Component-based method and system for achieving xxs protection for system

Abstract

The present invention relates to the technical field of network security, and specifically disclosed are a component-based system and method for achieving XSS protection for a system. The component-based system for achieving XSS protection of a system comprises: a request message reception module, which is used for receiving a request message; a thread data enablement determination module, which is used for enabling thread data to obtain a thread data enablement state when it is determined that a request message needs to be intercepted; an annotation search and storage module, which is used for storing a preset filter annotation in the class of the request message into the thread data, to obtain final thread data; a component creation module, which is used for generating an XSS protection component on the basis of the thread data enablement state and the final thread data; an intercepted data determination module, which is used for obtaining intercepted request thread data on the basis of the XSS protection component; and an interception protection execution module, which is used for deleting the intercepted request thread data and returning a request result. The present invention is used for developers to achieve code-level control and self-implementation of an XSS processing policy.

Description

System and method for implementing system XSS protection in a componentized manner TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a system and method for implementing system XSS protection in a componentized manner. BACKGROUND

[0002] Currently, XSS (Cross-Site Scripting) attack is the most common web attack, which is a code injection attack. Attackers inject malicious scripts on target websites, which run on the user's browser. Using these malicious scripts, attackers can obtain sensitive information such as cookies, SessionID, etc. of users, and thus endanger data security. In Jave Web applications, filters are generally used to implement XSS protection. Filters are components in the Jave Servlet specification, which can intervene and modify requests and responses before the request reaches the Servlet or before the response is given to the client. The brief process of implementing XSS protection based on filters is as follows: S1: create a filter class, implement the javax.servlet.Filter interface, and implement the doFilter method. S2: create a HttpServletRequest wrapper class to filter and process XSS when obtaining parameters. This process can use different XSS filtering methods according to specific needs, such as using regular expressions for replacement or using third-party XSS filtering libraries. S3: enable the filter in the Jave Web application.

[0003] The Java XSS protection component implemented based on filters has the following problems: 1. The XSS processing strategy does not support class / method / field-level custom configuration, cannot provide code-level control, and cannot meet the needs of developers to deal with complex application scenarios, such as field-level ignoring, field-level XSS custom configuration, etc. 2. It does not support some special scenarios, such as field control when receiving multi-level nested objects, custom processing and releasing a certain specific tag when the parameter is rich text content, etc.

[0004] Therefore, the present application proposes a system and method for implementing system XSS protection in a componentized manner.

[0005] SUMMARY

[0006] The application provides a system and method for realizing system XSS protection in a component manner, so as to support custom configuration at the class / method / field level for an interceptor-based XSS processing strategy; preset filter annotations are provided to facilitate developers to realize code-level control, such as field-level ignoring and field-level XSS custom configuration; an extension mode for custom XSS processing is provided, and developers can realize an XSS processing strategy according to specific business scenarios. When the received parameters are multi-level nested objects, field-level control is supported through annotations and parameter passing, such as a Person object with multi-level nested student and course objects, and through method-level annotations and parameter passing @XSSIgnore(value={"sex", "student.course.teacher"}), sex and student.course.teacher fine-grained control can be realized. A tag library function is realized, developers can customize a specific tag that needs to be released or processed, and rich text application scenarios are supported.

[0007] The application provides a system for realizing system XSS protection in a component manner, comprising:

[0008] A request message receiving module is configured to receive a request message sent from a client;

[0009] A thread data enabling judgment module is configured to enable thread data and obtain a thread data enabling state when it is determined that the request message needs to be intercepted based on a user-defined Web application interceptor routing control strategy;

[0010] An annotation retrieval and storage module is configured to determine whether preset filter annotations exist in a class related to the request message, and if so, store the preset filter annotations existing in the class related to the request message in the thread data to obtain final thread data;

[0011] A component creation module is configured to generate an XSS protection component based on the thread data enabling state and the final thread data;

[0012] An intercepted data determination module is configured to perform XSS protection processing on the request message based on the XSS protection component to obtain intercepted request thread data;

[0013] An interception protection execution module is configured to delete the intercepted request thread data and return a request result.

[0014] Preferably, the request message receiving module comprises:

[0015] A first receiving submodule is configured to receive a request message of an HTTP protocol sent from a client;

[0016] The second receiving sub-module is configured to receive a request message in an HTTPS protocol sent by the client.

[0017] Preferably, the thread data enabling judging module comprises:

[0018] The interception judging sub-module is configured to judge whether the request message needs to be intercepted based on the user-defined Web application interceptor routing control strategy and the behavior analysis judging result of the request message, and obtain an interception judging result;

[0019] The first judging sub-module is configured to enable the thread data when the interception judging result is that the request message needs to be intercepted, and take the enabled thread data as the thread data enabling state.

[0020] The second judging sub-module is configured to not enable the thread data when the interception judging result is that the request message does not need to be intercepted, and take the un-enabled thread data as the thread data enabling state.

[0021] Preferably, the interception judging sub-module comprises:

[0022] The behavior analysis judging unit is configured to perform behavior analysis judging on the request file, and obtain a behavior analysis judging result of the request message.

