From f65a6962866fcc8c65c45e3503bb0fde58af277e Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Tue, 5 Sep 2017 20:51:25 +0800
Subject: [PATCH] add checkSSRF

---
 .idea/workspace.xml           |  35 +++++-----
 src/main/java/security.java   | 124 +++++++++++++++++++++++++++++++++-
 src/main/java/test.java       |   7 ++
 target/classes/security.class | Bin 1478 -> 3890 bytes
 target/classes/test.class     | Bin 871 -> 980 bytes
 5 files changed, 148 insertions(+), 18 deletions(-)

diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index e4bad21..e9aa82d 100644
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -2,7 +2,6 @@
 <project version="4">
   <component name="ChangeListManager">
     <list default="true" id="42982c84-cdb2-4596-b4aa-818c31fc199a" name="Default" comment="">
-      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/.idea/workspace.xml" afterPath="$PROJECT_DIR$/.idea/workspace.xml" />
       <change type="MODIFICATION" beforePath="$PROJECT_DIR$/src/main/java/security.java" afterPath="$PROJECT_DIR$/src/main/java/security.java" />
       <change type="MODIFICATION" beforePath="$PROJECT_DIR$/src/main/java/test.java" afterPath="$PROJECT_DIR$/src/main/java/test.java" />
     </list>
@@ -23,7 +22,9 @@
           <provider selected="true" editor-type-id="text-editor">
             <state relative-caret-position="289">
               <caret line="17" column="10" lean-forward="false" selection-start-line="17" selection-start-column="10" selection-end-line="17" selection-end-column="10" />
-              <folding />
+              <folding>
+                <marker date="1504604535000" expanded="true" signature="89:618" ph="..." />
+              </folding>
             </state>
           </provider>
         </entry>
@@ -44,8 +45,8 @@
       <file leaf-file-name="security.java" pinned="false" current-in-tab="true">
         <entry file="file://$PROJECT_DIR$/src/main/java/security.java">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="163">
-              <caret line="10" column="0" lean-forward="true" selection-start-line="10" selection-start-column="0" selection-end-line="10" selection-end-column="0" />
+            <state relative-caret-position="276">
+              <caret line="66" column="59" lean-forward="false" selection-start-line="66" selection-start-column="59" selection-end-line="66" selection-end-column="59" />
               <folding>
                 <element signature="n#!!doc" expanded="true" />
                 <element signature="imports" expanded="true" />
@@ -57,8 +58,8 @@
       <file leaf-file-name="test.java" pinned="false" current-in-tab="false">
         <entry file="file://$PROJECT_DIR$/src/main/java/test.java">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="238">
-              <caret line="14" column="0" lean-forward="true" selection-start-line="14" selection-start-column="0" selection-end-line="14" selection-end-column="0" />
+            <state relative-caret-position="289">
+              <caret line="17" column="50" lean-forward="false" selection-start-line="17" selection-start-column="50" selection-end-line="17" selection-end-column="50" />
               <folding />
             </state>
           </provider>
@@ -87,8 +88,8 @@
         <option value="$PROJECT_DIR$/pom.xml" />
         <option value="$PROJECT_DIR$/src/main/java/main.java" />
         <option value="$PROJECT_DIR$/README.md" />
-        <option value="$PROJECT_DIR$/src/main/java/security.java" />
         <option value="$PROJECT_DIR$/src/main/java/test.java" />
+        <option value="$PROJECT_DIR$/src/main/java/security.java" />
       </list>
     </option>
   </component>
@@ -99,8 +100,6 @@
     <sorting>DEFINITION_ORDER</sorting>
   </component>
   <component name="ProjectFrameBounds">
-    <option name="x" value="-1280" />
-    <option name="y" value="214" />
     <option name="width" value="1280" />
     <option name="height" value="800" />
   </component>
@@ -658,15 +657,15 @@
       <option name="number" value="Default" />
       <option name="presentableId" value="Default" />
       <updated>1504604417100</updated>
-      <workItem from="1504604422158" duration="2421000" />
+      <workItem from="1504604422158" duration="3470000" />
     </task>
     <servers />
   </component>
   <component name="TimeTrackingManager">
-    <option name="totallyTimeSpent" value="2421000" />
+    <option name="totallyTimeSpent" value="3470000" />
   </component>
   <component name="ToolWindowManager">
-    <frame x="-1280" y="214" width="1280" height="800" extended-state="6" />
+    <frame x="0" y="0" width="1280" height="800" extended-state="0" />
     <editor active="true" />
     <layout>
       <window_info id="Palette" active="false" anchor="right" auto_hide="false" internal_type="DOCKED" type="DOCKED" visible="false" show_stripe_button="true" weight="0.33" sideWeight="0.5" order="-1" side_tool="false" content_ui="tabs" />
@@ -750,7 +749,9 @@
       <provider selected="true" editor-type-id="text-editor">
         <state relative-caret-position="289">
           <caret line="17" column="10" lean-forward="false" selection-start-line="17" selection-start-column="10" selection-end-line="17" selection-end-column="10" />
-          <folding />
+          <folding>
+            <marker date="1504604535000" expanded="true" signature="89:618" ph="..." />
+          </folding>
         </state>
       </provider>
     </entry>
@@ -775,16 +776,16 @@
     </entry>
     <entry file="file://$PROJECT_DIR$/src/main/java/test.java">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="238">
-          <caret line="14" column="0" lean-forward="true" selection-start-line="14" selection-start-column="0" selection-end-line="14" selection-end-column="0" />
+        <state relative-caret-position="289">
+          <caret line="17" column="50" lean-forward="false" selection-start-line="17" selection-start-column="50" selection-end-line="17" selection-end-column="50" />
           <folding />
         </state>
       </provider>
     </entry>
     <entry file="file://$PROJECT_DIR$/src/main/java/security.java">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="163">
-          <caret line="10" column="0" lean-forward="true" selection-start-line="10" selection-start-column="0" selection-end-line="10" selection-end-column="0" />
+        <state relative-caret-position="276">
+          <caret line="66" column="59" lean-forward="false" selection-start-line="66" selection-start-column="59" selection-end-line="66" selection-end-column="59" />
           <folding>
             <element signature="n#!!doc" expanded="true" />
             <element signature="imports" expanded="true" />
diff --git a/src/main/java/security.java b/src/main/java/security.java
index 2c9f01b..dd0883d 100644
--- a/src/main/java/security.java
+++ b/src/main/java/security.java
@@ -4,6 +4,9 @@
  * Date: 2017.09.05
  */
 
