A method and apparatus for identifying security of JSP action tag
By using bytecode instrumentation to monitor the input parameters of JSP action tags and determine whether the parameters they carry are consistent with the parameters in the request, the security risk of JSP action tags carrying tainted data is resolved, and secure identification of JSP action tags is achieved, thereby improving the security of the application.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SECZONE TECH CO LTD
- Filing Date
- 2022-10-18
- Publication Date
- 2026-07-31
AI Technical Summary
JSP action tags carry tainted data when responding to client requests, which poses a security risk that can be exploited by hackers. Existing technologies have failed to effectively identify this, resulting in insufficient security.
By using bytecode instrumentation to monitor the .class files of JSP pages, the input parameters of JSP action tags can be obtained, and it can be determined whether the parameters carried by the tags are consistent with the parameters obtained in the request. If they are consistent, it is determined that there is a security risk, and then tags containing tainted data can be identified.
It can effectively identify whether JSP action tags have security risks, helping technicians to take preventative measures, reduce the risk of attacks, and improve application security.
Smart Images
Figure CN115913638B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and specifically to a method and apparatus for identifying the security of JSP action tags. Background Technology
[0002] JSP (Java Server Pages) is a dynamic web page development technology standard. It primarily involves deploying JSP on a web server, responding to client requests, and dynamically generating HTML, XML, or other formatted web pages, which are then returned to the requester. JSP introduces JSP action tags, which are XML tags used to invoke functions built into the web server.
[0003] JSP action tags can control server behavior, enabling various common JSP page functions as well as specialized functions for handling complex business logic. Therefore, when a client initiates a request, corresponding JSP action tags are typically executed to respond. Some requests contain tainted data, which can lead to JSP action tags also carrying such data. Tainted data refers to user input, which poses a risk of being exploited by hackers. Therefore, without security checks when executing JSP action tags, security risks can easily arise. For example, if a JSP page uses the `jsp:forward` tag for redirection, and the redirect path uses the `jsp:param` tag to carry parameters that require user input, a security risk exists in this scenario.
[0004] Therefore, it is necessary to provide a method and apparatus for identifying the security of JSP action tags in order to solve the above problems. Summary of the Invention
[0005] The purpose of this invention is to provide a method and apparatus for identifying the security of JSP action tags. This method can determine whether there is tainted data in the parameters carried by JSP action tags in a JSP page, thereby identifying which JSP action tags pose security risks. This helps technicians to take preventative measures in advance, thereby reducing the risk of attacks by attackers and improving the security of applications.
[0006] To achieve the above objectives, the present invention provides a method for identifying the security of JSP action tags, comprising:
[0007] Determine the target JSP page on the server based on the request;
[0008] Obtain the parameters carried by the JSP action tags declared in the target JSP page;
[0009] Determine whether the target JSP page contains a parameter retrieval method for obtaining parameter data from the request;
[0010] If it exists, then determine the first parameter that is passed the parameter data by the parameter acquisition method;
[0011] The target parameter in the parameters carried by the JSP action tag is determined based on the first parameter, and the first parameter is consistent with the target parameter;
[0012] The JSP action tag to which the target parameter belongs is identified as having a security risk.
[0013] Optionally, the "determining the target JSP page within the server based on the request" includes:
[0014] The client sends the request to the application deployed on the server;
[0015] The application determines the JSP page to be accessed based on the request;
[0016] The JSP page to be accessed is identified as the target JSP page.
[0017] Optionally, the step of "obtaining the parameters carried by the JSP action tags declared in the target JSP page" includes:
[0018] Convert the target JSP page into a .class file;
[0019] The code for monitoring the instrumentation of the _jspService() method in the .class file is based on bytecode instrumentation technology.
[0020] The monitoring code obtains the input parameters of the method that processes the JSP action tag in the .class file, and determines the input parameters as the parameters carried by the JSP action tag.
[0021] Optionally, the parameter retrieval method includes one or more of the following three methods: request.getParameter(), request.getParameterValue(), and request.getQueryString().
[0022] Optionally, the step of "determining the target parameter among the parameters carried by the JSP action tag based on the first parameter" includes:
[0023] Match the corresponding attributes of the parameters carried by the JSP action tag according to the attributes of the first parameter;
[0024] The parameter whose corresponding attribute is the same as the attribute of the first parameter among the parameters carried by the JSP action tag is determined as the target parameter.
