Giter VIP home page Giter VIP logo

rhizobia_j's People

Contributors

momodememeda avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

rhizobia_j's Issues

关于富文本xss问题

你好,请问这个sdk有关于富文本中xss防护的策略吗?后期后更新这个吗?

AES 加密工具存在误用!

AES 加密攻击 默认是AES/CBC/PKCS5Padding 算法。
CBC/PKCS5Padding 加密模式是不安全的。存在以下攻击手段。
1、 padding oracle 攻击。
攻击条件存在一个解密接口,不需要知道解密结果,只需要知道是否报错。即个在不知道密钥的情况下除第一组明文外的所有明文。(因为第一组初始向量不可控)
2. 字节翻转攻击。
可以构造一个密文,使其解密成攻击的想要的明文。

CSRF

我觉得生成的csrftoken可以用CookieCsrfTokenRepository存储在cookie中的,后端$_COOKIES['csrf_token'] == $_POST['csrf_token']进行校验;如果使用seession存储或者其他存储介质,如果后端存在多台服务器,没有做session同步的话就有问题了;

RSAUtils代码存在问题

src/main/java/com/immomo/rhizobia/rhizobia_J/crypto/RSAUtils.java

你好,在这个文件里出现了两处密码学的误用,如下:

第一处:

    public String keyAlgorithm = "RSA"; 

RSA加解密时候

  • 不使用Padding,在密文短的时候是可以攻击的(理论上);
  • 不使用分组模式,在密文较长(超过N 的长度)的时候是无法被加密的;

第二处:

    /**
     * @Description: 签名(私钥加密)
     * @Param: oriData 待签名数据
     * @return: byte[] 数字签名
     */
    public byte[] sign(String oriData) throws Exception {
        byte[] data = oriData.getBytes();
        // 对数据加密
        KeyFactory keyFactory = KeyFactory.getInstance(keyAlgorithm);
        Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());
        cipher.init(Cipher.ENCRYPT_MODE, privateKey);
        byte[] encrypted = cipher.doFinal(data);
        return encrypted;
    }


    /**
     * @Description: 验签(公钥解密)
     * @Param: sign 签名
     * @return: String 待校验数据
     */
    public String verify(byte[] sign) throws Exception {
        // 对数据解密
        KeyFactory keyFactory = KeyFactory.getInstance(keyAlgorithm);
        Cipher cipher = Cipher.getInstance(keyFactory.getAlgorithm());
        cipher.init(Cipher.DECRYPT_MODE, publicKey);
        byte[] original = cipher.doFinal(sign);
        String originalString = new String(original);
        return originalString;
    }

加签是对整个数据完整性的保证,输出一个长度较短的摘要,代码里的sign函数是用私钥把原文完全加密一遍,生成比明文还要长的数据,完全不是加签。

验签同样,按理说要返回true/false表示是否成功,这里返回明文,和我理解的不大一样。

建议把这个文件重写,不要误导后人。

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.