关于政府网络安全扫描发现存在漏洞问题

jishuang

7楼已经写了啊在runtime/UIServer/WEB-INF/web.xml中配置上filter

平台默认的是没有.的

yiya42538757

jishuang 发表于 2019-8-16 11:49
7楼已经写了啊在runtime/UIServer/WEB-INF/web.xml中配置上filter

平台默认的是没有.的 ...

加上了  还是能访问

jishuang

1.tomcat重启了吗？
2.确认替换的目录是运行的目录吗？

本地测试过是没问题的

yiya42538757

jishuang 发表于 2019-8-19 09:58
1.tomcat重启了吗？
2.确认替换的目录是运行的目录吗？

1.尝试关闭重开调试模式很多次了，还是能访问到


2.替换什么？我就是按照贴子写的操作
web-inf-filter.jar拷贝到
E:\BeX5_V3.8-ent\runtime\UIServer\WEB-INF\lib
修改web.xml，路径如下：
E:\BeX5_V3.8-ent\runtime\UIServer\WEB-INF\web.xml

内容如下，加粗为新写入的过滤：

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app metadata-complete="true">
  <display-name>UI Server</display-name>
  <description/>

  <!-- Initialize main resource manager -->
  <context-param>
    <param-name>oxf.resources.factory</param-name>
    <param-value>com.justep.ui.resources.PriorityResourceManagerFactory</param-value>
  </context-param>
  <context-param>
    <param-name>oxf.resources.priority.1</param-name>
    <param-value>com.justep.ui.resources.WebAppResourceManagerFactory</param-value>
  </context-param>
  <context-param>
    <param-name>oxf.resources.priority.1.oxf.resources.webapp.rootdir</param-name>
    <param-value>/WEB-INF/resources</param-value>
  </context-param>
  <context-param>
    <param-name>oxf.resources.priority.2</param-name>
    <param-value>com.justep.ui.resources.ClassLoaderResourceManagerFactory</param-value>
  </context-param>

  <context-param>
    <param-name>mobile.login.path</param-name>
    <param-value>/UI2/portal/mobile/index.w?device=m</param-value>
  </context-param>
  <context-param>
    <param-name>pc.login.path</param-name>
    <param-value>/UI2/portal/pc3/index.w?device=pc</param-value>
  </context-param>
  <context-param>
    <param-name>pad.login.path</param-name>
    <param-value>/UI2/portal/pc3/index.w?device=pc</param-value>
  </context-param>


--加入的代码
  <filter>
    <filter-name>web_inf_filter</filter-name>
    <filter-class>com.justep.wangjie.WebInfFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>web_inf_filter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>




  <filter>
          <filter-name>microServiceAdminFilter</filter-name>
          <filter-class>com.justep.ui.filter.MicroServiceAdminFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>microServiceAdminFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

  <filter>
    <filter-name>redirfilter</filter-name>
    <filter-class>com.justep.portal.filter.RedirectFilter</filter-class>
  </filter>
  <!--  
  <filter>
    <filter-name>JFilter</filter-name>
    <filter-class>com.justep.servlet.filter.JFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>JFilter</filter-name>
    <url-pattern>*.j</url-pattern>
  </filter-mapping>
  -->
  <filter-mapping>
    <filter-name>redirfilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>






  <listener>
    <listener-class>com.justep.ui.listener.NativeLoaderListener</listener-class>
  </listener>

  <listener>
    <listener-class>com.justep.ui.listener.UISessionListener</listener-class>
  </listener>

  <servlet>
    <servlet-name>Download</servlet-name>
    <servlet-class>com.justep.update.DownloadServlet</servlet-class>
    <init-param>
      <param-name>default-update-path</param-name>
      <param-value>messenger</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
  </servlet>
  <servlet>
    <servlet-name>main-servlet</servlet-name>
    <servlet-class>com.justep.ui.servlet.MainServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
  </servlet>
  <servlet>
    <servlet-name>captcha-image</servlet-name>
    <servlet-class>com.justep.portal.controller.CaptchaImage</servlet-class>
    <load-on-startup>1</load-on-startup>
  </servlet>

  <servlet>
    <servlet-name>cache-servlet</servlet-name>
    <servlet-class>com.justep.ui.servlet.cache.LoginServlet</servlet-class>
    <init-param>  
       <param-name>cacheIDs</param-name>   
       <param-value>100</param-value>   
    </init-param>
    <init-param>  
       <param-name>enable</param-name>   
       <param-value>false</param-value>   
    </init-param>
    <init-param>  
       <param-name>cacheDBName</param-name>   
       <param-value>java:comp/env/system</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
  </servlet>
<!--  
  <servlet>
    <servlet-name>Connector</servlet-name>
    <servlet-class>com.fredck.FCKeditor.connector.ConnectorServlet</servlet-class>
    <init-param>
      <param-name>baseDir</param-name>
      <param-value>/user/</param-value>
    </init-param>
    <init-param>
      <param-name>realDir</param-name>
      <param-value>/WEB-INF/resources/user/</param-value>
    </init-param>
    <init-param>
      <param-name>debug</param-name>
      <param-value>false</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
  </servlet>

