最近在一个扯蛋的项目中遇到一堆渗透测试的问题。其中有一个“X-Frame-Options漏洞”问题。我抓耳挠腮的一度不知道怎么解决，最后在我的不屑坚持下.......嘻嘻。愿遇到该BUG的人都能处理掉。我们先看看渗透报告中的东西，以失败而告终。
广告:由于我的博文《docker实现离线地图server》怎么写都搜不到，所以请原谅我这样无耻的推广~~:https://blog.csdn.net/u010403700/article/details/90678645
===================================渗透报告中的内容 START====================================
点 击劫持：X-Frame-Options头缺失（低）
漏洞情况：
漏洞危害：
点击劫持（ClickJacking）是一种视觉上的欺骗手段。攻击者使用一个透明的、不可见的iframe，覆盖在一个网页上，然后诱使用户在该网页上进行操作，此时用户将在不知情的情况下点击透明的iframe页面。通过调整iframe页面的位置，可以诱使用户恰好点击在iframe页面的一些功能性按钮上。
解决方案(用不了)：
Tomcat配置X-Frame-Options
2种方法：
第1种：将ClickjackFilter.jar添加到lib目录下。
（可在OWASP的网站中找到）
<filter>
<filter-name>ClickjackFilterDeny</filter-name>
<filter-class>org.owasp.filters.ClickjackFilter</filter-class>
<init-param>
<param-name>mode</param-name>
<param-value>SAMEORIGIN </param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>ClickjackFilterDeny</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
第2种：打开webapps\ROOT\WEB-INF\web.xml添加以下过滤器：
<filter>
<filter-name>httpHeaderSecurity</filter-name>
<filter-class>
org.apache.catalina.filters.HttpHeaderSecurityFilter
</filter-class>
<antiClickJackingEnabled>true</antiClickJackingEnabled>
<antiClickJackingOption>SAMEORIGIN</antiClickJackingEnabled>
</filter>
<filter-mapping>
<filter-name>httpHeaderSecurity</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
===================================渗透报告中的内容 END====================================
本来看文档就头疼，尼玛，看完还没处理掉。在心里画了一万个圈圈骂他们。报错
实在没招了。回过头来再看看加粗的那部分，原来就是 apache 的 HttpHeaderSecurityFilter类。经过反编译看了看源码
原来初始化 antiClickJackingOption 的值是XFrameOption.DENY。我们希望的是antiClickJackingOption=XFrameOption.SAME_ORIGIN。于是就重新了一个类，将HttpHeaderSecurityFilter中的代码复制进去。就好了
提示:XFrameOptionn 中有三中，DENY 不允许嵌入IFrame、SAME_ORIGIN 运行显示同源iframe、ALLOW_FROM指定地址的iframe
终极解决方案
1.编写CntenHttpHeaderSecurityFilter类
public class CntenHttpHeaderSecurityFilter extends FilterBase{
private static final Log log = LogFactory.getLog(CntenHttpHeaderSecurityFilter.class);
private static final String HSTS_HEADER_NAME = "Strict-Transport-Security";
private boolean hstsEnabled;
private int hstsMaxAgeSeconds;
private boolean hstsIncludeSubDomains;
private String hstsHeaderValue;
private static final String ANTI_CLICK_JACKING_HEADER_NAME = "X-Frame-Options";
private boolean antiClickJackingEnabled;
private XFrameOption antiClickJackingOption;
private URI antiClickJackingUri;
private String antiClickJackingHeaderValue;
private static final String BLOCK_CONTENT_TYPE_SNIFFING_HEADER_NAME = "X-Content-Type-Options";
private static final String BLOCK_CONTENT_TYPE_SNIFFING_HEADER_VALUE = "nosniff";
private boolean blockContentTypeSniffingEnabled;
public CntenHttpHeaderSecurityFilter()
{
this.hstsEnabled = true;
this.hstsMaxAgeSeconds = 0;
this.hstsIncludeSubDomains = false;
this.antiClickJackingEnabled = true;
this.antiClickJackingOption = XFrameOption.ALLOW_FROM;
this.blockContentTypeSniffingEnabled = true;
}
public void init(FilterConfig filterConfig) throws ServletException {
super.init(filterConfig);
StringBuilder hstsValue = new StringBuilder("max-age=");
hstsValue.append(this.hstsMaxAgeSeconds);
if (this.hstsIncludeSubDomains) {
hstsValue.append(";includeSubDomains");
}
this.hstsHeaderValue = hstsValue.toString();
StringBuilder cjValue = new StringBuilder(this.antiClickJackingOption.headerValue);
if (this.antiClickJackingOption == XFrameOption.ALLOW_FROM) {
cjValue.append(':');
cjValue.append(this.antiClickJackingUri);
}
this.antiClickJackingHeaderValue = cjValue.toString();
}
