.net全站过滤url危险参数，防注入

来源：互联网发布：仿没内涵网源码模板编辑：程序博客网时间：2024/06/15 07:39

在global文件中添加如下代码：

    void Application_BeginRequest(object sender, EventArgs e)
    {
        //遍历Post参数，隐藏域除外
        if (Regex.IsMatch(Request.RawUrl.ToLower(), @"/manager/")==false)
            for (int i=0; i < Request.Form.Count;i++)
            {
                if (Request.Form[i].ToString() == "__VIEWSTATE") continue;
                if (IsDanger(Request.Form[i].ToString()))
                {
                    Response.Write("您提交的内容中含有非法字符,已经被拒绝.");
                    Response.End();
                }

            }
        //过滤所有Url中的危险字符串
        if (Request.QueryString.Count > 0 && Regex.IsMatch(Request.RawUrl.ToLower(), @"/.aspx") == true && Regex.IsMatch(Request.RawUrl.ToLower(), @"fckeditor") == false)//如果防止截获fckeditor正常的Url，必须验证".aspx"
        {
            string Temp = "";
            //string Url = Request.Url.AbsoluteUri.Substring(0, Request.Url.AbsoluteUri.LastIndexOf("?"));
            string Url = Request.RawUrl.Substring(0, Request.RawUrl.LastIndexOf("?"));
            for (int i = 0; i < this.Request.QueryString.Count; i++)
            {
                try
                {
                    Temp = HandleRequestParam(this.Request.QueryString[i].ToString());
                    Url += i == 0 ? "?" : "&";
                    Url += Request.QueryString.Keys[i].ToString() + "=" + Temp;
                }
                catch { }
            }
            //if (Url.Length < Request.Url.AbsoluteUri.Length)
            //    Response.Redirect(Url);
            Context.RewritePath(Url);//可以用Response.Redirect和Context.RewritePath
        }

        //全站防止页面缓存
        Response.Buffer = true;
        Response.ExpiresAbsolute = DateTime.Now.AddSeconds(-1);
        Response.Expires = 0;
        Response.CacheControl = "no-cache";
    }

    protected string HandleRequestParam(string str)
    {
        string RetStr = "";
        char[] strC = str.ToLower().ToCharArray();
        for (int i = 0; i < strC.Length; i++)
        {
            if (Convert.ToInt32(strC[i]) >= 48 && Convert.ToInt32(strC[i]) <= 57)
                RetStr += strC[i].ToString();
            else
                break;
        }
        return RetStr;
    }

    protected bool IsDanger(string InText)
    {
        string word = @"exec|insert|select|delete|update|master|truncate|char|declare|join|iframe|href|script|<|>|request";
        if (InText == null)
            return false;
        if (Regex.IsMatch(InText,word))
            return true;
        return false;
    }

阅读全文

0 0