通过HttpModule、httpHandlers防止SQL注入式攻击

博客园 - 飛雪飄寒

【共享】十步优化SQL Server中的数据访问【推荐】SQL优化-索引【推荐】SQL CookBook OLAP函数的使用 .net导出excel文件操作类续【分享】Tomcat服务器之安全设置【分享】.net1.1调用webservice返回二维数组时提示“XML 文档(1, 378)中有错误”的解决方法! .net页面之间传值方式小结 - 飛雪飄寒 - 博客园在SQLServer中实现ORACLE的Sequence 【共享】将程序制作为服务运行的方法！【推荐】.NET使用NPOI组件将数据导出Excel 【推荐】Quest.Central.For.Databases——Spotlight的使用【推荐】[SQL优化工具]Quest.Central.For.Databases——SQL Tuning for SQL Server 【共享】解决“无法显示进程。没有正确安装调试器。请运行安装程序安装或修复调试器。”错误的方法。【求助】使用SQL语句优化工具遇到的问题【求助】软考报名即将开始，信息系统项目管理师、系统分析师、系统架构设计师——如何选择？【探讨】索引视图如何提高性能 .net实现将Excel中的数据导入数据库【学习】NeatUpload——支持大文件上传的控件

飛雪飄寒 · 2011-07-26 · via 博客园 - 飛雪飄寒

1、通过HttpModule防止SQL注入式攻击，适用于.net1.1程序
（1）新建类文件SqlHttpModule.cs，具体代码类似如下：

SqlHttpModule.cs

using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.HtmlControls;
using System.Text.RegularExpressions;namespace HttpModule.Class
{
 /// <summary>
 /// SqlInPost 的摘要说明
 /// </summary>
 public class SqlHttpModule : System.Web.IHttpModule
 {
 public SqlHttpModule()
 {
 }public void Dispose()
 {
 }public void Init(HttpApplication context)
 {
 context.AcquireRequestState += new EventHandler(context_AcquireRequestState);
 }private void context_AcquireRequestState(object sender, EventArgs e)
 {
 HttpContext context = ((HttpApplication)sender).Context;
 try
 {
 string getkeys = string.Empty;
 string keyvalue = string.Empty;
 string strErrorAlertScript = "<script type=\"text/javascript\">alert('字符串格式非法，请重新输入！');history.go(-1);</script>";
 string requestUrl = context.Request.Path.ToString();
 #region URL提交数据
 if (context.Request.QueryString != null)
 {
 for (int i = 0; i < context.Request.QueryString.Count; i++)
 {
 getkeys = context.Request.QueryString.Keys[i];
 keyvalue = context.Server.UrlDecode(context.Request.QueryString[getkeys]).Replace("'", "");if (!IsSafeString(keyvalue))
 {
 context.Response.Write(strErrorAlertScript);
 context.Response.End();
 break;
 }
 }
 }
 #endregion#region 表单提交数据
 if (context.Request.Form != null)
 {
 for (int i = 0; i < context.Request.Form.Count; i++)
 {
 getkeys = context.Request.Form.Keys[i].ToUpper();
 if (getkeys == "__VIEWSTATE" || getkeys == "__EVENTARGUMENT" || getkeys == "__EVENTTARGET" || getkeys == "__CLIENTPOSTDATA__") continue;

