OWASP Top 10 深度解析

@RestController
public class OrderController {
    @GetMapping("/api/orders/{orderId}")
    public Order getOrder(@PathVariable Long orderId, 
                          @AuthenticationPrincipal User user) {
        Order order = orderService.findById(orderId);
        // ✅ 必须验证资源归属
        if (!order.getUserId().equals(user.getId())) {
            throw new AccessDeniedException();
        }
        return order;
    }
}

// 全局方案：
// 1. 默认拒绝（Deny by Default）
// 2. 最小权限原则
// 3. 服务端验证权限（不信任客户端）
// 4. 使用成熟的 RBAC/ABAC 框架

// ✅ 密码哈希：BCrypt / Argon2 / PBKDF2
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(12); // strength=12
String hashed = encoder.encode("user_password");
boolean matches = encoder.matches("user_password", hashed);

// ✅ 敏感数据加密（AES-256-GCM）
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
cipher.init(Cipher.ENCRYPT_MODE, secretKey, gcmParameterSpec);

// ✅ HTTPS 强制
server:
  ssl:
    enabled: true
    protocol: TLS
    enabled-protocols: TLSv1.2,TLSv1.3

// ❌ 字符串拼接（危险！）
String sql = "SELECT * FROM users WHERE name = '" + username + "'";
// username = "' OR '1'='1" → 绕过认证

// ✅ 预处理语句
String sql = "SELECT * FROM users WHERE name = ?";
PreparedStatement stmt = conn.prepareStatement(sql);
stmt.setString(1, username);

# Spring Boot 安全配置
server:
  error:
    whitelabel:
      enabled: false  # 禁用默认错误页
    include-stacktrace: never
    include-message: never

management:
  endpoints:
    web:
      exposure:
        include: health,info  # 不暴露 sensitive endpoints
      base-path: /admin/actuator  # 隐藏路径
      
security:
  headers:
    content-security-policy: "default-src 'self'"
    x-content-type-options: nosniff
    x-frame-options: DENY
    strict-transport-security: max-age=31536000; includeSubDomains

# 使用依赖扫描工具
# Maven
mvn org.owasp:dependency-check-maven:check

# npm
npm audit
yarn audit

# Gradle
./gradlew dependencyCheckAnalyze

# Snyk 持续监控
snyk monitor
snyk test

# GitHub Dependabot
# 自动创建 PR 升级有漏洞的依赖

// 登录速率限制（Bucket4j）
Bucket bucket = Bucket.builder()
    .addLimit(Bandwidth.classic(5, Refill.intervally(5, Duration.ofMinutes(1))))
    .build();

if (!bucket.tryConsume(1)) {
    throw new TooManyRequestsException("登录尝试过多，请稍后再试");
}

// JWT 安全配置
@Bean
public JwtDecoder jwtDecoder() {
    NimbusJwtDecoder decoder = NimbusJwtDecoder.withJwkSetUri(jwkUri).build();
    decoder.setJwtValidator(JwtValidators.createDefaultWithIssuer(issuer));
    return decoder;
}
// - 使用 RS256（非对称加密）
// - 设置合理的 exp（15分钟）
// - 包含 jti 用于撤销
// - HTTPS only

// ❌ Java 原生反序列化（危险！）
ObjectInputStream ois = new ObjectInputStream(input);
Object obj = ois.readObject(); // 可执行任意代码！

// ✅ 使用 JSON 替代（Jackson + 类型白名单）
ObjectMapper mapper = new ObjectMapper();
mapper.activateDefaultTyping(
    BasicPolymorphicTypeValidator.builder()
        .allowIfBaseType(Object.class)
        .build(),
    ObjectMapper.DefaultTyping.NON_FINAL
);

// 更好的方案：明确类型，不使用多态
User user = mapper.readValue(json, User.class);

# 验证依赖签名
- name: Verify signatures
  run: |
    gpg --verify artifact.jar.asc artifact.jar
    
# SLSA 供应链层级
# Level 1: 构建过程脚本化
# Level 2: 使用版本控制和托管构建服务
# Level 3: 构建环境安全隔离 + 源码完整性
# Level 4: 双人员审查 + 可复现构建

// 安全事件日志模板
@Aspect
@Component
public class SecurityAuditAspect {
    @AfterReturning("@annotation(auditable)")
    public void audit(JoinPoint jp, Auditable auditable) {
        SecurityEvent event = SecurityEvent.builder()
            .timestamp(Instant.now())
            .user(getCurrentUser())
            .action(auditable.action())
            .resource(auditable.resource())
            .ip(getClientIp())
            .userAgent(getUserAgent())
            .result("SUCCESS")
            .build();
        securityLogger.info(event);
    }
}

// 必须记录的事件：
// - 登录成功/失败
// - 权限变更
// - 敏感数据访问
// - 管理员操作
// - 配置变更
// - 安全异常（XSS/注入尝试）

public class UrlValidator {
    private static final Set<String> ALLOWED_SCHEMES = Set.of("http", "https");
    private static final Set<String> BLOCKED_HOSTS = Set.of(
        "localhost", "127.0.0.1", "0.0.0.0",
        "169.254.169.254" // AWS/阿里云 metadata
    );
    
    public static boolean isSafe(String urlString) {
        try {
            URL url = new URL(urlString);
            
            // 1. 验证协议
            if (!ALLOWED_SCHEMES.contains(url.getProtocol())) {
                return false;
            }
            
            // 2. 解析 IP（防止 DNS 重绑定）
            InetAddress address = InetAddress.getByName(url.getHost());
            if (address.isLoopbackAddress() || address.isSiteLocalAddress()) {
                return false;
            }
            
            // 3. 黑名单检查
            if (BLOCKED_HOSTS.contains(url.getHost().toLowerCase())) {
                return false;
            }
            
            return true;
        } catch (Exception e) {
            return false;
        }
    }
}