[0025] Optionally, the method further includes:
[0026] A counter value is declared within the server. When the server is in a state of responding to the request, the counter value is a first value, and when the server is not in a state of responding to the request, the counter value is a second value.
[0027] The server is able to respond to the request if and only if the count value is the second value, and during the response process, the count value is set to the first value.
[0028] Optionally, the method further includes:
[0029] When the client sends multiple requests to the application deployed on the server, all of which are for accessing the same target JSP page, the target JSP page that responds to each request is marked respectively;
[0030] The parameters carried by the JSP action tags obtained from the target JSP page are summarized by the tag, so that the parameters carried by the JSP action tags that respond to the same request on the target JSP page are summarized together.
[0031] The security of the JSP action tag to which the summarized parameters belong is determined according to the summarization results.
[0032] To achieve the above objectives, the present invention also provides a device for identifying the security of JSP action tags, comprising:
[0033] The page determination module is used to determine the target JSP page on the server based on the request.
[0034] The acquisition module is used to acquire the parameters carried by the JSP action tags declared in the target JSP page;
[0035] The first determining module is used to determine whether there is a parameter obtaining method in the target JSP page for obtaining parameter data from the request, and when the parameter obtaining method exists in the target JSP page, to determine the first parameter that is passed the parameter data by the parameter obtaining method;
[0036] The second determining module is used to determine the target parameter among the parameters carried by the JSP action tag based on the first parameter, wherein the first parameter is consistent with the target parameter;
[0037] The risk determination module is used to determine whether the JSP action tag to which the target parameter belongs has a security risk.
[0038] To achieve the above objectives, the present invention also provides an electronic device, comprising:
[0039] processor;
[0040] A memory in which executable instructions of the processor are stored;
[0041] The processor is configured to perform the method described above for identifying the security of JSP action tags by executing the executable instructions.
[0042] To achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method for identifying the security of JSP action tags as described above.
[0043] The present invention also provides a computer program product or computer program comprising computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned method for identifying the security of JSP action tags.
[0044] This invention determines the target JSP page on the server based on the request, obtains the parameters carried by the JSP action tags declared in the target JSP page, and then determines whether there is a parameter retrieval method in the target JSP page for obtaining parameter data from the request. If a parameter retrieval method exists, it can be assumed that user input data has been obtained from the request. Therefore, the parameter passed by the parameter retrieval method is determined as the first parameter, and the target parameter in the parameters carried by the JSP action tag is determined based on the first parameter. If the target parameter is consistent with the first parameter, the JSP action tag to which the target parameter belongs is determined to have a security risk. This invention can determine whether there is tainted data in the parameters carried by JSP action tags in a JSP page, thereby identifying which JSP action tags have security risks. This helps technicians to take preventative measures in advance, thereby reducing the risk of attacks by attackers and improving the security of applications. Attached Figure Description
[0045] Figure 1 This is a flowchart of the method for identifying the security of JSP action tags according to the present invention.
[0046] Figure 2 This is a sample diagram of a .class file converted from a JSP page.
[0047] Figure 3 This is a sample JSP page diagram containing tainted data.
[0048] Figure 4 yes Figure 3 A diagram showing the corresponding .class file.
[0049] Figure 5 This is a schematic block diagram of a device for identifying the security of JSP action tags according to an embodiment of the present invention.
[0050] Figure 6 This is a schematic block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation
[0051] To explain in detail the technical content, structural features, objectives and effects of the present invention, the following description is provided in conjunction with the embodiments and accompanying drawings.
[0052] Please see Figure 1 , Figure 3 and Figure 4 This invention discloses a method for identifying the security of JSP action tags, comprising:
[0053] S1. Determine the target JSP page on the server based on the request.
[0054] Specifically, step S1 includes:
[0055] The client sends a request to the application deployed on the server;
[0056] The application determines the JSP page to be accessed based on the request;
[0057] The JSP page to be accessed is identified as the target JSP page.
[0058] Generally, a client can send a request to a server through a browser, including the path to the requested resource in the request. When the application deployed on the server receives the request, it matches the corresponding JSP page to respond. Therefore, by designing the request, security checks can be performed on the JSP action tags of different JSP pages.
