日韩欧美国产精品免费一二-日韩欧美国产精品亚洲二区-日韩欧美国产精品专区-日韩欧美国产另-日韩欧美国产免费看-日韩欧美国产免费看清风阁

namespace DotNet.Utilities
{
    /// <summary>
    /// 網(wǎng)站安全通用防護
    ///
    /// 主要功能：
    ///          攔截攻擊者注入惡意代碼，可以防御諸如跨站腳本攻擊（XSS）、SQL注入攻擊等惡意攻擊行為。
    ///
    /// 修改紀錄
    ///
    /// 2013-12-27，更新正則表達式避免誤報問題。
    /// 2013-01-08，更新了aspx防護腳本中referer變量沖突問題。
    /// 2013-01-09，加入了UTF7編碼XSS的防護。
    /// 2013-01-28，增強了對XSS的防護。
    /// 2013-01-31，針對某些用戶后臺上傳文件出錯的問題。
    /// 2013-03-15，增強了對POST的防護。
    /// 2013-03-28，增強了對XSS的防護。
    /// 2013-04-25，對XSS防護加入了通用的防護方法。
    /// 2013-08-02，加入對XSS編碼繞過的防護。
    /// 2013-08-14，增強利用樣式的XSS防護。
    /// 2014-11-12，解決SQL盲注不攔截的問題。
    ///
    /// 2014-11-12 版本：1.0 SongBiao 創(chuàng)建文件。  
    ///
    /// <author>
    ///     <name>SongBiao</name>
    ///     <date>2014-11-12</date>
    /// </author>
    /// </summary>
    public partial class SecretUtil
    {
        //正則過濾字符
        private const string StrRegex = @"<[^>]+?style=[\w]+?:expression\(|\b(alert|confirm|prompt)\b|^\+/v(8|9)|<[^>]*?=[^>]*?&#[^>]*?>|\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|<\s*img\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)";
        /// <summary>
        ///  POST請求
        /// </summary>
        /// <param name="putData">輸出非法字符串</param>
        /// <returns></returns>
        public static bool PostData(out string putData)
        {
            bool result = false;
            putData = string.Empty;
            for (int i = 0; i < HttpContext.Current.Request.Form.Count; i++)
            {
                result = CheckData(HttpContext.Current.Request.Form[i].ToString(), out putData);
                if (result)
                {
                    putData = HttpContext.Current.Request.Form[i].ToString();
                    break;
                }
            }
            return result;
        }
        /// <summary>
        /// GET請求
        /// </summary>
        /// <param name="putData">輸出非法字符串</param>
        /// <returns></returns>
        public static bool GetData(out string putData)
        {
            bool result = false;
            putData = string.Empty;
            for (int i = 0; i < HttpContext.Current.Request.QueryString.Count; i++)
            {
                result = CheckData(HttpContext.Current.Request.QueryString[i].ToString(), out putData);
                if (result)
                {
                    putData = HttpContext.Current.Request.QueryString[i].ToString();
                    break;
                }
            }
            return result;
        }

        /// <summary>
        /// COOKIE
        /// </summary>
        /// <param name="putData">輸出非法字符串</param>
        /// <returns></returns>
        public static bool CookieData(out string putData)
        {
            bool result = false;
            putData = string.Empty;
            for (int i = 0; i < HttpContext.Current.Request.Cookies.Count; i++)
            {
                result = CheckData(HttpContext.Current.Request.Cookies[i].Value.ToLower(), out putData);
                if (result)
                {
                    putData = HttpContext.Current.Request.Cookies[i].Value.ToLower();
                    break;
                }
            }
            return result;

        }
        /// <summary>
        /// UrlReferrer請求來源
        /// </summary>
        /// <param name="putData">輸出非法字符串</param>
        /// <returns></returns>
        public static bool Referer(out string putData)
        {
            bool result = false;
            result = CheckData(HttpContext.Current.Request.UrlReferrer.ToString(), out putData);
            if (result)
            {
                putData = HttpContext.Current.Request.UrlReferrer.ToString();
            }
            return result;
        }
        /// <summary>
        /// 正則檢查
        /// </summary>
        /// <param name="inputData">字符串</param>
        /// <param name="putData">輸出非法字符串</param>
        /// <returns></returns>
        public static bool CheckData(string inputData, out string putData)
        {
            putData = string.Empty;
            //if (Regex.IsMatch(inputData.ToUpper(), StrRegex.ToUpper(),RegexOptions.IgnoreCase))
            if (Regex.IsMatch(inputData, StrRegex, RegexOptions.IgnoreCase))
            {
                putData = inputData;
                return true;
            }
            else
            {
                return false;
            }
        }
    }

}

/// <summary>
        /// 在此處進行安全檢測和防范
        /// Application_BeginRequest
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        protected void Application_AcquireRequestState(object sender, EventArgs e)
        {
            HttpContext context = HttpContext.Current;
            string putData = string.Empty;
            if (Request.Cookies != null)
            {
                if (SecretUtil.CookieData(out putData))
                {
                    ResponseWarnMessage(context, "Cookie數(shù)據(jù)有惡意字符！", putData);
                }
            }
            if (Request.UrlReferrer != null)
            {
                if (SecretUtil.Referer(out putData))
                {
                    ResponseWarnMessage(context, "Referrer數(shù)據(jù)有惡意字符！", putData);
                }
            }
            if (Request.RequestType.ToUpper() == "POST")
            {
                if (SecretUtil.PostData(out putData))
                {
                    ResponseWarnMessage(context, "Post數(shù)據(jù)有惡意字符！", putData);
                }
            }
            if (Request.RequestType.ToUpper() == "GET")
            {
                if (SecretUtil.GetData(out putData))
                {
                    ResponseWarnMessage(context, "Get數(shù)據(jù)有惡意字符！", putData);
                }
            }
        }
        /// <summary>
        /// 非安全行為 輸出警告信息
        /// </summary>
        /// <param name="errorMessage"></param>
        /// <param name="putData"></param>
        private void ResponseWarnMessage(HttpContext context, string errorMessage, string putData)
        {
            //記錄一下惡意攻擊行為
            string ipAddress = Utilities.GetIPAddress(true);
            BaseUserInfo userInfo = context.Session[DotNet.Business.Utilities.SessionName] as BaseUserInfo;
            //非安全行為同時記錄到數(shù)據(jù)庫和文本文件中
            LogHelper.OracleWarn(userInfo, "惡意訪問行為", "來自IP：" + ipAddress + "的訪問存在惡意行為：" + errorMessage + "字符內(nèi)容：" + putData, " private void ResponseErrorMessage(string errorMessage, string putData)", typeof(MvcApplication), null);
            RouteData routeData = new RouteData();
            routeData.Values.Add("controller", "Error");
            routeData.Values.Add("action", "General");
            routeData.Values.Add("title", "非法訪問與請求提醒");
            routeData.Values.Add("error", "你提交的" + errorMessage + "字符內(nèi)容：" + putData);
            IController errorController = new ErrorController();
            errorController.Execute(new RequestContext(new HttpContextWrapper(Context), routeData));
            context.Response.End();
        }