diff --git a/.idea/workspace.xml b/.idea/workspace.xml index e9aa82d..c81a59f 100644 --- a/.idea/workspace.xml +++ b/.idea/workspace.xml @@ -2,6 +2,7 @@ + @@ -29,12 +30,12 @@ - + - - + + @@ -42,11 +43,11 @@ - + - - + + @@ -58,8 +59,8 @@ - - + + @@ -87,9 +88,9 @@ @@ -657,12 +658,12 @@ \ No newline at end of file diff --git a/README.md b/README.md index 1768fd4..4373256 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,14 @@ ## URL白名单验证 -验证代码 +### 验证逻辑 + +1. 取URL一级域名 +2. 判断是否在域名白名单列表内 + +### 验证代码 + +合法URL返回true,非法URL返回false ```java security checkUrl = new security(); @@ -12,4 +19,26 @@ String[] urlWList = {"joychou.com", "joychou.me"}; Boolean ret = checkUrl.checkUrlWlist("http://test.joychou.me", urlWList); System.out.println(ret); -``` \ No newline at end of file +``` + +## SSRF + +JAVA默认dns请求会有30s的缓存,所以默认不存在dns rebind问题。除非重新设置ttl为0。 +### 验证逻辑 + +1. 取URL的IP +2. 判断IP是否是内网IP +3. 判断是否是内网IP +4. 请求URL +5. 如果有跳转,取出跳转URL,执行1 + +### 验证代码 + +如果是内网IP,返回false,表示checkSSRF不通过。 +否则返回true。即合法返回true。 +URL只支持HTTP协议。 + +```java +ret = checkUrl.checkSSRF("http://127.0.0.1"); +System.out.println(ret); +``` diff --git a/src/main/java/security.java b/src/main/java/security.java index dd0883d..3204197 100644 --- a/src/main/java/security.java +++ b/src/main/java/security.java @@ -77,7 +77,7 @@ public class security { // 判断当前请求的URL是否是内网ip Boolean bRet = isInnerIpFromUrl(finalUrl); if (bRet) { - return true; + return false; } connection = (HttpURLConnection) new URL(finalUrl).openConnection(); @@ -98,9 +98,9 @@ public class security { } while (connection.getResponseCode() != HttpURLConnection.HTTP_OK); connection.disconnect(); } catch (Exception e) { - return false; + return true; } - return false; + return true; } /* diff --git a/src/main/java/test.java b/src/main/java/test.java index ba0e090..4f0284b 100644 --- a/src/main/java/test.java +++ b/src/main/java/test.java @@ -10,7 +10,7 @@ public class test { // URL白名单组件测试 security checkUrl = new security(); String[] urlWList = {"joychou.com", "joychou.me"}; - Boolean ret = checkUrl.checkUrlWlist("http://test.joychou.me", urlWList); + Boolean ret = checkUrl.checkUrlWlist("http://test.joychou.org", urlWList); System.out.println(ret); // SSRF组件测试 diff --git a/target/classes/security.class b/target/classes/security.class index a43fc1d..1206b8e 100644 Binary files a/target/classes/security.class and b/target/classes/security.class differ diff --git a/target/classes/test.class b/target/classes/test.class index 2de076d..de8c665 100644 Binary files a/target/classes/test.class and b/target/classes/test.class differ