[0059] S2. Obtain the parameters carried by the JSP action tags declared in the target JSP page.
[0060] Specifically, the parameters carried by the obtained JSP action tags can include the parameter name and the corresponding parameter data.
[0061] Understandably, JSP action tags are generally predefined functions. The JSP specification defines a series of standard actions, which are JSP action tags, including: jsp:include, jsp:forward, jsp:param, etc. The jsp:include action tag is used to insert the output of another file into the output of the current JSP page; the jsp:forward action tag is used to forward the request to another JSP, HTML, or related resource file; and the jsp:param action tag is often used as a child tag of other tags to pass parameters to them.
[0062] Specifically, step S2 includes:
[0063] Convert the target JSP page into a .class file;
[0064] This involves instrumenting the _jspService() method in a .class file using bytecode instrumentation technology to monitor code performance.
[0065] By monitoring the code, the input parameters of the methods that process JSP action tags in the .class file are obtained, and the input parameters are determined to be the parameters carried by the JSP action tags.
[0066] When the server receives a request, it loads the corresponding JSP page. The JSP engine on the server converts the target JSP page into Servlet source code (i.e., .java file), and then the Java compiler compiles the Servlet to obtain the corresponding .class file.
[0067] The .class file mainly includes the _jspInit(), _jspService(), and _jspDestroy() methods, which can be found in the documentation. Figure 2 , Figure 2 The JSP action tag includes the three methods mentioned above. Executing the `_jspInit()` method performs initialization, executing the `_jspService()` method handles client requests, and executing the `_jspDestroy()` method closes or destroys the JSP page. Therefore, JSP action tags only need to focus on the `_jspService()` method, and bytecode instrumentation techniques can be used to instrument the `_jspService()` method in the `.class` file to monitor the code.
[0068] Specifically, before the .class file is loaded into memory, the _jspService() method is instrumented using bytecode instrumentation to collect the input parameters of the method that processes JSP action tags. The instrumentation monitoring code can be designed according to the purpose. In this application, it is necessary to obtain method information and method input parameter information, so the corresponding monitoring code can be designed and instrumented in the _jspService() method, and the corresponding information can be returned when it is executed.
[0069] For example, the method corresponding to `jsp:forward` can be `PageContext.forward(String param)`, where the parameter `param` is the parameter carried by `jsp:forward` during the redirection; the method corresponding to `jsp:include` is `JspRuntimeLibrary.include(ServletRequest request,ServletResponse response,String relativePath,JspWriter out,boolean flush)`, where the parameter `relativePath` represents the target page path, and the parameters carried by `jsp:include` will include this parameter.
[0070] In some embodiments, to prevent other threads from interfering with the current thread, Java locks can be introduced, specifically including:
[0071] Declare a counter value within the server. When the server is responding to a request, the counter value is the first value, and when the server is not responding to a request, the counter value is the second value.
[0072] The server is able to respond to the request and, in the response process, set the count value to the first value if and only if the count value is the second value.
[0073] In other words, new threads are only allowed to enter when the server is not responding to the corresponding request, in order to avoid data corruption caused by multi-threaded operations and affect the results of security assessment.
[0074] Specifically, the Java lock-related code can also be instrumented into the .class file via bytecode instrumentation and placed before the _jspService() method. This ensures that the counter value is checked every time the _jspService() method is executed, thus avoiding interference from other threads.
[0075] S3. Determine if the target JSP page contains a parameter retrieval method for obtaining parameter data from the request.
[0076] The methods for obtaining parameters include one or more of the following: `request.getParameter()`, `request.getParameterValue()`, and `request.getQueryString()`. These three methods are used to retrieve parameter data submitted by the user, which means that any parameter data obtained through these three methods is considered tainted data. Figure 3 and Figure 4 As shown.
[0077] S4. If it exists, determine the first parameter of the parameter data passed by the method to obtain the parameter.
[0078] When the target JSP page has a parameter retrieval method, it can be determined that the parameters within the target JSP page contain tainted data. Therefore, it is necessary to further determine whether the tainted data belongs to the parameters carried by the JSP action tag. By determining the parameter retrieval method, the obtained parameter data is assigned to the parameters within the target JSP page; such parameters are called the first parameters.