[0023] The need-interception judging unit is configured to judge that the request message needs to be intercepted when the behavior analysis judging result of the request message is that the request message is attackable or the request message hits the Web application interceptor routing control strategy, and take the result as the interception judging result.

[0024] The no-need-interception judging unit is configured to judge that the request message does not need to be intercepted when the behavior analysis judging result of the request message is that the request message is not attackable and the request message does not hit the Web application interceptor routing control strategy, and take the result as the interception judging result.

[0025] Preferably, the behavior analysis judging unit comprises:

[0026] The step attackability evaluating sub-unit is configured to perform attackability evaluation on each execution step in the request execution task in the request message, and obtain an attack performance value of each execution step in the request message.

[0027] The attack step preliminary selection sub-unit is configured to take an execution step with an attack performance value exceeding an attack performance threshold in the request execution task as a suspected attack behavior step.

[0028] The logic tree building sub-unit is configured to determine an execution logic tree of the request execution task based on the execution logic of all execution steps in the request execution task.

[0029] The comprehensive attack performance evaluation subunit is configured to evaluate a comprehensive attack performance value of the request execution task of the request message based on distribution characteristics and attack performance values of all suspected attack behavior steps in the execution logic tree in performing the task.

[0030] The first behavior analysis determination subunit is configured to determine that the request message is attack if the comprehensive attack performance value of the request execution task of the request message is not less than the comprehensive attack performance threshold.

[0031] The second behavior analysis determination subunit is configured to determine that the request message is not attack if the comprehensive attack performance value of the request execution task of the request message is less than the comprehensive attack performance threshold.

[0032] Preferably, the step attack evaluation subunit comprises:

[0033] The evaluation model building end is configured to obtain a preset step attack evaluation model.

[0034] The step attack evaluation end is configured to input each execution step in the request execution task of the request message into the preset step attack evaluation model to obtain an attack performance value of each execution step in the request message.

[0035] Preferably, the comprehensive attack performance evaluation subunit comprises:

[0036] The tree structure topology screening end is configured to determine all suspected attack behavior step topology structures with maximum degree of continuity in all topological orders in the execution logic tree.

[0037] The evaluation weight determination end is configured to take a quotient of a difference between a maximum level number of the execution logic tree and a minimum level tree in each suspected attack behavior step topology structure and the maximum level number of the execution logic tree as an attack evaluation weight of each suspected attack behavior step topology structure.

[0038] The sub-comprehensive attack performance determination end is configured to take a product of a sum of attack performance values of all suspected attack behavior steps in each suspected attack behavior step topology structure and the corresponding attack evaluation weight as a sub-comprehensive attack performance value of each suspected attack behavior step topology structure.

[0039] The comprehensive attack performance determination end is configured to take a sum of the sub-comprehensive attack performance values of all suspected attack behavior step topology structures in the execution logic tree as the comprehensive attack performance value of the request execution task of the request message.

[0040] Preferably, the annotation retrieval and storage module comprises:

[0041] A class inspection submodule is configured to determine whether the @XSS annotation or / and the @XSSIgnore annotation in the preset filter annotation exists in a class involved in the request message, and if so, to call a thread-local variable object in a ThreadLocal type of a sub-class in a thread data pool.

[0042] A gradual storage submodule is configured to store the @XSS annotation or / and the @XSSIgnore annotation existing in the class involved in the request message into the current thread data in a key-value pair mapping set of the thread-local variable object of the ThreadLocal type, and obtain final thread data.

[0043] Preferably, the component creation module comprises:

[0044] A first creation submodule is configured to, when the parameter formatting or deserialization is performed, if it is determined that the thread data is enabled based on the thread data enabling state, create a method-level XSSConfig object based on the preset filter annotation stored in the thread data, and generate an XSS protection component based on the method-level XSSConfig object.

[0045] A second creation submodule is configured to, when the parameter formatting or deserialization is performed, if it is determined that the thread data is not enabled based on the thread data enabling state, generate an XSS protection component based on the global XSS configuration of the Java Web by default.

[0046] The application provides a method for implementing system XSS protection in a componentized manner, which is applied to the system for implementing system XSS protection in a componentized manner in any one of embodiments 1 to 9, and comprises the following steps:

[0047] S1: receiving a request message sent from a client;

[0048] S2: when it is determined that the request message needs to be intercepted based on a user-defined Web application interceptor routing control strategy, enabling thread data to obtain a thread data enabling state;

[0049] S3: determining whether a preset filter annotation exists in a class involved in the request message, and if so, storing the preset filter annotation existing in the class involved in the request message into the thread data to obtain final thread data;

[0050] S4: generating an XSS protection component based on the thread data enabling state and the final thread data;

[0051] S5: performing XSS protection processing on the request message based on the XSS protection component to obtain intercepted request thread data;

[0052] S6: deleting the intercepted request thread data and returning a request result.

[0053] The beneficial effects of the present application relative to the prior art are: enabling the XSS processing strategy based on the interceptor to support class / method / field level custom configuration; providing preset filter annotations to facilitate developers to implement code level control, such as field level ignore, field level XSS custom configuration, etc.; providing an extension mode of custom XSS processing, and developers can implement XSS processing strategy according to specific business scenarios. When the received parameters are multi-level nested objects, field level control is supported through annotation parameter passing, such as the Person object multi-level nested student and course object, through the method level annotation and parameter passing @XSSIgnore(value={"sex","student.course.teacher"}), sex, student.course.teacher fine-grained control can be realized. The tag library function is realized, and developers can customize a certain specific tag that needs to be released or processed, and support the application scenario of rich text.

