转载

SpringMvc xss (CVE-2014-1904)学习与分析

介绍

https://pivotal.io/cn/security/cve-2014-1904 根据漏洞描述： SpringMvc xss (CVE-2014-1904)学习与分析

内容

可以知道需要用form标签，选择3.2.8版本以前的spring-mvc。然后写了一个demo,代码如下:

bean

````
package net.codersec.entity;

public String getUsername() {
    return username;
}

public void setUsername(String username) {
    this.username = username;
}

public String getPassword() {
    return password;
}

public void setPassword(String password) {
    this.password = password;
}
}
````

controller

````
package net.codersec.controller;

import net.codersec.entity.User;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;

/**
 * Created by bsmali4 on 18/1/25.
 */
@Controller
public class UseController {

    @RequestMapping(value = "/login/*")
    public String login(Model model){
        model.addAttribute("user", new User());
        return "login";
    }

}

````

其中标签需要绑定一个bean，其在form的commandName属性绑定

```
	  <%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
<html>
<body>
<h2>Hello,welcome to CVE-2014-1904!</h2>
<form:form method="post" commandName="user">
    <form:input path="username"/>
    <form:input path="password"/>
    <input type="submit" value="login"/>

</form:form>

</body>
</html>

````

这里需要说明一个特性，在form:form中未设置action的时候，spring-mvc会自动将当前url设置为action,比如 SpringMvc xss (CVE-2014-1904)学习与分析