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException
{
if (response.isCommitted()) {
throw new ServletException(sm.getString("httpHeaderSecurityFilter.committed"));
}
if ((this.hstsEnabled) && (request.isSecure()) && ((response instanceof HttpServletResponse))) {
((HttpServletResponse)response).setHeader("Strict-Transport-Security", this.hstsHeaderValue);
}
if ((this.antiClickJackingEnabled) && ((response instanceof HttpServletResponse))) {
((HttpServletResponse)response).setHeader("X-Frame-Options", this.antiClickJackingHeaderValue);
}
if ((this.blockContentTypeSniffingEnabled) && ((response instanceof HttpServletResponse))) {
((HttpServletResponse)response).setHeader("X-Content-Type-Options", "nosniff");
}
chain.doFilter(request, response);
}
protected Log getLogger()
{
return log;
}
protected boolean isConfigProblemFatal()
{
return true;
}
public boolean isHstsEnabled()
{
return this.hstsEnabled;
}
public void setHstsEnabled(boolean hstsEnabled)
{
this.hstsEnabled = hstsEnabled;
}
public int getHstsMaxAgeSeconds()
{
return this.hstsMaxAgeSeconds;
}
public void setHstsMaxAgeSeconds(int hstsMaxAgeSeconds)
{
if (hstsMaxAgeSeconds < 0)
this.hstsMaxAgeSeconds = 0;
else
this.hstsMaxAgeSeconds = hstsMaxAgeSeconds;
}
public boolean isHstsIncludeSubDomains()
{
return this.hstsIncludeSubDomains;
}
public void setHstsIncludeSubDomains(boolean hstsIncludeSubDomains)
{
this.hstsIncludeSubDomains = hstsIncludeSubDomains;
}
public boolean isAntiClickJackingEnabled()
{
return this.antiClickJackingEnabled;
}
public void setAntiClickJackingEnabled(boolean antiClickJackingEnabled)
{
this.antiClickJackingEnabled = antiClickJackingEnabled;
}
public String getAntiClickJackingOption()
{
return this.antiClickJackingOption.toString();
}
public void setAntiClickJackingOption(String antiClickJackingOption)
{
for (XFrameOption option : XFrameOption.values()) {
if (option.getHeaderValue().equalsIgnoreCase(antiClickJackingOption)) {
this.antiClickJackingOption = option;
return;
}
}
throw new IllegalArgumentException(sm.getString("httpHeaderSecurityFilter.clickjack.invalid", new Object[] { antiClickJackingOption }));
}
public String getAntiClickJackingUri()
{
return this.antiClickJackingUri.toString();
}
public boolean isBlockContentTypeSniffingEnabled()
{
return this.blockContentTypeSniffingEnabled;
}
public void setBlockContentTypeSniffingEnabled(boolean blockContentTypeSniffingEnabled)
{
this.blockContentTypeSniffingEnabled = blockContentTypeSniffingEnabled;
}
public void setAntiClickJackingUri(String antiClickJackingUri)
{
URI uri;
try
{
uri = new URI(antiClickJackingUri);
}
catch (URISyntaxException e)
{
uri = null;
throw new IllegalArgumentException(e);
}
this.antiClickJackingUri = uri;
}
private static enum XFrameOption
{
DENY("DENY"),
SAME_ORIGIN("SAMEORIGIN"),
ALLOW_FROM("ALLOW-FROM");
private final String headerValue;
private XFrameOption(String headerValue) {
this.headerValue = headerValue;
}
public String getHeaderValue() {
return this.headerValue;
}
}
}
2.在项目中的web.xml文件中添加自定义Filter
<filter>
<filter-name>httpHeaderSecurity</filter-name>
<filter-class>
com.hd.platform.devlActions.CntenHttpHeaderSecurityFilter
</filter-class>
<antiClickJackingEnabled>true</antiClickJackingEnabled>
<antiClickJackingOption>SAMEORIGIN</antiClickJackingOption>
</filter>
<filter-mapping>
<filter-name>httpHeaderSecurity</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
至此问题处理完毕。
相关资源地址：https://download.csdn.net/download/u010403700/10629286
需要探讨微服务、微服务容器化、微服务编排、arcgis for javascript 的问题。可加qq:914423503