+import java.io.IOException;
+import java.net.HttpURLConnection;
+import java.net.InetAddress;
 import java.net.URL;
 import com.google.common.net.InternetDomainName;
 
@@ -13,7 +16,7 @@ public class security {
         * 检测传入的URL是否在白名单的域名里
         * url：需要检测的URL
         * urlWList: 一级域名的域名列表，比如String[] urlWList = {"joychou.com", "joychou.me"};
-        * 合法URL返回true，非法URL返回false
+        * 返回值：合法URL返回true，非法URL返回false
      */
     public static Boolean checkUrlWlist(String url, String[] urlWList) {
         try {
@@ -39,6 +42,125 @@ public class security {
         }
     }
 
+
+    /*
+        * 判断一个URL的IP是否是内网IP
+        * 如果是内网IP，返回true
+        * 非内网IP，返回false
+    */
+    public static boolean isInnerIpFromUrl(String url) throws Exception {
+        String domain = getUrlDomain(url);
+        if (domain.equals("")) {
+            return true; // 异常URL当成内网IP等非法URL处理
+        }
+
+        String ip = DomainToIP(domain);
+        if(ip.equals("")){
+            return true; // 如果域名转换为IP异常，则认为是非法URL
+        }
+        return isInnerIp(ip);
+    }
+
+
+    /*
+        * check SSRF (判断逻辑为判断URL的IP是否是内网IP)
+        * 如果是内网IP，返回false，表示checkSSRF不通过。否则返回true。即合法返回true
+        * URL只支持HTTP协议
+        * 设置了访问超时时间为3s
+     */
+    public static Boolean checkSSRF(String url) {
+
+        HttpURLConnection connection;
+        String finalUrl = url;
+        try {
+            do {
+                // 判断当前请求的URL是否是内网ip
+                Boolean bRet = isInnerIpFromUrl(finalUrl);
+                if (bRet) {
+                    return true;
+                }
+
+                connection = (HttpURLConnection) new URL(finalUrl).openConnection();
+                connection.setInstanceFollowRedirects(false);
+                connection.setUseCaches(false); // 设置为false，手动处理跳转，可以拿到每个跳转的URL
+                connection.setConnectTimeout(3*1000); // 设置连接超时时间为3s
+                //connection.setRequestMethod("GET");
+                connection.connect(); // 会解析dns
+                int responseCode = connection.getResponseCode(); // 发起网络请求
+                if (responseCode >= 300 && responseCode < 400) {
+                    String redirectedUrl = connection.getHeaderField("Location");
+                    if (null == redirectedUrl)
+                        break;
+                    finalUrl = redirectedUrl;
+                    System.out.println("redirected url: " + finalUrl);
+                } else
+                    break;
+            } while (connection.getResponseCode() != HttpURLConnection.HTTP_OK);
+            connection.disconnect();
+        } catch (Exception e) {
+            return false;
+        }
+        return false;
+    }
+
+    /*
+        内网IP：
+        10.0.0.1 - 10.255.255.254       (10.0.0.0/8)
+        192.168.0.1 - 192.168.255.254   (192.168.0.0/16)
+        127.0.0.1 - 127.255.255.254     (127.0.0.0/8)
+        172.16.0.1 - 172.31.255.254     (172.16.0.0/12)
+    */
+    public static boolean isInnerIp(String strIP) throws IOException {
+        try{
+            String[] ipArr = strIP.split("\\.");
+            if (ipArr.length != 4){
+                return false;
+            }
+
+            int ip_split1 = Integer.parseInt(ipArr[1]);
+
+            return (ipArr[0].equals("10") ||
+                    ipArr[0].equals("127") ||
+                    (ipArr[0].equals("172") && ip_split1 >= 16 && ip_split1 <=31) ||
+                    (ipArr[0].equals("192") && ipArr[1].equals("168")));
+        }catch (Exception e) {
+            return false;
+        }
+
+    }
+    /*
+        * 域名转换为IP
+        * 会将各种进制的ip转为正常ip
+        * 167772161转换为10.0.0.1
+        * 127.0.0.1.xip.io转换为127.0.0.1
+    */
+    public static String DomainToIP(String domain) throws IOException{
+        try {
+            InetAddress IpAddress = InetAddress.getByName(domain);
+            return IpAddress.getHostAddress();
+        }
+        catch (Exception e) {
+            return "";
+        }
+    }
+
+    /*
+        从URL中获取域名
+        限制为http/https协议
+    */
+    public static String getUrlDomain(String url) throws IOException{
+        try {
+            URL u = new URL(url);
+            if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) {
+                throw new IOException("Protocol error: " + u.getProtocol());
+            }
+            return u.getHost();
+        } catch (Exception e) {
+            return "";
+        }
+
+    }
+
     public static void main(String[] args) throws Exception {
 
     }
diff --git a/src/main/java/test.java b/src/main/java/test.java
index 29a7462..ba0e090 100644
--- a/src/main/java/test.java
+++ b/src/main/java/test.java
@@ -6,9 +6,16 @@
 