[0054] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application can be realized and achieved by the structure particularly pointed out in the specification.

[0055] The technical solutions of the present application will be further described in detail below with the help of the drawings and examples. BRIEF DESCRIPTION OF DRAWINGS

[0056] The accompanying drawings are included to provide a further understanding of the present application, and constitute a part of the specification, together with the embodiments of the present application, to explain the present application, and do not constitute a limitation of the present application. In the drawings:

[0057] Fig. 1 is a system internal function module schematic diagram of the component implementation system XSS protection in the embodiment of the present application;

[0058] Fig. 2 is a request message receiving module internal function sub-module schematic diagram in the embodiment of the present application;

[0059] Fig. 3 is a method flow chart of the component implementation system XSS protection in the embodiment of the present application. DETAILED DESCRIPTION

[0060] The preferred embodiments of the present application will be described below in conjunction with the drawings, and it should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and do not limit the present application.

[0061] Embodiment 1

[0062] The present application provides a component implementation system XSS protection system, as shown in Fig. 1, which comprises:

[0063] The request message receiving module is configured to receive a request message sent by a client;

[0064] The thread data enabling judging module is configured to enable thread data and obtain a thread data enabling state when it is determined that the request message needs to be intercepted based on a user-defined Web application interceptor routing control strategy;

[0065] The annotation retrieving and storing module is configured to determine whether a preset filter annotation exists in a class related to the request message, and store the preset filter annotation existing in the class related to the request message into the thread data to obtain final thread data if the preset filter annotation exists;

[0066] The component creating module is configured to generate an XSS protection component based on the thread data enabling state and the final thread data;

[0067] The intercepted data determining module is configured to perform XSS protection processing on the request message based on the XSS protection component to obtain intercepted request thread data;

[0068] The interception protection executing module is configured to delete the intercepted request thread data and return a request result.

[0069] In this embodiment, the client is a communication end that sends a request to the system, and the client can be a malicious attacker using code injection attacks.

[0070] In this embodiment, the Web application interceptor routing control strategy is a user-defined Web application firewall rule;

[0071] A Web application interceptor is a network security tool that can be used to prevent unauthorized requests from entering a Web application. The interceptor is usually deployed on the server side of the Web application and is used to monitor HTTP requests and perform predefined logic, such as rejecting suspicious requests, limiting access from specific IP addresses, or performing other security checks. The interceptor is usually used in conjunction with a routing control strategy to further restrict which requests will be allowed to pass through the Web application;

[0072] A routing control strategy refers to a method of determining which requests will be routed to different parts of a Web application. This can be based on URL parameters, request headers, user identity, or other factors to decide whether to forward the request to a specific handler or page. The routing control strategy can be used in conjunction with an interceptor to ensure that only legitimate and secure requests can reach different parts of the Web application;

[0073] Some common Web application interceptor routing control strategies include:

[0074] URL path matching: only allow specific types of requests to pass, such as restricted users, date ranges, or types;

[0075] Request header matching: only allow certain types of requests to pass, such as restricted User-Agent headers, Referer headers, or Content-Type;

[0076] User authentication: requires users to log in and provide a verification code to prevent unauthorized requests;

[0077] Session tracking: record each request and forward the request to the appropriate handler or page;

[0078] IP blocking: block requests from specific IP addresses based on blacklists or whitelists;

[0079] Use with other filters, such as filtering requests based on request timestamps or sizes.

[0080] In this embodiment, in the XSS (Cross Site Scripting) attack, the so-called "thread data" refers to the session identifier obtained by the hacker through the XSS vulnerability, which is usually the user's cookie ID, session ID or other forms of user identity information. These session identifiers allow hackers to obtain the user's sensitive operations and data on the server side.

[0081] Attackers inject malicious script code into websites, allowing websites to obtain user session data and thus obtain user data such as form submission data. Therefore, when defending against XSS attacks, it is very important to protect the security of these session data.

[0082] In this embodiment, the XSS protection component is used to perform XSS protection processing on the request message, and the intercepted request thread data is obtained by using the configured XSS protection component to review the request message, and the thread data corresponding to the intercepted request data is obtained.

[0083] In this embodiment, the request result is a prompt to the client that the corresponding request message has been intercepted.

