37764ed69bd9cebbfe32c14727a7407a6b8b76a433&scene=21#wechat_redirect","title":null},"content":[{"type":"text","text":"RSA算法及一種\"旁門左道\"的攻擊方式。"}],"marks":[{"type":"strong"}]}]}]},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"http://mp.weixin.qq.com/s?__biz=MzI3OTUzMzcwNw==&mid=2247483891&idx=1&sn=264171adf872514d1fd54faf54970dd7&chksm=eb470017dc3089019ffc13facfdfb38e9d5f2adaf7fcbf9c117723ce015fb660f0802d406c7b&scene=21#wechat_redirect","title":null},"content":[{"type":"text","text":"震驚! 阿里的程序員也不過如此,竟被一個簡單的 SQL 查詢難住。"}],"marks":[{"type":"strong"}]}]}]},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"https://mp.weixin.qq.com/s?__biz=MzI3OTUzMzcwNw==&mid=2247483912&idx=1&sn=520bbca6a2056ab4df6b0e1d0ebaf6e0&chksm=eb4703ecdc308afa83b288b1469f0927c1916189f219ee5e8c3c5194defc0b8f313ff7607730&scene=21#wechat_redirect","title":null},"content":[{"type":"text","text":"面了7輪 Google，最終還是逃不脫被掛的命運。"}],"marks":[{"type":"strong"}]}]}]}]},{"type":"blockquote","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"color","attrs":{"color":"#6a737d","name":"user"}},{"type":"bgcolor","attrs":{"color":"#fff9f9","name":"user"}}],"text":"文章首發於本人微信公衆號（ID："},{"type":"codeinline","content":[{"type":"text","text":"tangleithu"}],"marks":[{"type":"color","attrs":{"color":"#6a737d","name":"user"}},{"type":"bgcolor","attrs":{"color":"#fff9f9","name":"user"}}]},{"type":"text","marks":[{"type":"color","attrs":{"color":"#6a737d","name":"user"}},{"type":"bgcolor","attrs":{"color":"#fff9f9","name":"user"}}],"text":"），請感興趣的同學關注我的微信公衆號，及時獲取技術乾貨。"}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}}]}