// Table structure and data initialization at program startup
@PostConstruct
public void init() {

    // Drop table
    jdbcTemplate.execute("drop table IF EXISTS `userdata`;");

    // Create table, containing three columns: ID, username, and password
    jdbcTemplate.execute("create TABLE `userdata` (\n" +
            "  `id` bigint(20) NOT NULL AUTO_INCREMENT,\n" +
            "  `name` varchar(255) NOT NULL,\n" +
            "  `password` varchar(255) NOT NULL,\n" +
            "  PRIMARY KEY (`id`)\n" +
            ") ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;");

    // Insert two test data
    jdbcTemplate.execute("INSERT INTO `userdata` (name,password) VALUES ('test1','haha1'),('test2','haha2')");
}

@Autowired
private JdbcTemplate jdbcTemplate;

// User fuzzy search interface
@PostMapping("jdbcwrong")
public void jdbcwrong(@RequestParam("name") String name) {

    // Use SQL concatenation to concatenate the name parameter into the LIKE clause
    log.info("{}", jdbcTemplate.queryForList("SELECT id,name FROM userdata WHERE name LIKE '%" + name + "%'"));

}

@ExceptionHandler
public void handle(HttpServletRequest req, HandlerMethod method, Exception ex) {
    log.warn(String.format("Exception occurred while accessing %s -> %s!", req.getRequestURI(), method.toString()), ex);
}

<dependency>
    <groupId>com.github.gavlyukovskiy</groupId>
    <artifactId>p6spy-spring-boot-starter</artifactId>
    <version>1.6.1</version>
</dependency>

@PostMapping("jdbcright")
public void jdbcright(@RequestParam("name") String name) {
    log.info("{}", jdbcTemplate.queryForList("SELECT id,name FROM userdata WHERE name LIKE ?", "%" + name + "%"));
}

@Select("SELECT id,name FROM `userdata` WHERE name LIKE '%${name}%'")
List<UserData> findByNameWrong(@Param("name") String name);

@PostMapping("mybatiswrong2")
public List mybatiswrong2(@RequestParam("names") String names) {
    return userDataMapper.findByNamesWrong(names);
}

python sqlmap.py -u  http://localhost:45678/sqlinject/mybatiswrong2 --data names="'test1','test2'"

@PostMapping("mybatisright2")
public List mybatisright2(@RequestParam("names") List<String> names) {
    return userDataMapper.findByNamesRight(names);
}

<select id="findByNamesRight" resultType="org.geekbang.time.commonmistakes.codeanddata.sqlinject.UserData">
    SELECT id,name FROM `userdata` WHERE name in
    <foreach collection="names" item="item" open="(" separator="," close=")">
        #{item}
    </foreach>
</select>

private ScriptEngineManager scriptEngineManager = new ScriptEngineManager();

// Obtain a JavaScript script engine

private ScriptEngine jsEngine = scriptEngineManager.getEngineByName("js");

@GetMapping("wrong")
public Object wrong(@RequestParam("name") String name) {
    try {
        // Dynamically execute JavaScript script using eval. Here, the name parameter is mixed into the JavaScript code using string concatenation
        return jsEngine.eval(String.format("var name='%s'; name=='admin'?1:0;", name));
    } catch (ScriptException e) {
        e.printStackTrace();
    }
    return null;
}

haha';java.lang.System.exit(0);'

@GetMapping("right")
public Object right(@RequestParam("name") String name) {
    try {
        // External parameter
        Map<String, Object> parm = new HashMap<>();
        parm.put("name", name);
        // The name parameter is bound and passed to the eval method instead of concatenating JavaScript code
        return jsEngine.eval("name=='admin'?1:0;", new SimpleBindings(parm));
    } catch (ScriptException e) {
        e.printStackTrace();
    }
    return null;
}