[0084] In this embodiment, the component is a pure backend component implemented based on Java language and Spring technology stack, and based on the component, Java Web applications can quickly implement XSS processing on the string type request parameters in url and body (Json and Form). The main content of the component is divided into two parts: basic components and Spring Boot Stater:

[0085] Basic components, based on the general capabilities of Spring components;

[0086] 1. Mode configuration, applicable to Url and Body parameter passing scenarios, support configuration translation, verification and cleaning mode. With code parameter passing <script>alert("XSS-code")；< / script> " as an example, the code will be processed as " < ; script> ; alert ( " ; XSS-code " ; ) ; < ; / script> ; " in escape mode, which parameter format does not support direct execution in the browser, thus preventing XSS attacks; In the verification mode, the code parameter will be cleared, and the code value is null; In the verification mode, it will check whether the parameter is an executable script. If it is, an exception will be thrown;

[0087] 2. Route control, configurable interception route, pass route. Configure the following parameters in the project configuration file:

[0088] baa.application-security.XSS.path-pattern: / ** #intercepted route

[0089] baa.application-security.XSS.path-exclude-pattern: #pass route, default is empty

[0090] The process of route configuration needs to be supplemented;

[0091] 3. Personalized configuration, configurable whether to remove the leading and trailing spaces of the text, whether to keep the line breaks;

[0092] 4. Custom cleaning XSS extension, if the built-in XSS cleaning rules do not meet the needs, you can implement XSSCleaner yourself, and register it as a Spring bean;

[0093] 5, class / method ignore annotation, this annotation is a supplement to route control, developers can achieve class, method, field level ignore control through class / method level ignore annotation and annotation passing;

[0094] 6, class / method processing annotation, through this annotation, developers can achieve global configuration parameter local customization through class / method level custom annotation and annotation passing, to achieve class, method, field level customization control;

[0095] Spring Boot Stater is based on basic components, providing out-of-the-box capabilities in the Spring boot environment, avoiding the cumbersome configuration of business system users, and achieving import and use.

[0096] The beneficial effects of the above technology are: the interceptor-based XSS processing strategy supports custom configuration at the class / method / field level; preset filter annotations are provided to facilitate developers to implement code-level control, such as field-level ignore, field-level XSS custom configuration, etc.; an extension mode for custom XSS processing is provided, and developers can implement XSS processing strategies according to specific business scenarios. When the received parameters are multi-level nested objects, field-level control is supported through annotation parameter passing, such as the Person object multi-level nested student and course objects. Through the method-level annotation and parameter passing @XSSIgnore(value={"sex","student.course.teacher"}), sex, student.course.teacher fine-grained control can be achieved. The tag library function is implemented, and developers can customize certain specific tags that need to be released or processed, supporting rich text application scenarios.

[0097] Embodiment 2

[0098] On the basis of embodiment 1, the request message receiving module, referring to FIG. 2, comprises:

[0099] The first receiving submodule is configured to receive a request message in HTTP protocol sent from a client;

[0100] The second receiving submodule is configured to receive a request message in HTTPS protocol sent from a client.

[0101] In this embodiment, HTTP and HTTPS are two common network request protocols used for communication between a client and a server. Among them, HTTP (Hypertext Transfer Protocol) mainly focuses on the acquisition of resources (such as HTML documents, images, scripts, etc.), and HTTPS adds a security layer to HTTP, which can encrypt and authenticate data to ensure the confidentiality, integrity and reliability of data in the communication process.

[0102] The beneficial effects of the above technology are: the request message receiving module can receive the request message sent by using two network request protocols.

[0103] Embodiment 3

[0104] On the basis of embodiment 1, the thread data enabling judgment module comprises:

[0105] The interception judgment submodule is configured to judge whether the request message needs to be intercepted based on the user-defined Web application interceptor routing control strategy and the behavior analysis judgment result of the request message, and obtain an interception judgment result;

[0106] The first determining sub-module is configured to enable the thread data when the interception determining result is that the request message needs to be intercepted, and use the enabled thread data as the thread data enabled state.

[0107] The second determining sub-module is configured to not enable the thread data when the interception determining result is that the request message does not need to be intercepted, and use the unenabled thread data as the thread data enabled state.

[0108] The above technology has the beneficial effect of further determining whether the request message needs to be intercepted based on the user-defined Web application interceptor routing control strategy and the behavior analysis determining result of the request message, and determining whether the thread data needs to be enabled based on the interception determining result.

[0109] Embodiment 4

[0110] Based on the embodiment 3, the interception determining sub-module comprises:

[0111] The behavior analysis determining unit is configured to perform behavior analysis determination on the request message to obtain a behavior analysis determining result of the request message.

[0112] The need-interception determining unit is configured to determine that the request message needs to be intercepted when the behavior analysis determining result of the request message is that the request message is attackable or the request message hits the Web application interceptor routing control strategy, and use the result as the interception determining result.

[0113] The no-need-interception determining unit is configured to determine that the request message does not need to be intercepted when the behavior analysis determining result of the request message is that the request message is not attackable and the request message does not hit the Web application interceptor routing control strategy, and use the result as the interception determining result.

[0114] In this embodiment, the request message hitting the Web application interceptor routing control strategy means that part of the attributes or data in the request message belongs to the situation that should be intercepted according to the Web application interceptor routing control strategy, and the user identity of the request message belongs to the situation that should be intercepted according to the Web application interceptor routing control strategy.

[0115] The above technology has the beneficial effect of providing an implementation manner of determining whether the request message needs to be intercepted based on the behavior analysis determining result of the request message and the Web application interceptor routing control strategy.

[0116] Embodiment 5

[0117] Based on the embodiment 4, the behavior analysis determining unit comprises:

[0118] The step attack assessment subunit is configured to perform attack assessment on each execution step in the request execution task in the request message, and obtain an attack performance value of each execution step in the request message.