 public class test {
     public static void main(String[] args) throws Exception {
+
+        // URL白名单组件测试
         security checkUrl = new security();
         String[] urlWList = {"joychou.com", "joychou.me"};
         Boolean ret = checkUrl.checkUrlWlist("http://test.joychou.me", urlWList);
         System.out.println(ret);
+
+        // SSRF组件测试
+
+        ret = checkUrl.checkSSRF("http://127.0.0.1");
+        System.out.println(ret);
     }
 }
diff --git a/target/classes/security.class b/target/classes/security.class
index 9555903dc2376c5116785eb56feba08cae24f76e..a43fc1d69581d206251878472dd3242e67722bbf 100644
GIT binary patch
literal 3890
zcmb7Hi+>c=75-*-HZ!|SUJHSS@(5Bf$%cf)3YsY8p=q{m0ww_jEI8Q=$>8qJIy(ze
z1Z``p78TmkTF?rl*7T9KXxk-~7VX>G=bzAD|B%}6%<Lmb{I!K2=iYnnz31_r@17mr
z|M%NB0QBM?G2DeI4bw4%V2e1a<FObr$m+<&;2<x`$3^4DP=F_*DB_stj%#=#hEL*z
zj?c+>QpA%YPRZrda``C@PsgwVpBM235nmMXjEFDk__B=8M)4e;*YK4X+AyW#jEpac
zpqm%*lAJlK<DB^XY7Ae)*L9rN@eLi{)bX;8Z^du{7e&0H;Z+^qjxjk~!)qEYDX6>G
z&e`5p1>yFNy$aNw&ZMQFF=gkhkz#hja>vby3^nnTlQuJZP1lxnS*d!{c0oZbRj|@U
z*Y-{fD5y_QTj|I4xS4$!yWlD4Z%-XHkC{CgGdI;U=DBumYT)3ls*VM!9gdT+%p8sB
z$ER)2qA>~J7BdQzqJoBCBWHO%dqz{dq)t2HIOaNzcfXT0?Hms>g_Z>t9(W>c<vrUG
zC*h*l*D3d<{E(L}5}$%5yO7M~EH{}Sbe*gpQ_CW`bsQk5lV!IdJI_F>&WKgihi7bT
zbWp(^i(Ow3WDSRU*P66lEA3g6zGHP_)MAQD7d>paRw3`?3RX}{CCL!d4nt2%!U|T^
z02}hWJVD!8-4)D_*f}%fyNOm)RuHlC+g+Cl*!jbSe8%>AsVjJHayQKfFpoR3*zjMn
zDszCAlKJhElMI%yEU(3sWF^abMq^A_9%HH0Q4PwuynT@p`TRBADPiQ8Q*_hTpe@v`
zuduUQ7-V2Gw$QH6rZQ<nciF%d%m{mkiH7eOcpVQiMOhX!eAmDmm^JV{%ozASW;Fc3
zzz;EJ;79nefuD%_D&AyGYBa6Z-GGTh3Si)~IAmZy9yIV75pUtA27ZR0D_B{L=a!ln
zDB+rcc@e+B+Xk*<i-BL_SFDx1N~x-W8#tul9Ru&;*9unDf(YQ=QM5CY7R%REV^Uku
z&Gfe!_zixm;dcgpFBtqmzzIFlZQzf1Ps5)KypKOq)4PcerMHip;odEMBJc6#=DRig
