Web 安全实战

// ❌ 危险：字符串拼接$sql = "SELECT * FROM users WHERE username = '" . $_GET['name'] . "'";// 输入 ' OR '1'='1  →  SELECT * FROM users WHERE username = '' OR '1'='1'// 输入 '; DROP TABLE users; --  →  直接删表

// ✅ PDO 预处理$stmt = $pdo->prepare('SELECT * FROM users WHERE username = ?');$stmt->execute([$name]);

// ✅ JDBC PreparedStatementString sql = "SELECT * FROM users WHERE username = ?";try (PreparedStatement ps = conn.prepareStatement(sql)) {    ps.setString(1, name);    ResultSet rs = ps.executeQuery();}

// ✅ mysql2 占位符const [rows] = await pool.query('SELECT * FROM users WHERE username = ?', [name]);

// ✅ ORM（TypeORM / Prisma / Sequelize）自动参数化await userRepo.findOne({ where: { username: name } });

const ALLOWED_SORT = ['created_at', 'price', 'sales']const sort = ALLOWED_SORT.includes(req.query.sort) ? req.query.sort : 'created_at'const order = req.query.order === 'asc' ? 'ASC' : 'DESC'const sql = `SELECT * FROM products ORDER BY ${sort} ${order} LIMIT ?`

// ❌ 危险：shell 拼接const { exec } = require('child_process')exec(`convert ${userFile} -resize 800x800 out.png`)// 输入 "a.jpg; rm -rf /"  →  灾难

// ✅ execFile / spawn：不经过 shellconst { execFile } = require('child_process')execFile('convert', [userFile, '-resize', '800x800', 'out.png'])

// ✅ 每个参数单独转义$cmd = 'convert ' . escapeshellarg($file) . ' -resize 800x800 out.png';

// ✅ HTML 文本上下文function escapeHtml(s) {  return String(s)    .replace(/&/g, '&amp;')    .replace(/</g, '&lt;')    .replace(/>/g, '&gt;')    .replace(/"/g, '&quot;')    .replace(/'/g, '&#039;')}

<!-- ❌ 属性上下文用 HTML 转义不够 --><a href="javascript:alert(1)">链接</a><!-- ✅ URL 参数要先做协议白名单 + URL 编码 -->

// ❌ 危险el.innerHTML = userContentdocument.write(userContent)eval(userContent)// ✅ 安全el.textContent = userContentel.setAttribute('data-x', userContent)

// 引入 DOMPurify，只允许安全标签import DOMPurify from 'dompurify'el.innerHTML = DOMPurify.sanitize(html, {  ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'ul', 'ol', 'li', 'a', 'code', 'pre', 'img'],  ALLOWED_ATTR: ['href', 'src', 'alt'],})

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; object-src 'none'; base-uri 'self';";

Set-Cookie: session=xxx; HttpOnly; Secure; SameSite=Lax; Path=/

// ✅ bcryptconst bcrypt = require('bcrypt')const hash = await bcrypt.hash(password, 12)          // 存储const ok = await bcrypt.compare(inputPwd, hash)       // 校验

// ✅ PHP 内置$hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);if (password_verify($inputPwd, $hash)) { /* 通过 */ }

// ✅ Spring Security BCryptPasswordEncoderString hash = encoder.encode(password);boolean ok = encoder.matches(inputPwd, hash);

// ❌ 常见错误：把敏感信息塞进 payload{ "userId": 1, "phone": "13800000000", "idCard": "..." }   // 全部明文可见// ✅ 只放必要标识{ "sub": "user_1024", "role": "member", "exp": 1735689600 }

// ✅ 签发与校验（显式指定算法）const token = jwt.sign({ sub: user.id, role: user.role }, SECRET, {  algorithm: 'HS256',  expiresIn: '30m',})const payload = jwt.verify(token, SECRET, { algorithms: ['HS256'] })

// ✅ 关键配置app.use(session({  key: 'sid',  secret: process.env.SESSION_SECRET,   // 不硬编码  httpOnly: true,  secure: true,                          // 仅 HTTPS  sameSite: 'lax',  maxAge: 7 * 24 * 3600 * 1000,}))

req.session.regenerate((err) => {  req.session.userId = user.id   // 在再生成之后写入})