[0119] The attack step preliminary selection subunit is configured to regard an execution step in the request execution task whose attack performance value exceeds an attack performance threshold as a suspected attack behavior step.

[0120] The logic tree building subunit is configured to determine an execution logic tree of the request execution task based on execution logics of all execution steps in the request execution task.

[0121] The comprehensive attack performance assessment subunit is configured to assess a comprehensive attack performance value of the request execution task in the request message based on distribution characteristics and attack performance values of all suspected attack behavior steps in the request execution task in the execution logic tree.

[0122] The first behavior analysis determination subunit is configured to determine that the request message is attack as a behavior analysis determination result of the request message when the comprehensive attack performance value of the request execution task in the request message is not less than the comprehensive attack performance threshold.

[0123] The second behavior analysis determination subunit is configured to determine that the request message is not attack as a behavior analysis determination result of the request message when the comprehensive attack performance value of the request execution task in the request message is less than the comprehensive attack performance threshold.

[0124] In this embodiment, the attack performance value represents a numerical value of the attack possibility of a single execution step (or a numerical value representing the danger degree of a single execution step).

[0125] In this embodiment, the execution step is quantified according to a user-defined quantification level. The smaller the content contained in the execution step, the more accurate the evaluation result of the comprehensive attack performance value of the request execution task in the request message, and vice versa.

[0126] In this embodiment, the attack performance threshold is a threshold that the attack performance value of the suspected attack behavior step needs to exceed.

[0127] In this embodiment, the execution logic includes the execution order of the execution steps and the source of the execution object (i.e., the data applied by the execution step), etc. For example, the execution order of three execution steps is: execution step A, execution step B, and execution step C. Execution step B is a child node of execution step A, and execution step C is a child node of execution step B. For another example, execution steps B and C both use the data output by execution step A. Therefore, execution steps B and C are both child nodes of execution step A. If there is a conflict between the execution order and the source of the execution object in determining the relationship, the execution order is used to determine the final execution logic.

[0128] In this embodiment, the execution logic tree is a tree structure built by using execution logic to execute all execution steps in the request execution task, and represents the dependency or sequence relationship in the execution logic.

[0129] In this embodiment, the request execution task is an execution task requested by the system in the request message, such as downloading a data packet A or accessing a subsystem Q in the system.

[0130] In this embodiment, the distribution feature is mainly the continuous distribution of the suspected attack behavior step in the execution logic tree level.

[0131] In this embodiment, the comprehensive attack performance value is a value representing the size of the attack possibility of the request execution task in the request message.

[0132] In this embodiment, the comprehensive attack performance threshold is a threshold that the comprehensive attack performance value of the request execution task in the request message cannot be less than when the attack possibility of the request message is taken as the behavior analysis result of the request message.

[0133] The beneficial effects of the above technology are: by evaluating the attack of each execution step in the request execution task in the request message, the suspected attack behavior step is filtered out, and the execution logic of all execution steps in the request execution task is further analyzed and represented in a tree structure. Based on the distribution feature of the suspected attack behavior step in the execution logic tree and the corresponding attack performance value, the individual analysis of the comprehensive attack performance of the request execution task in the request message is realized, and the comparison of the comprehensive attack performance threshold and the comprehensive attack performance value provides a more rigorous review mechanism for the possible attack hidden danger in the request message, further reducing the possibility of system attack.

[0134] Embodiment 6

[0135] On the basis of embodiment 5, the step attack evaluation subunit comprises:

[0136] The evaluation model building end is used to obtain a preset step attack evaluation model;

[0137] The step attack evaluation end is used to input each execution step in the request execution task in the request message into the preset step attack evaluation model to obtain the attack performance value of each execution step in the request message.

[0138] In this embodiment, the preset step attack evaluation model is a model obtained by pre-training a large number of execution steps with corresponding attack performance values based on a machine learning algorithm.

[0139] The beneficial effect of the above technology is that the preset step attack assessment model is introduced to accurately assess the attack performance value of each execution step in the request message.

[0140] Embodiment 7

[0141] On the basis of embodiment 5, the comprehensive attack performance assessment subunit includes:

[0142] The tree structure topology screening end is used to determine all suspected attack behavior step topology structures with maximum degree of continuity in all topological orders in the execution logic tree.

[0143] The evaluation weight determination end is used to take the quotient (MAX-MIN) / MAX of the difference (MAX-MIN) between the maximum level number MAX of the execution logic tree and the minimum level tree MIN in each suspected attack behavior step topology structure and the maximum level number MAX of the execution logic tree as the attack assessment weight of each suspected attack behavior step topology structure.

[0144] The sub-comprehensive attack performance determination end is used to take the product w×ALL of the sum ALL of the attack performance values of all suspected attack behavior steps in each suspected attack behavior step topology structure and the corresponding attack assessment weight w as the sub-comprehensive attack performance value of each suspected attack behavior step topology structure.

[0145] The comprehensive attack performance determination end is used to take the sum of the sub-comprehensive attack performance values of all suspected attack behavior step topology structures in the execution logic tree as the comprehensive attack performance value of the request execution task of the request message.

[0146] In this embodiment, the topological order is a one-way extension structure in which the nodes between adjacent levels are in a parent-child relationship, and each level in the topological order has only one node (corresponding to an execution step).