z#lT<jHv@kc{DS;#rzg3qnm^s{b{)@2JDE1ibse|Ajj>nC!rfZ9yC#m3r+lo7v4{<7
z3Hea5rC?e6!oE>u)&hHhj*KXHrt1~<+1|8*=9<6q8&jYiGc!eN*Aa5D{lG%2wO6Ro
z_mJOPmUvFeIc~W-%>oJ5o_4Z5Q;sv0v3fYoI=LPpRx;;VE++wZN6ajbsz=y66l`5A
zyVU<`hR>qObMm`g`<Urjm8a1~EdCD*y604|sk0t0ni)Qun?MgLF(CcSm<T%ZUV(_U
zZx>~QlecoU&Or)Sicx-5wLJ#BvS4}19E*_Svve{U=lE#3rO~fS#93Q|XZEmdne36&
zHgj3FF>Yrqr$}0;?MXSQrGt*eUn<sQ^rn8t=-BZZq*j(m&JWsFX7VPEjh!fX7ON2U
zO_qNa$XEiJ^9YJ%W*KpvnP-B$xpC2A)hHCeSbkx=SbYHt>@noLSkJKk#wP7THU5a-
zOF!bbV38(w6M2PUQ}U|yyy+G!E<aSmAhZDiWSJjuz{_fbWfLY&J5B`T?EL6NKXi{-
z`T+AWlv_2{@x$gWemDU-6zQ>)cXQRlk*yDr&TCNK<RpZ9DC>M>J^DE}f&&=9y<A0c
zAGT7%%gSnmxdsZ?5!z1!;o+_l)Oe(Xx{Fxm&ozIphv%VRr6O8FY-Hm+mXu(WP~Wd6
z`XjB88=LFGo3$3LrEUgmTO%!6U%%d}w(2D`T!601-Dfmq_Je==W`=!9*TC(_q7fU|
zzh#`@Czgys3VjS5{P>EZmD#W4snzJlTBfuPW4MjIem!rj!!&oYXh#kme!4@@xZj9R
zVH>fEViMc2gEqUV*-2fPr|!i4oT<DM!2=lNE<wPjsgpki3?WH~qVg-kJ;C`TM?d1u
zc{HUG@n%1_h&q>;M|`-ew(gq8(m7rTl32rFz|uunyatx7iPdRg0Bcx{HdaFF(^iHe
za3A41#Xv|ko*w2bgb|)nscB?LyRe%xsa}@%>bP^EbC^z-5#^DMCA3r!mzs95rX?(Y
z7b{W;PCh20HPO6ezJ!&D5<bp<t2V1GYO~UH1v_LsH-r8}e02$H`Xfqf<PFr#qN6o3
z{1(<;N8A2uSQo#og!QDt`Vu}-!tG+B8Sh>G;526&W)U6n%Nx`<#Nb=-5(8h3GyWLB
za)4|2*zQ7%2{q#(YR1WjJ?O+<vU(rE+D~{65P*X`@dzH4Uw8gBahNrI6sM5Jvz(p5
z6fIjgiz7HsHVCAnto*~Y_7HDJ=%GN(7~$GR$j9kJ<(^GH`v~RPG6$r(7s?zsPhGGZ
z!ppQIMTp9W1xI1Szc|YIiO%>PCA6m!H?&KLgy#}!-#j|*ON9I4og~Ob49JwgaJosR
z#Enm)aaB{(6+~Axt$m&4pqh1~I?n6yZhxw&vrxlxsqh><fz&xn3>%rfi~)w-Si&8T
z1S_H*$EZI+3{UbkJjwrooFa!$^ZZHPc#3E}?c>tP%r)k7z~}dJ%7a8B#Ql)}4y2Pz
z5bJFmE2QgX=7M~X`J+V4kBIM}C&kP*T}{QCuTm?mC030tPEWuK#PLOH&ob6?RkBB@
zJxrhc+#rhb{^WLpPy3tw^1H6=cZT-F?@*;xiSJ6Q+UU<Uzg4Zfj^6zhs`inlvKO%R
z8t#0Dt7t9ao$Lb@JXiXU=_0dug<a)Uc8k}zdx`N~u0|f^vz2b5P+N<9sLYy$h)s~4
h0b&V8E&1Kjoo9WsL3dV2<RlMOOf>R}#dQcr{sV}sh?D>T