[0079] S5. Determine the target parameter in the parameters carried by the JSP action tag based on the first parameter. The first parameter is consistent with the target parameter.
[0080] It is understandable that the first parameter being consistent with the target parameter can mean that the two have the same attributes, and the attributes can be parameter names, parameter data, or a combination of parameter names and parameter data.
[0081] Specifically, step S5 includes:
[0082] Match the attributes of the first parameter to the corresponding attributes of the parameters carried by the JSP action tag;
[0083] The parameter whose corresponding attribute is the same as the attribute of the first parameter in the parameters carried by the JSP action tag is determined as the target parameter.
[0084] In other words, the parameter name or parameter data of the first parameter is matched with the parameter name or parameter data of the parameter carried by the JSP action tag. When a match is found, it can be determined that the parameter carried by the JSP action tag has tainted data, and it is identified as the target parameter.
[0085] S6. Identify the JSP action tag to which the target parameter belongs as having a security risk.
[0086] In some embodiments, when there are multiple requests, and these requests all access the same JSP page, in order to avoid confusion in the obtained results, it is necessary to mark the response JSP page, specifically including:
[0087] When the client sends multiple requests to the application deployed on the server, all of which are for accessing the same target JSP page, the corresponding target JSP page responding to each request is marked separately.
[0088] The parameters carried by the JSP action tags obtained from the target JSP page are summarized by tags, so that the parameters carried by the JSP action tags that respond to the same request on the target JSP page are summarized together.
[0089] The security of the JSP action tags to which the parameters belong is determined according to the summarization results.
[0090] For example, if there are requests A and B that need to be sent to the server, and the JSP page accessed by requests A and B is the same, then the target JSP page responding to request A is marked as A, and the target JSP page responding to request B is marked as B. Then, the parameters carried by the obtained JSP action tags are classified and summarized according to the corresponding tags to avoid data disorder during analysis.
[0091] This invention determines the target JSP page on the server based on the request, obtains the parameters carried by the JSP action tags declared in the target JSP page, and then determines whether there is a parameter retrieval method in the target JSP page for obtaining parameter data from the request. If a parameter retrieval method exists, it can be assumed that user input data has been obtained from the request. Therefore, the parameter passed by the parameter retrieval method is determined as the first parameter, and the target parameter in the parameters carried by the JSP action tag is determined based on the first parameter. If the target parameter is consistent with the first parameter, the JSP action tag to which the target parameter belongs is determined to have a security risk. This invention can determine whether there is tainted data in the parameters carried by JSP action tags in a JSP page, thereby identifying which JSP action tags have security risks. This helps technicians to take preventative measures in advance, thereby reducing the risk of attacks by attackers and improving the security of applications.
[0092] Please see Figure 5 This invention also discloses a device for identifying the security of JSP action tags, comprising:
[0093] Page determination module 100 is used to determine the target JSP page in the server based on the request;
[0094] Module 200 is used to retrieve the parameters carried by the JSP action tags declared in the target JSP page;
[0095] The first determining module 300 is used to determine whether there is a parameter-obtaining method in the target JSP page for obtaining parameter data from the request, and when there is a parameter-obtaining method in the target JSP page, to determine the first parameter of the parameter data passed by the parameter-obtaining method.
[0096] The second determining module 400 is used to determine the target parameter in the parameters carried by the JSP action tag according to the first parameter, wherein the first parameter is consistent with the target parameter;
[0097] The risk assessment module 500 is used to identify the JSP action tags to which the target parameters belong as having security risks.
[0098] This invention can determine whether there is tainted data in the parameters carried by JSP action tags in JSP pages, thereby identifying which JSP action tags pose security risks. This helps technicians to take preventative measures in advance, thereby reducing the risk of attacks by attackers and improving the security of applications.
[0099] Please see Figure 6 The present invention also discloses an electronic device, comprising:
[0100] Processor 40;
[0101] Memory 50, which stores executable instructions of processor 40;
[0102] The processor 40 is configured to execute the method described above for identifying the security of JSP action tags by executing executable instructions.
[0103] This invention also discloses a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method described above for identifying the security of JSP action tags.
[0104] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the method for identifying the security of JSP action tags as described above.
[0105] It should be understood that, in this embodiment of the invention, the processor may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.
[0106] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by hardware related to computer program instructions. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.