keyvalue

= context.Server.HtmlDecode(context.Request.Form[i]).Replace("'", "");
 if (!IsSafeString(keyvalue))
 {
 context.Response.Write(strErrorAlertScript);
 context.Response.End();
 break;
 }
 }
 }
 #endregion
 }
 catch (Exception ex)
 {
 }
 }//判断是否为安全字符串
 public bool IsSafeString(string strText)
 {
 bool bResult = true;
 //strText = Regex.Replace(strText, "[\\s]{1,}", ""); //two or more spaces
 strText = Regex.Replace(strText, "(<[b|B][r|R]/*>)+|(<[p|P](.|\\n)*?>)", "\n"); // 
string FilterSql = System.Configuration.ConfigurationSettings.AppSettings["SqlHttpModule_KeyWord"];//将关键词组配置在webconfig中
 if(FilterSql==null || FilterSql=="")
 {
 string[] UnSafeArray = new string[23];
 UnSafeArray[0] = "'";
 UnSafeArray[1] = "xp_cmdshell ";
 UnSafeArray[2] = "declare";
 UnSafeArray[3] = "netlocalgroupadministrators ";
 UnSafeArray[4] = "delete ";
 UnSafeArray[5] = "truncate ";
 UnSafeArray[6] = "netuser ";
 UnSafeArray[7] = "/add ";
 UnSafeArray[8] = "drop ";
 UnSafeArray[9] = "update ";
 UnSafeArray[10] = "select ";
 UnSafeArray[11] = "union ";
 UnSafeArray[12] = "exec ";
 UnSafeArray[13] = "create ";
 UnSafeArray[14] = "insertinto ";
 UnSafeArray[15] = "sp_ ";
 UnSafeArray[16] = "exec ";
 UnSafeArray[17] = "create ";
 UnSafeArray[18] = "insert ";
 UnSafeArray[19] = "masterdbo ";
 UnSafeArray[20] = "sp_ ";
 UnSafeArray[21] = ";-- ";
 UnSafeArray[22] = "1= ";
 foreach (string strValue in UnSafeArray)
 {

 if (strText.ToLower().IndexOf(strValue) > -1)
 {
 bResult = false;
 break;
 }
 }
 }
 else
 {
 string sqlStr = FilterSql;
 string[] sqlStrs = sqlStr.Split('|');
 foreach (string ss in sqlStrs)
 {
 if (strText.ToLower().IndexOf(ss) >= 0)
 {
 bResult = false;
 break;
 }
 }
 }
 return bResult;
 }

}
}

（2）在web.config文件中做以下配置
 </system.web>
 <httpModules>
 <add name="SqlHttpModule" type="HttpModule.Class.SqlHttpModule, HttpModule" />
 </httpModules>
 </system.web>

2、通过httpHandlers防止SQL注入式攻击，适用于.net2.0及以上程序
（1）新建类文件SqlhttpHandlers.cs，具体代码类似如下：

SqlhttpHandlers.cs

using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
using System.Text.RegularExpressions;
using System.Collections.Specialized;
namespace httpHandlers
{
 /// <summary>
 /// SqlInPost 的摘要说明
 /// </summary>
 public class SqlhttpHandlers : IHttpHandlerFactory
 {
 public SqlhttpHandlers()
 {
 //
 // TODO: 在此处添加构造函数逻辑
 //
 }public virtual IHttpHandler GetHandler(HttpContext context, string requestType, string url, string pathTranslated)
 {
 //得到编译实例(通过反射)
 PageHandlerFactory factory = (PageHandlerFactory)Activator.CreateInstance(typeof(PageHandlerFactory), true);
 IHttpHandler handler = factory.GetHandler(context, requestType, url, pathTranslated);
 //过滤字符串
 if (requestType == "POST")
 {
 Page page = handler as Page;
 if (page != null)
 page.PreLoad += new EventHandler(FormFilterStrFactoryHandler_PreLoad);
 }
 if (requestType == "GET")
 {
 Page page = handler as Page;
 if (page != null)
 page.PreLoad += new EventHandler(RequestFilterStrFactoryRHandler_PreLoad);
 }
 //返回
 return handler;
 }public virtual void ReleaseHandler(IHttpHandler handler)
 {