delta 550
zcmZXRPfrt36vcn9?J(2v8RV~^SOF2SV2gnNP(dpoARsbvW5NRJL~67UIv89S_HJiu
z{0`{C#D#I?!jIwJuV6e6HzrJS?>+CFbMJdM^QrLTMD+8|*Kfd8qL3Cwe6ECKD7jP)
z7!9S21&oJGaLtj|9dje(CbwLgbm_L^?)cpGnev%F{5@jQkJ+Jv+5Kv~lhn5B4MP}h
z@9kFOx!SAPaIz6s_jYT^+tSO8Hyf5#+6>m=ay?GUPuG?lch7R4iXpd^Bs)G2EHlg+
zJa=sP%vl~XZ&{#XS)}6g$g;$;WrfF<Rhq;<VJ)4?b*3-8cj@<_!#w-^%NsQjeVo#|
z?#p7_{mSh+l~s+ZSNwuG6v)t_+;l_+bPC&l22RtZQ=V?lh-pvX=RX`c@0c8DWL^XN
z)IBI)NuEi1h&abO1vZ7Zq`u|?bq0>+&f`mO=B%_p-OuGMxPQSk=f!0;VVqu}oO(QU
w_e+I_X7s2EMH+QckIC!OOA_5i!wR?2v2BX~ZDSZxBV1PGWN%g!g)<EQ1!`YJIsgCw

diff --git a/target/classes/test.class b/target/classes/test.class
index 0b91aceeb228b6210d389c0d4905092161394ca0..2de076d35c9805f380f5f43191e092094eaf481e 100644
GIT binary patch
delta 382
zcmYL^yG{a85Qe|AAZK@36<Bmt6v5jfC<}N2Q4=dm3o)^@ASNU>7L>jOZlcejg&GSV
zz}mvZUf;qv3x#KL=JL;f{+aWW_|Ql1zprmVokN=mmNhFjMif^~)=YepQUt79l&RQk
zuxV0_kU&$@)Ca9k)d<rn7n>v%2I{P`#kOY0VV9<+<*-Lvk?QsP*X<yvH=5O&SlwZt
zgYZs$rxaGVciFw_bWV>IerYgpZw>c?BIB}AbPN=tE<P<)AW=yiD?g(ihV6{_#1PcD
zk~<>;S*E12n8p*4=<z*qF=&QghJRBz&m>=PP9Cu~pRoVM@@OF?F-6LgJqogkPex|D
r@~`Z0NO>g0470*Dr8h@T27AJu7tE08u|S>}i^7OYuOPQ5xxvyO+lwg{

delta 304
zcmYL?Nm9Z<6o$V}Lb?fYWD;@0DHueIfVlJ!?p=8guVCdQZlKDA2XO6z6W}c@|Ad9z
z)&G0%A6|dkpYY-9_u~`Dm_@|&ET<7(QO_Lbjtj?SK_pfBTt%b|EZ3Id+vC#Q<Q>!X
zH`vT)=BYm7){@2CF}6%%rrhUqvwEgSO{<IJVUS(8rD>#UR4eHM^Ipo^!muO*cGSmf
z1H05URcX-Fk|O*{pbPyx^OKkVbc>4E5Qn8LJW(nkDz~NU1T86)+8!PK(3ZL{^yGGQ
QIl$*ojzHRx-m!XVf7N*y<^TWy