[0107] The above-disclosed examples are merely preferred embodiments of the present invention and should not be construed as limiting the scope of the present invention. Therefore, any equivalent variations made in accordance with the claims of the present invention are within the scope of the present invention.
Claims
1. A method for identifying the security of a JSP action tag, characterized by, include: Determine the target JSP page on the server based on the request; Obtain the parameters carried by the JSP action tags declared in the target JSP page; Determine whether the target JSP page contains a parameter retrieval method for obtaining parameter data from the request; If it exists, then determine the first parameter that is passed the parameter data by the parameter acquisition method; The target parameter in the parameters carried by the JSP action tag is determined based on the first parameter, and the first parameter is consistent with the target parameter; The JSP action tag to which the target parameter belongs is identified as having a security risk; The phrase "determine the target JSP page within the server based on the request" includes: The client sends the request to the application deployed on the server; The application determines the JSP page to be accessed based on the request; The JSP page to be accessed is identified as the target JSP page; When the client sends multiple requests to the application deployed on the server, all of which are for accessing the same target JSP page, the target JSP page that responds to each request is marked respectively; The parameters carried by the JSP action tags obtained from the target JSP page are summarized by the tag, so that the parameters carried by the JSP action tags that respond to the same request in the target JSP page are summarized together. The security of the JSP action tag to which the summarized parameters belong is determined according to the summarization results.
2. The method for identifying the security of JSP action tags as described in claim 1, characterized in that, The phrase "obtaining the parameters carried by the JSP action tags declared in the target JSP page" includes: Convert the target JSP page into a .class file; The code for monitoring the instrumentation of the _jspService() method in the .class file is based on bytecode instrumentation technology. The monitoring code obtains the input parameters of the method that processes the JSP action tag in the .class file, and determines the input parameters as the parameters carried by the JSP action tag.
3. The method for identifying the security of JSP action tags as described in claim 1, characterized in that, The parameter retrieval methods include one or more of the following: request.getParameter(), request.getParameterValue(), and request.getQueryString().
4. The method for identifying the security of JSP action tags as described in claim 1, characterized in that, The phrase "determining the target parameter among the parameters carried by the JSP action tag based on the first parameter" includes: Match the corresponding attributes of the parameters carried by the JSP action tag according to the attributes of the first parameter; The parameter whose corresponding attribute is the same as the attribute of the first parameter among the parameters carried by the JSP action tag is determined as the target parameter.
5. The method for identifying the security of JSP action tags as described in claim 1, characterized in that, Also includes: A counter value is declared within the server. When the server is in a state of responding to the request, the counter value is a first value, and when the server is not in a state of responding to the request, the counter value is a second value. The server is able to respond to the request if and only if the count value is the second value, and during the response process, the count value is set to the first value.
6. A device for identifying the security of JSP action tags, characterized in that, include: The page determination module is used to determine the target JSP page on the server based on the request. The acquisition module is used to acquire the parameters carried by the JSP action tags declared in the target JSP page; The first determining module is used to determine whether there is a parameter obtaining method in the target JSP page for obtaining parameter data from the request, and when the parameter obtaining method exists in the target JSP page, to determine the first parameter that is passed the parameter data by the parameter obtaining method; The second determining module is used to determine the target parameter among the parameters carried by the JSP action tag based on the first parameter, wherein the first parameter is consistent with the target parameter; The risk determination module is used to determine whether the JSP action tag to which the target parameter belongs is a security risk. The phrase "determine the target JSP page within the server based on the request" includes: The client sends the request to the application deployed on the server; The application determines the JSP page to be accessed based on the request; The JSP page to be accessed is identified as the target JSP page; When the client sends multiple requests to the application deployed on the server, all of which are for accessing the same target JSP page, the target JSP page that responds to each request is marked respectively; The parameters carried by the JSP action tags obtained from the target JSP page are summarized by the tag, so that the parameters carried by the JSP action tags that respond to the same request in the target JSP page are summarized together. The security of the JSP action tag to which the summarized parameters belong is determined according to the summarization results.
7. An electronic device, characterized in that, include: processor; A memory in which executable instructions of the processor are stored; The processor is configured to execute the method for identifying the security of JSP action tags according to any one of claims 1-5 by executing the executable instructions.
8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method for identifying the security of JSP action tags as described in any one of claims 1-5.