}

/// <summary>
 /// 过滤TextBox、Input和Textarea中非法字符
 /// </summary>
 /// <param name="sender"></param>
 /// <param name="e"></param>
 void FormFilterStrFactoryHandler_PreLoad(object sender, EventArgs e)
 {
 try
 {
 bool isSafe = true;
 Page page = sender as Page;
 NameValueCollection postData = page.Request.Form;
 foreach (string postKey in postData)
 {
 Control ctl = page.FindControl(postKey);
 if (ctl as TextBox != null)
 {
 ((TextBox)ctl).Text = ((TextBox)ctl).Text.Replace("'", "＇");
 string strValue = ((TextBox)ctl).Text.Trim();
 if (!IsSafeString(strValue))
 {
 isSafe = false;
 break;
 }

 continue;
 }
 if (ctl as HtmlInputControl != null)
 {

 ((HtmlInputControl)ctl).Value = ((HtmlInputControl)ctl).Value.Replace("'", "＇");
 string strValue = ((HtmlInputControl)ctl).Value.Trim();
 if (!IsSafeString(strValue))
 {
 isSafe = false;
 break;
 }
 continue;
 }
 if (ctl as HtmlTextArea != null)
 {
 ((HtmlTextArea)ctl).Value = ((HtmlTextArea)ctl).Value.Replace("'", "＇");
 string strValue = ((HtmlTextArea)ctl).Value.Trim();
 if (!IsSafeString(strValue))
 {
 isSafe = false;
 break;
 }
 continue;
 }
 }
 if (!isSafe)
 {
 page.Response.Write("字符串格式非法!");
 page.Response.End();
 }
 }
 catch(Exception ex)
 {
 string a = ex.Message;
 }
 }/// <summary>
 /// 过滤QueryString 中的非法字符串
 /// </summary>
 /// <param name="sender"></param>
 /// <param name="e"></param>
 protected void RequestFilterStrFactoryRHandler_PreLoad(object sender, EventArgs e)
 {
 try
 {
 Page page = sender as Page;
 NameValueCollection QueryNV = page.Request.QueryString;
 bool isSafe = true;
 for (int i = 0; i < QueryNV.Count; i++)
 {
 if (!IsSafeString(QueryNV.Get(i)))
 {
 isSafe = false;
 break;
 }
 }
 if (!isSafe)
 {
 page.Response.Write("字符串格式非法!");
 page.Response.End();
 }
 }
 catch { }
 }//判断是否为安全字符串
 public bool IsSafeString(string strText)
 {
 bool bResult = true;
 strText = Regex.Replace(strText, "[\\s]{1,}", ""); //two or more spaces
 strText = Regex.Replace(strText, "(<[b|B][r|R]/*>)+|(<[p|P](.|\\n)*?>)", "\n"); // 

 string[] UnSafeArray = new string[23];
 UnSafeArray[0] = "'";
 UnSafeArray[1] = "xp_cmdshell";
 UnSafeArray[2] = "declare";
 UnSafeArray[3] = "netlocalgroupadministrators";
 UnSafeArray[4] = "delete";
 UnSafeArray[5] = "truncate";
 UnSafeArray[6] = "netuser";
 UnSafeArray[7] = "/add";
 UnSafeArray[8] = "drop";
 UnSafeArray[9] = "update";
 UnSafeArray[10] = "select";
 UnSafeArray[11] = "union";
 UnSafeArray[12] = "exec";
 UnSafeArray[13] = "create";
 UnSafeArray[14] = "insertinto";
 UnSafeArray[15] = "sp_";
 UnSafeArray[16] = "exec";
 UnSafeArray[17] = "create";
 UnSafeArray[18] = "insertinto";
 UnSafeArray[19] = "masterdbo";
 UnSafeArray[20] = "sp_";
 UnSafeArray[21] = ";--";
 UnSafeArray[22] = "1=";
 foreach (string strValue in UnSafeArray)
 {

 if (strText.ToLower().IndexOf(strValue) > -1)
 {
 bResult = false;
 break;
 }
 }
 return bResult;
 }

}
}

（2）在web.config文件中做以下配置
 </system.web>
 <httpHandlers>
 <add verb="*" path="*.aspx" type="httpHandlers.SqlhttpHandlers, httpHandlers"/>
 </httpHandlers>
 </system.web>

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

博客园 - 飛雪飄寒