@Slf4j
public class ScriptingSandbox {
    private ScriptEngine scriptEngine;
    private AccessControlContext accessControlContext;
    private SecurityManager securityManager;
    private static ThreadLocal<Boolean> needCheck = ThreadLocal.withInitial(() -> false);

    public ScriptingSandbox(ScriptEngine scriptEngine) throws InstantiationException {
        this.scriptEngine = scriptEngine;
        securityManager = new SecurityManager() {
            // Only checks permissions when needed
            @Override
            public void checkPermission(Permission perm) {
                if (needCheck.get() && accessControlContext != null) {
                    super.checkPermission(perm, accessControlContext);
                }
            }
        };
        // Set the required permissions for script execution
        setPermissions(Arrays.asList(
                new RuntimePermission("getProtectionDomain"),
                new PropertyPermission("jdk.internal.lambda.dumpProxyClasses","read"),
                new FilePermission(Shell.class.getProtectionDomain().getPermissions().elements().nextElement().getName(),"read"),
                new RuntimePermission("createClassLoader"),
                new RuntimePermission("accessClassInPackage.jdk.internal.org.objectweb.*"),
                new RuntimePermission("accessClassInPackage.jdk.nashorn.internal.*"),
                new RuntimePermission("accessDeclaredMembers"),
                new ReflectPermission("suppressAccessChecks")
        ));
    }

    // Set permissions for the execution context 
    public void setPermissions(List<Permission> permissionCollection) {
        Permissions perms = new Permissions();
        if (permissionCollection != null) {
            for (Permission p : permissionCollection) {
                perms.add(p);
            }
        }
        ProtectionDomain domain = new ProtectionDomain(new CodeSource(null, (CodeSigner[]) null), perms);
        accessControlContext = new AccessControlContext(new ProtectionDomain[]{domain});
    }

    public Object eval(final String code) {
        SecurityManager oldSecurityManager = System.getSecurityManager();
        System.setSecurityManager(securityManager);
        needCheck.set(true);
        try {
            // Execute the script under the protection of AccessController
            return AccessController.doPrivileged((PrivilegedAction<Object>) () -> {
                try {
                    return scriptEngine.eval(code);
                } catch (ScriptException e) {
                    e.printStackTrace();
                }
                return null;
            }, accessControlContext);
        } catch (Exception ex) {
            log.error("Sorry, cannot execute the script {}", code, ex);
        } finally {
            needCheck.set(false);
            System.setSecurityManager(oldSecurityManager);
        }
        return null;
    }
}

@GetMapping("right2")
public Object right2(@RequestParam("name") String name) throws InstantiationException {
    // Execute the script using the sandbox
    ScriptingSandbox scriptingSandbox = new ScriptingSandbox(jsEngine);
    return scriptingSandbox.eval(String.format("var name='%s'; name=='admin'?1:0;", name));
}

@RequestMapping("xss")
@Slf4j
@Controller
public class XssController {

    @Autowired
    private UserRepository userRepository;

    // Display the XSS page
    @GetMapping
    public String index(ModelMap modelMap) {
        // Query the database
        User user = userRepository.findById(1L).orElse(new User());
        // Provide the model for the view
        modelMap.addAttribute("username", user.getName());
        return "xss";
    }

    // Save user information
    @PostMapping
    public String save(@RequestParam("username") String username, HttpServletRequest request) {
        User user = new User();
        user.setId(1L);
        user.setName(username);
        userRepository.save(user);
        // Redirect to the home page after saving
        return "redirect:/xss/";
    }

}

// User class serving as DTO and Entity
@Entity
@Data
public class User {

    @Id
    private Long id;
    private String name;

}

<div style="font-size: 14px">
    <form id="myForm" method="post" th:action="@{/xss/}">
        <label th:utext="${username}"/>
        <input id="username" name="username" size="100" type="text"/>
        <button th:text="Register" type="submit"/>
    </form>
</div>

@ControllerAdvice
public class SecurityAdvice {

    @InitBinder
    protected void initBinder(WebDataBinder binder) {
        // Register a custom editor
        binder.registerCustomEditor(String.class, new PropertyEditorSupport() {
            @Override
            public String getAsText() {
                Object value = getValue();
                return value != null ? value.toString() : "";
            }
            @Override
            public void setAsText(String text) {
                // Perform HTML escaping when assigning values
                setValue(text == null ? null : HtmlUtils.htmlEscape(text));
            }
        });
    }