[0147] In this embodiment, the maximum degree of continuity of the level means that the first node (corresponding to an execution step) in each suspected attack behavior step topology structure is not a suspected attack behavior step, nor is the last node (corresponding to an execution step) in the topology order.

[0148] In this embodiment, the suspected attack behavior step topology structure is a structure composed of multiple nodes (corresponding to execution steps) with maximum degree of continuity of the level contained in the topological order.

[0149] In this embodiment, the attack evaluation weight of the suspected attack behavior step represents a sum of attack performance values of all suspected attack behavior steps in the suspected attack behavior step topology, and a proportion of the comprehensive attack performance value of the request execution task of the request message.

[0150] In this embodiment, the sub-comprehensive attack performance value represents a partial value in the comprehensive attack performance value of the request execution task of the request message determined by the single suspected attack behavior step topology.

[0151] The above-mentioned technology has the beneficial effect that a way of calculating the comprehensive attack performance value of the request execution task of the request message by using the distribution characteristics and attack performance values of the suspected attack behavior steps in the execution logic tree is given, the attack evaluation weights of the suspected attack behavior steps in the suspected attack behavior step topology with the maximum degree of continuity in all topological orderings in the execution logic tree are uniformly zoned, the influence of the continuous existence of the suspected attack behavior steps in the request execution task on the comprehensive attack performance value is considered, and the accuracy of the calculated comprehensive attack performance value of the request execution task of the request message is improved.

[0152] Embodiment 8

[0153] On the basis of Embodiment 1, the annotation retrieval and storage module comprises:

[0154] The class patrol submodule is used to determine whether the @XSS annotation or / and the @XSSIgnore annotation in the preset filter annotation exists in the class involved in the request message, and if so, the thread local variable object in the ThreadLocal type of the sub-class is called in the thread data pool.

[0155] The gradual storage submodule is used to store the @XSS annotation or / and the @XSSIgnore annotation existing in the class involved in the request message into the current thread data in the key-value pair mapping set of the thread local variable object of the ThreadLocal type, and obtain the final thread data.

[0156] In this embodiment, in the field of Web security, the two annotations of @XSS and @XSSIgnore are both related to the prevention of XSS (Cross-Site Scripting) attacks. They are both part of the security filter class for configuring request parameters in the Spring Security framework.

[0157] 1. XSS: This annotation is used to prohibit the submission of fields containing XSS attack code. When you enable the @XSS annotation on forms or other input controls, these input controls will be automatically cleaned to remove any invalid input that may trigger an XSS attack. In this way, the server side will not execute these malicious inputs when rendering the page, thereby reducing the risk of XSS vulnerabilities;

[0158] 2. XSSIgnore: Similar to @XSS, the @XSSIgnore annotation also prevents XSS attacks. However, unlike @XSS, the @XSSIgnore annotation ignores certain types of XSS attacks and allows them to pass through. When you use the @XSSIgnore annotation in your project, the security filter will not be triggered to block even if there is an XSS attack in the specified locations. You need to decide whether to enable XSS attack ignore for these locations based on the specific scenario;

[0159] In summary, both annotations are effective means to prevent XSS attacks and can help you reduce the risk of web application attacks during development; Both annotations are used in the Spring Security framework to prevent Cross-Site Scripting (XSS) attacks, and their common goal is to process input content in form input controls and other cases to avoid malicious scripts running in the user's browser, causing security risks.

[0160] In this embodiment, the type of thread data pool is ThreadLocal<Map<String, Object>> and the key of Map<String, Object> is the current thread, and the value is used to store annotations and annotation parameters.

[0161] The beneficial effects of the above technology are: two detailed annotation forms of preset filter annotations are specified.

[0162] Embodiment 9

[0163] On the basis of embodiment 1, the component creation module includes:

[0164] The first creation submodule is used to create a method-level XSSConfig object based on the preset filter annotations stored in the thread data when the thread data is enabled based on the thread data during parameter formatting or deserialization, and generate an XSS protection component based on the method-level XSSConfig object;

[0165] The second creation sub-module is configured to generate the XSS protection component based on the global XSS configuration of the Java Web by default when the thread data is not enabled according to the state determination based on the thread data during the parameter formatting or deserialization.

[0166] In this embodiment, the method-level XSSConfig object is created based on the preset filter annotation stored in the thread data, and the XSS protection component is generated based on the method-level XSSConfig object, including:

[0167] Based on the preset filter annotation stored in the thread data, the method-level XSSConfig object is created, and then the specific implementation steps of generating the specific XSS protection component according to the method-level XSSConfig object are as follows:

[0168] 1. First, read the configuration file to obtain the preset filter annotation. These annotations may be included in the configuration class of the application program, or may be included in a separate XML or JSON file;

[0169] 2. Create an XSSConfig object according to the preset filter annotation. This object contains all the preset filtering rules, including the URL pattern to be intercepted, the request header, etc.;

[0170] 3. For each request, traverse the rule array of the XSSConfig object. For each rule, determine whether the request URI matches the rule. If so, perform the corresponding operation. This includes some common operations, such as modifying the request header, adding XSS protection filtering, etc.;

[0171] 4. If the request matches a rule, but the rule does not require any operation to be performed, the request is forwarded directly;

[0172] 5. If the request matches a rule and the rule requires some operations to be performed, such as encoding the request body, etc., perform these operations. This usually requires processing the request body, such as HTML entity, to prevent malicious code from being injected into the server side;

[0173] 6. After all rules are processed, if no rule is matched, it means that this is a request that does not contain XSS vulnerabilities, and it is directly forwarded to the backend for processing;

[0174] 7. Finally, the request is forwarded to the backend, thus completing the entire process.

