TRKJ/EdgeAdmin
2
0
Fork 0
mirror of https://github.com/TeaOSLab/EdgeAdmin.git synced 2025-11-09 16:50:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

管理系统增加XSS和SQL注入攻击防御

Browse Source
This commit is contained in:
GoEdgeLab
2024-03-18 12:42:49 +08:00
parent b31e26740e
commit 97dc434da5
22 changed files with 15277 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
internal/web/helpers/user_must_auth.go
View File

@@ -7,6 +7,7 @@ import (
"github.com/TeaOSLab/EdgeAdmin/internal/goman"
"github.com/TeaOSLab/EdgeAdmin/internal/rpc"
"github.com/TeaOSLab/EdgeAdmin/internal/setup"
"github.com/TeaOSLab/EdgeAdmin/internal/waf/injectionutils"
"github.com/TeaOSLab/EdgeAdmin/internal/web/actions/default/index/loginutils"
"github.com/TeaOSLab/EdgeCommon/pkg/langs"
"github.com/TeaOSLab/EdgeCommon/pkg/nodeconfigs"
@@ -115,6 +116,13 @@ func (this *userMustAuth) BeforeAction(actionPtr actions.ActionWrapper, paramNam
return false
}
// 检测注入
if injectionutils.DetectXSS(action.Request.RequestURI, false) || injectionutils.DetectSQLInjection(action.Request.RequestURI, false) {
action.ResponseWriter.WriteHeader(http.StatusForbidden)
_, _ = action.ResponseWriter.Write([]byte("Denied By WAF"))
return false
}
// 恢复模式
if teaconst.IsRecoverMode {
action.RedirectURL("/recover")