}

user.setName(request.getParameter("username"));

// Custom filter
@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class XssFilter implements Filter {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        chain.doFilter(new XssRequestWrapper((HttpServletRequest) request), response);
    }
}

public class XssRequestWrapper extends HttpServletRequestWrapper {
    public XssRequestWrapper(HttpServletRequest request) {
        super(request);
    }
    @Override
    public String[] getParameterValues(String parameter) {
        // Escape all parameter values one by one when there are multiple values
        return Arrays.stream(super.getParameterValues(parameter)).map(this::clean).toArray(String[]::new);
    }
    @Override
    public String getHeader(String name) {
        // Also clean the request headers
        return clean(super.getHeader(name));
    }
    @Override
    public String getParameter(String parameter) {
    
```java
// Handling single parameter values

return clean(super.getParameter(parameter));

}

// The clean method is used to HTML escape the value

private String clean(String value) {

 return StringUtils.isEmpty(value)? "" : HtmlUtils.htmlEscape(value);

}

}

This way, we can achieve HTML escaping for all request parameters. However, this approach is still not thorough enough because it cannot handle JSON data submitted through the @RequestBody annotation. For example, consider a PUT endpoint that directly saves the JSON User object passed in by the client:

@PutMapping

public void put(@RequestBody User user) {

 userRepository.save(user);

}

When making a request to this endpoint using Postman, the data saved in the database is still not escaped:

![img](../images/6d8e2b3b68e8a623d039d9d73999a64f.png)

We need to customize a Jackson deserializer to escape the strings during deserialization:

// Register custom Jackson deserializer

@Bean

public Module xssModule() {

  SimpleModule module = new SimpleModule();

  module.module.addDeserializer(String.class, new XssJsonDeserializer());

  return module;

}

public class XssJsonDeserializer extends JsonDeserializer<String> {

  @Override

  public String deserialize(JsonParser jsonParser, DeserializationContext ctxt) throws IOException, JsonProcessingException {

    String value = jsonParser.getValueAsString();

    if (value != null) {

      // HTML escape the value

      return HtmlUtils.htmlEscape(value);

    }

    return value;

  }

  @Override

  public Class<String> handledType() {

    return String.class;

  }

}

This way, we can escape not only the data submitted via GET/POST request parameters, but also the JSON data submitted directly in the request body.

You may think that at this point, our defense is already comprehensive enough. However, that is not the case. This approach is only blocking new vulnerabilities and ensures that new data is escaped before entering the database. If some JavaScript code has already been saved in the database due to previous vulnerabilities, we could still encounter issues when reading the data. Therefore, we also need to escape the data when reading it.

Next, let's take a look at the specific implementation.

First, as we have addressed the JSON deserialization issue, we also need to handle serialization to escape the strings when reading from the database. Otherwise, the retrieved JSON may still contain JavaScript code.

For example, suppose we have a GET endpoint that returns user information in JSON:

@GetMapping("user")

@ResponseBody

public User query() {

  return userRepository.findById(1L).orElse(new User());

}

![img](../images/b2f919307e42e79ce78622b305d455f8.png)

Modify the previous SimpleModule to include a custom serializer and implement string escaping during serialization:

// Register custom Jackson serializer

@Bean

public Module xssModule() {

  SimpleModule module = new SimpleModule();

  module.addDeserializer(String.class, new XssJsonDeserializer());

  module.addSerializer(String.class, new XssJsonSerializer());

  return module;

}

public class XssJsonSerializer extends JsonSerializer<String> {

  @Override

  public Class<String> handledType() {

    return String.class;

  }

  @Override

  public void serialize(String value, JsonGenerator jsonGenerator, SerializerProvider serializerProvider) throws IOException {

    if (value != null) {

      // HTML escape the string

      jsonGenerator.writeString(HtmlUtils.htmlEscape(value));

    }

  }

}