[0175] In this embodiment, an XSS protection component is generated based on the default global XSS configuration of Java Web, for example, based on the Java Web platform, regular expressions are used to filter and protect the input parameters from XSS (i.e., generate an XSS protection component), and the specific implementation steps are as follows:

[0176] 1. Create a class named XSSFilter that extends the AbstractFilterBean class. In the constructor method of the class, use the init method to define the character set that needs to be filtered, and set the default attribute value;

[0177] 2. In the web.xml file, register XSSFilter and specify the name and order of the filter;

[0178] 3. When a request arrives, first check whether it is an XSS request, if not, use the default filter to process it. If it is an XSS request, use the custom XSSFilter to process the request;

[0179] 4. Implement the isXSSRequest method to determine whether the request header contains a specific XSS attack indicator, such as X-Doctor-Test or X-Attack-Target. If it contains, it means that the request may have XSS attack risk, and the custom XSSFilter needs to be called for filtering processing;

[0180] 5. In order to prevent reflection attacks, the X-XSS-Check field can be added to the request header, and the value of this field is a 128-bit MD5 encrypted random number. After receiving the request, the server will verify whether this field is equal to 128;

[0181] Through the above steps, a simple XSS protection component can be implemented to protect the application program on the Java Web platform from XSS attacks.

[0182] The beneficial effects of the above technology are: the XSS protection component generation method for two cases (determining that thread data is enabled based on thread data enablement state and determining that thread data is not enabled based on thread data enablement state) is given.

[0183] Embodiment 10

[0184] The present application provides a kind of component implementation system XSS protection method, it is applied to the system of any one of the component implementation system XSS protection of the described in embodiment 1 to 9, reference Figure 3, including:

[0185] S1: receiving the request message from the client;

[0186] S2: when determining that the request message needs to be intercepted based on the user-defined Web application interceptor routing control strategy, thread data is enabled, and a thread data enabling state is obtained;

[0187] S3: it is determined whether there is a preset filter annotation in the class involved in the request message, if yes, the preset filter annotation existing in the class involved in the request message is stored in the thread data, and final thread data is obtained;

[0188] S4: generating an XSS protection component based on the thread data enabling state and the final thread data;

[0189] S5: performing XSS protection processing on the request message based on the XSS protection component, and obtaining intercepted request thread data;

[0190] S6: deleting the intercepted request thread data, and returning a request result.

[0191] The beneficial effects of the above technology are: the XSS processing strategy based on the interceptor supports class / method / field level custom configuration; the preset filter annotation is provided, which facilitates the developer to realize code level control, such as field level ignoring, field level XSS custom configuration, etc.; the extension mode of custom XSS processing is provided, and the developer can realize the XSS processing strategy according to the specific business scenario. When the received parameter is a multi-level nested object, the field level control is supported through the annotation parameter, such as the multi-level nested student and course objects of the Person object, through the method level annotation and the parameter @XSSIgnore(value={"sex","student.course.teacher"}), the sex, student.course.teacher fine-grained control can be realized. The tag library function is realized, the developer can customize a certain specific tag that needs to be released or processed, and the application scenario of rich text is supported.

[0192] Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application belong to the scope of the claims of the present application and their equivalent technologies, the present application also intends to include these modifications and variations.

Claims

1. A system for modularly implementing system Xss protection, characterized in that, Comprise: Thread data enablement judgment module, for when based on user-defined Web application interceptor route control strategy and request message behavior analysis judgment result, determine the need to intercept the request message, then enable thread data, obtain thread data enablement state; Annotation retrieval and storage module, for determining whether the class involved in the request message exists a preset filter annotation, if so, the preset filter annotation existing in the class involved in the request message is stored in the thread data, and the final thread data is obtained; Component creation module, for generating XSS protection component based on thread data enablement state and final thread data; Wherein, the behavior analysis judgment unit in the thread data enablement judgment module, comprising: Step attack evaluation subunit, for evaluating the attack performance value of each execution step in the request execution task in the request message; Attack step preliminary selection subunit, for taking the execution step with attack performance value exceeding the attack performance threshold in the request execution task as a suspected attack behavior step; Logical tree building subunit, for determining the execution logic tree of the request execution task based on the execution logic of all execution steps in the request execution task; Comprehensive attack performance evaluation subunit, for evaluating the comprehensive attack performance value of the request execution task of the request message based on the distribution characteristics and attack performance value of all suspected attack behavior steps in the request execution task in the execution logic tree; Behavior analysis determination subunit, for obtaining the behavior analysis judgment result of the request message based on the comprehensive attack performance value of the request execution task of the request message; Wherein, the annotation retrieval and storage module comprises: Class inspection sub-module, for determining whether the class involved in the request message exists @XSS annotation or / and @XSSIgnore annotation in the preset filter annotation, if so, the thread local variable object in the ThreadLocal type subclass is called in the thread data pool; Gradual storage submodule, for storing the @XSS annotation or / and @XSSIgnore annotation existing in the class involved in the request message into the current thread data in the key-value pair mapping set of the ThreadLocal type thread local variable object, and obtaining the final thread data; Wherein, the component creation module comprises: First creation submodule, for creating method-level XSSConfig object based on the preset filter annotation stored in the thread data when the thread data is enabled based on the thread data enablement state during parameter formatting or deserialization, and generating XSS protection component based on the method-level XSSConfig object; Second creation submodule, for generating XSS protection component based on the default global XSS configuration of Java Web when the thread data is not enabled based on the thread data enablement state during parameter formatting or deserialization.