  <servlet>
    <servlet-name>SimpleUploader</servlet-name>
    <servlet-class>com.fredck.FCKeditor.uploader.SimpleUploaderServlet</servlet-class>
    <init-param>
      <param-name>baseDir</param-name>
      <param-value>/user/</param-value>
    </init-param>
    <init-param>
      <param-name>realDir</param-name>
      <param-value>/WEB-INF/resources/user/</param-value>
    </init-param>
    <init-param>
      <param-name>debug</param-name>
      <param-value>false</param-value>
    </init-param>
    <init-param>
      <param-name>enabled</param-name>
      <param-value>true</param-value>
    </init-param>
    <init-param>
      <param-name>AllowedExtensionsFile</param-name>
      <param-value/>
    </init-param>
    <init-param>
      <param-name>DeniedExtensionsFile</param-name>
      <param-value>php|php3|php5|phtml|asp|aspx|ascx|jsp|cfm|cfc|pl|bat|exe|dll|reg|cgi</param-value>
    </init-param>
    <init-param>
      <param-name>AllowedExtensionsImage</param-name>
      <param-value>jpg|gif|jpeg|png|bmp</param-value>
    </init-param>
    <init-param>
      <param-name>DeniedExtensionsImage</param-name>
      <param-value/>
    </init-param>
    <init-param>
      <param-name>AllowedExtensionsFlash</param-name>
      <param-value>swf|fla</param-value>
    </init-param>
    <init-param>
      <param-name>DeniedExtensionsFlash</param-name>
      <param-value/>
    </init-param>
    <load-on-startup>1</load-on-startup>
  </servlet>
  -->

  <servlet>
    <servlet-name>ResourceProxy</servlet-name>
    <servlet-class>com.justep.res.proxy.ResourceProxy</servlet-class>
    <init-param>
      <param-name>proxy</param-name>
      <param-value>/WEB-INF/justep.xml</param-value>
    </init-param>
  </servlet>

  <servlet>
    <servlet-name>PortalController</servlet-name>
    <servlet-class>com.justep.portal.controller.ControllerServlet</servlet-class>
    <load-on-startup>2</load-on-startup>
  </servlet>
  <servlet-mapping>
    <servlet-name>Download</servlet-name>
    <url-pattern>/Update/*</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>PortalController</servlet-name>
    <url-pattern>/portal/controller/*</url-pattern>
  </servlet-mapping>

  <servlet-mapping>
    <servlet-name>ResourceProxy</servlet-name>
    <url-pattern>/resourceproxy</url-pattern>
  </servlet-mapping>

  <servlet-mapping>
    <servlet-name>main-servlet</servlet-name>
    <url-pattern>/</url-pattern>
  </servlet-mapping>

  <servlet-mapping>
    <servlet-name>cache-servlet</servlet-name>
    <url-pattern>/cache/login</url-pattern>
  </servlet-mapping>

  <!--  
  <servlet-mapping>
    <servlet-name>Connector</servlet-name>
    <url-pattern>/ops/fckeditor/editor/filemanager/browser/default/connectors/jsp/connector</url-pattern>
  </servlet-mapping>

  <servlet-mapping>
    <servlet-name>SimpleUploader</servlet-name>
    <url-pattern>/ops/fckeditor/editor/filemanager/upload/simpleuploader</url-pattern>
  </servlet-mapping>
  -->
  <servlet-mapping>
    <servlet-name>captcha-image</servlet-name>
    <url-pattern>/captchaimage</url-pattern>
  </servlet-mapping>
  <session-config>
    <session-timeout>30</session-timeout>
  </session-config>


<!-- 400  -->
<error-page>
        <error-code>400</error-code>
        <location>/error.jsp</location>
</error-page>

<!-- 404 -->
<error-page>
        <error-code>404</error-code>
        <location>/error.jsp</location>
</error-page>

<!-- 500 -->
<error-page>
        <error-code>500</error-code>
        <location>/error.jsp</location>
</error-page>

  <error-page>
    <exception-type>java.lang.Exception</exception-type>
    <location>/error.jsp</location>
  </error-page>

</web-app>

jishuang

tomcat部署的？

yiya42538757

jishuang 发表于 2019-8-21 09:52
tomcat部署的？

下载的企业版，然后装许可直接运行。

包里写的是/WEB-INF/ ，我这个是/WEB-INF./，有影响么

jishuang

平台默认的是WEB-INF，没有WEB-INF.

yiya42538757

jishuang 发表于 2019-8-21 11:09
平台默认的是WEB-INF，没有WEB-INF.

我知道，但是能访问到XML的url是这么写的啊，报告通报我们的如下：
http://10.22.121.226:8088/x5/WEB-INF./web.xml



有.的
这什么情况

jishuang

平台默认的WEB-INF.是不能访问，这个就是标准的web应用平台不会进行处理，需要自己检查一下相关配置

江苏院-吴昊

jishuang 发表于 2019-8-21 14:59
平台默认的WEB-INF.是不能访问，这个就是标准的web应用平台不会进行处理，需要自己检查一下相关配置 ...

是/WEB-INF/不能访问，我这3.8开发版也有这问题，/WEB-INF./应该是平台映射出来了。