As a result, even if JavaScript code is already saved in the database, it will only be displayed as HTML. Now, we have implemented escaping in both the input and output directions.

However, to ensure we don't overlook anything and further control the potential harm caused by XSS, we need to consider another scenario: if we need to write sensitive information to cookies, we can enable the HttpOnly attribute. This way, JavaScript code cannot read the cookies even if the page is injected with XSS attack code.

Let's test it with some code. Define two endpoints: readCookie endpoint to read the cookie with the key "test", and writeCookie endpoint to write the cookie. The HttpOnly parameter determines whether the cookie has the HttpOnly attribute:

// Server-side code to read the cookie

@GetMapping("readCookie")

@ResponseBody

public String readCookie(@CookieValue("test") String cookieValue) {

  return cookieValue;

}

// Server-side code to write the cookie

@GetMapping("writeCookie")

@ResponseBody

public void writeCookie(@RequestParam("httpOnly") boolean httpOnly, HttpServletResponse response) {

  Cookie cookie = new Cookie("test", "zhuye");

  // Enable the HttpOnly attribute based on the httpOnly parameter

  cookie.setHttpOnly(httpOnly);

  response.addCookie(cookie);

}

We can see that due to "test" and "_ga" cookies not having HttpOnly, they can be accessed using document.cookie:

![img](../images/726e984d392aa1afc6d7371447700977.png)

After enabling the HttpOnly attribute for the "test" cookie, it cannot be accessed using document.cookie anymore, and only the "_ga" cookie is included in the output:

![img](../images/1b287474f0666d5a2fde8e9442ae2e0c.png)

However, the server can still access the cookie:

![img](../images/b25da8d4aa5778798652f9685a93f6bd.png)
## Key Takeaways

Today, I analyzed two types of injection security issues, SQL injection and XSS attacks, through case studies.

While learning about SQL injection, we saw several common injection methods using the sqlmap tool. This may have changed our understanding of the power of SQL injection: even for POST requests with no returned data and no errors, it is still possible to complete the injection and export all data from the database.

For SQL injection, using parameterized queries is the best way to prevent leaks. For JdbcTemplate, we can use "?" as a parameter placeholder, while for MyBatis, we need to use "#{}" for parameterization.

Similar to SQL injection, when dynamically executing code with a script engine, we need to ensure that externally provided data is treated only as data and not concatenated with code. The boundaries between code and data need to be clear, otherwise code injection issues may arise. Additionally, we can refine the permissions of the code by setting up a code execution sandbox, making it difficult for injection attacks to have a significant impact due to restricted privileges.

Next, through studying XSS cases, we realized that handling security issues requires ensuring three things.

First, fixing the leak from the root and at the lowest level is essential. It is best to avoid fixing the issue at a higher-level framework, as it may not be thorough enough.

Second, fixing the leak should consider both input and output. We need to ensure that data is properly escaped or filtered when it is stored in the database and when it is presented, to ensure complete security.

Third, in addition to direct fixes, we can also limit the impact of vulnerabilities through additional means. For example, setting the HttpOnly attribute for cookies prevents data from being read by scripts. Similarly, limiting the maximum length of fields can restrict a hacker's ability to construct complex attack scripts, even if a vulnerability exists.

The code used today is available on GitHub. You can click on this [link](https://github.com) to view it.
## Reflection and Discussion

In discussing SQL injection cases, in the last test, we saw that sqlmap returned 4 types of injection methods. I have already introduced boolean-based blind injection, time-based blind injection, and error-based injection. Do you know what union-based injection is?

When discussing XSS, we know how to escape HTML and display it as text in Thymeleaf template engine. FreeMarker is also a commonly used template engine in Java. Do you know how to handle escaping in FreeMarker?

Have you encountered any other types of injection issues? I am Zhu Ye. Feel free to leave a comment in the comment section to share your thoughts with me. You are also welcome to share today's content with your friends or colleagues and discuss together.