2. The system for assembling a system XSS protection according to claim 1, characterized in that, Further comprising: Request message receiving module, comprising: First receiving submodule, for receiving the request message of HTTP protocol from the client; The second receiving sub-module is configured to receive a request message in an HTTPS protocol sent by the client.

3. The system for assembling a system XSS defense in accordance with claim 1, wherein, The thread data enabling judgment module comprises: The interception judgment sub-module is configured to perform behavior analysis on the request message based on the user-defined Web application interceptor routing control strategy and the request message The behavior analysis judgment result is used to determine whether the request message needs to be intercepted, and an interception judgment result is obtained; The first determination sub-module is configured to enable the thread data when the interception judgment result is that the request message needs to be intercepted, and the enabled thread data is used as the thread data enabling state; The second determination sub-module is configured to not enable the thread data when the interception judgment result is that the request message does not need to be intercepted, and the unenabled thread data is used as the thread data enabling state.

4. The system for assembling a system XSS protection according to claim 3, characterized in that, The interception judgment sub-module comprises: The behavior analysis judgment unit is configured to perform behavior analysis judgment on the request file, and obtain a behavior analysis judgment result of the request message; The need-interception determination unit is configured to determine that the request message needs to be intercepted when the behavior analysis judgment result of the request message is that the request message is attackable or the request message hits the Web application interceptor routing control strategy, and the interception judgment result is obtained; The no-need-interception determination unit is configured to determine that the request message does not need to be intercepted when the behavior analysis judgment result of the request message is that the request message is not attackable and the request message does not hit the Web application interceptor routing control strategy, and the interception judgment result is obtained.

5. The system for assembling a system XSS defense in accordance with claim 1, wherein, The behavior analysis determination subunit comprises: The first behavior analysis determination subunit is configured to determine that the request message is attackable when a comprehensive attack performance value of the request execution task of the request message is not less than a comprehensive attack performance threshold value, and the behavior analysis judgment result of the request message is obtained; The second behavior analysis determination subunit is configured to determine that the request message is not attackable when the comprehensive attack performance value of the request execution task of the request message is less than the comprehensive attack performance threshold value, and the behavior analysis judgment result of the request message is obtained.

6. The system for assembling a system XSS defense in accordance with claim 1, wherein, The step attack assessment subunit comprises: The evaluation model building end is configured to obtain a preset step attack assessment model; The step attack assessment end is configured to input each execution step in the request execution task in the request message into the preset step attack assessment model, and obtain an attack performance value of each execution step in the request message.

7. The system for assembling a system XSS defense in accordance with claim 1, wherein, The comprehensive attack performance assessment subunit comprises: The tree structure topology screening end is configured to determine all suspected attack behavior step topology structures with the maximum degree of continuity in all topological orderings in the execution logic tree; The evaluation weight determination end is configured to take the quotient of the difference between the maximum level number of the execution logic tree and the minimum level tree in each suspected attack behavior step topology structure and the maximum level number of the execution logic tree as the attack assessment weight of each suspected attack behavior step topology structure; The sub-comprehensive attack performance determination end is configured to take the product of the sum of the attack performance values of all suspected attack behavior steps in each suspected attack behavior step topology structure and the corresponding attack assessment weight as the sub-comprehensive attack performance value of each suspected attack behavior step topology structure; The comprehensive attack performance determination end is configured to sum all sub-comprehensive attack performance values of all suspected attack behavior step topologies in the execution logic tree, and take the sum as a comprehensive attack performance value of the request execution task of the request message.

8. A method of modularly implementing system Xss protection, characterized in that, The application is applied to the system for realizing XSS protection by componentization according to any one of claims 1 to 7, and comprises: S1: receiving a request message sent from a client; S2: when it is determined that the request message needs to be intercepted based on user-defined web application interceptor routing control strategy and behavior analysis judgment result of the request message, thread data is enabled, and a thread data enabling state is obtained; S3: it is determined whether there is a preset filter annotation in a class related to the request message, if yes, the preset filter annotation existing in the class related to the request message is stored into the thread data, and final thread data is obtained; S4: an XSS protection component is generated based on the thread data enabling state and the final thread data; S5: the request message is subjected to XSS protection processing based on the XSS protection component, and intercepted request thread data is obtained; S6: the intercepted request thread data is deleted, and a request result is returned.

Images