// ❌ 只验登录，不验归属router.get('/orders/:id', auth, async (ctx) => {  ctx.body = await orderRepo.findById(ctx.params.id)   // 谁都能查任何订单})// ✅ 查询时带上归属条件router.get('/orders/:id', auth, async (ctx) => {  const order = await orderRepo.findOne({    where: { id: ctx.params.id, userId: ctx.state.user.id },   // 关键  })  if (!order) ctx.throw(404, '订单不存在')   // 不暴露「存在但无权」的信息  ctx.body = order})

// 1. SameSite Cookie（首选，现代浏览器默认）res.cookie('sid', value, { sameSite: 'lax', httpOnly: true, secure: true })// 2. CSRF Token（对状态变更操作）// 服务端下发 token → 前端放请求头 → 服务端比对// 3. 校验 Origin / Refererconst origin = ctx.get('Origin')if (origin && !ALLOWED_ORIGINS.includes(origin)) ctx.throw(403)

// ❌ 危险：反射任意 Origin + 允许携带凭证app.use(cors({ origin: (o, cb) => cb(null, true), credentials: true }))// 等于任何网站都能带着用户 Cookie 读你的接口// ✅ 白名单const ALLOWED = ['https://app.example.com', 'https://admin.example.com']app.use(cors({  origin: (o, cb) => cb(null, ALLOWED.includes(o)),  credentials: true,  methods: ['GET', 'POST', 'PUT', 'DELETE'],}))

// 1. 扩展名白名单（不是黑名单）const ALLOWED_EXT = ['.jpg', '.jpeg', '.png', '.gif', '.webp']// 2. MIME 类型// 3. 文件头魔数（最关键，扩展名可伪造）const MAGIC = [  { sig: Buffer.from([0x89, 0x50, 0x4e, 0x47]), ext: '.png' },  { sig: Buffer.from([0xff, 0xd8, 0xff]), ext: '.jpg' },]// 4. 大小限制 + 重命名存储（不用用户原始文件名）const filename = `${Date.now()}_${crypto.randomUUID()}${ext}`

# Nginx：上传目录禁止执行 PHPlocation ^~ /uploads/ {    location ~ \.(php|php5|phtml)$ { deny all; }}

// ❌ 危险：用户可控 URLconst data = await fetch(req.query.imageUrl)// 攻击者传 http://169.254.169.254/latest/meta-data/  → 读取云主机元数据// 或 http://127.0.0.1:6379/  → 探测内网服务

-- ✅ 用条件更新保证幂等与状态机正确UPDATE coupons SET status = 1, used_at = NOW()WHERE id = ? AND user_id = ? AND status = 0;-- 影响行数为 0 说明已被使用，直接拒绝

// ❌ 危险：提交进 Git 后无法收回const SECRET = 'my-secret-key-123'// ✅ 环境变量const SECRET = process.env.JWT_SECRETif (!SECRET) throw new Error('缺少 JWT_SECRET')

# php.inidisplay_errors = Offlog_errors = Onexpose_php = Off

// Nodeif (process.env.NODE_ENV === 'production') {  app.on('error', (err) => logger.error(err))   // 不把堆栈返回给客户端}

// ❌ 把数据库错误原样返回ctx.body = { error: err.message }   // 泄露表名、SQL 结构// ✅ 统一友好提示 + 内部记录logger.error({ err, requestId: ctx.state.requestId })ctx.body = { code: 500, message: '服务异常，请稍后重试', requestId: ctx.state.requestId }

# 常见敏感路径防护location ~ /\.(git|env|svn) { deny all; }location ~* \.(sql|bak|log|ini)$ { deny all; }

ssl_protocols TLSv1.2 TLSv1.3;ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# 检查已知漏洞npm auditnpm audit fixcomposer audit          # PHPmvn dependency-check    # Java（OWASP Dependency-Check）

// ✅ 脱敏后再记logger.info({  event: 'login',  userId: user.id,  phone: maskPhone(phone),    // 138****0000  ip: ctx.ip,  requestId: ctx.state.requestId,})