javascript - 阻止 URL 漏洞

Question

在我的应用程序中，我们有许多用户，他们都与不同的调用中心相关。在 URL 中，有一个向后的 hack，他们可以在 ? 后面输入 call_center=number。它将引导他们进入不同的调用中心数据页面。切断这种可能性的最佳方法是什么？如果他们尝试编辑 URL，我想将他们重定向到他们所在的当前页面。我应该用什么方法来修复这个漏洞？

Dash.js

checkLockSave();
        var month = $('div.top').attr('data-month');
        var sellertype = $('div.top').attr('data-sellertype'); 
        var call_center = $('div.top').attr('data-callcenter');
        var full_call_center = $('#cancel-full-chart').attr('data-callcenter');
        var forecast_url = call_center ==='' ? "/forecast/data" : "/forecast/data?call_center="+call_center;
        var cancel_url = call_center === '' ? "/contracts/cancelpercent" : "/contracts/cancelpercent?call_center="+call_center;
        var cancel_full_url = full_call_center === '' ? "/contracts/cancelpercentfull" : "/contracts/cancelpercentfull?call_center="+full_call_center;
        var contract_status_url = call_center === '' ? "/contracts/contractstatus" : "/contracts/contractstatus?call_center="+call_center;


        if (sellertype && sellertype.length >= 0) {
            if (contract_status_url.indexOf('?') >= 0) {
                contract_status_url = contract_status_url + "&sellertype=" + sellertype;
            }
            else {
                contract_status_url = sellertype === '' ? "/contracts/contractstatus" : "/contracts/contractstatus?sellertype="+ sellertype;
            }
        }

        if (month && month.length >= 0) {
            if (contract_status_url.indexOf('?') >= 0) {
                contract_status_url = contract_status_url + "&month=" + month;
            }
            else {
                contract_status_url = month === '' ? "/contracts/contractstatus" : "/contracts/contractstatus?month="+ month;
            }
        }
        $('select.sellertype_select').on('change', function(){
            base_url = $('.service-container').data('base_url');
           // window.location.href = base_url+"/?month="+$(this).val();
            if ($(this).val() == "call_center") {
                newUrl = urlBuilder("sellertype", null);
            } else {
                newUrl = urlBuilder("sellertype", $(this).val());
            }
            window.location.href = newUrl;
        });


        $('select.company_select').on('change', function(){
             base_url = $('.service-container').data('base_url');
            // window.location.href = base_url+"/?call_center="+$(this).val();
            var newUrl = window.location.href;
            if ($(this).val() == "call_center_0") {
                newUrl = urlBuilder("call_center", null);
            } else {
                newUrl = urlBuilder("call_center", $(this).val());
            }
            window.location.href = newUrl;
        });


        $('select.month_select').on('change', function(){
            base_url = $('.service-container').data('base_url');
           // window.location.href = base_url+"/?month="+$(this).val();
            if ($(this).val() == "twentyfour") {
                newUrl = urlBuilder("month", null);
            } else {
                newUrl = urlBuilder("month", $(this).val());
            }
            window.location.href = newUrl;
        });
                //function url builder add or update query param with specified query param value
                function urlBuilder(param, paramValue){
                    base_url = $('.service-container').data('base_url');
                    var fullurl = window.location.href;
                    var urlStart = fullurl.split("?").length > 1 ? fullurl.split("?")[0] : null;
                    var urlQuery = fullurl.split("?").length > 1 ? fullurl.split("?")[1] : null;

                    if (urlQuery) {
                        var queryParts = urlQuery.split('&');
                        var len = queryParts.length;
                        var removeAt = -1;
                        var paramFound = false;
                        for (var i = 0; i < len; i++)
                        {
                            console.debug('query part: ', queryParts[i]);
                            skip = false;
                            if (queryParts[i].startsWith(param)) {
                                paramFound = true;
                                if (!paramValue) {
                                   removeAt = i;
                                } else {
                                    queryParts[i] = param + "=" + paramValue;
                                }
                            }
                        }

                        if (!paramFound) {
                            queryParts.push(param + "=" + paramValue);
                        }

                        if (removeAt >= 0) {
                            queryParts.splice(removeAt, 1);
                        }

                        var rtnUrl = urlStart + "?" + queryParts.join("&");
                        console.log('rtnUrl', rtnUrl);
                        return rtnUrl;
                    } else {
                        return base_url + '?' + param + '=' + paramValue;
                    }
                }

DashboardController.php

     $input = Input::all();

        $user_id = Auth::user()->id;
        $role_id = User::UserRoleData()->where('user_id', '=', $user_id)->first();
        $call_center = Auth::user()->call_center;
        $call_center = ($call_center == null ? '' : $call_center);
        $call_center = !empty($input['call_center']) ? $input['call_center'] : $call_center;
        $month = !empty($input['month']) ? $input['month'] : 'twentyfour';
        $sellertype = !empty($input['sellertype']) ? $input['sellertype'] : 'seller';
        $companies = Company::DistinctCompanies()->orderby('name')->get();
        $date = date('Y-m-d', strtotime('now -24 months'));
if($sellertype == 'dealership')
        {
        $pending->where("type", "=", 'dealership');
        $active->where("type", "=", 'dealership');
        $cancelled_contracts->where("type", "=", 'dealership');
        $late_contracts->where("type", "=", 'dealership');
        $back_out_contracts->where("type", "=", 'dealership');
        $pending_late->where("type", "=", 'dealership');
        $pending_cancellation->where("type", "=", 'dealership');
        }

        if($month == 'twentyfour' || $month != 'all')
        {
            $pending->where("sold_date", ">=", $date);
            $active->where("sold_date", ">=", $date);
            $cancelled_contracts->where("sold_date", ">=", $date);
            $late_contracts->where("sold_date", ">=", $date);
            $back_out_contracts->where("sold_date", ">=", $date);
            $pending_late->where("sold_date", ">=", $date);
            $pending_cancellation->where("sold_date", ">=", $date);
        }
 if($role_id['id'] == '5' || $role_id['id'] == '6' || $role_id['id'] == '7' || $role_id['id'] == '8' || $role_id['id'] == '9' || $role_id['id'] == '10')
        {
            {
                $pending->where('contracts.call_center', '=', $call_center);
                $active->where('contracts.call_center', '=', $call_center);
                $cancelled_contracts->where('contracts.call_center', '=', $call_center);
                $late_contracts->where('contracts.call_center', '=', $call_center);
                $back_out_contracts->where('contracts.call_center', '=', $call_center);
                $pending_late->where('contracts.call_center', '=', $call_center);
                $pending_cancellation->where('contracts.call_center', '=', $call_center);
            }
        }
        else
        {
            if($role_id['id'] == '2' && !empty($input['call_center']))
            {
                $call_center = $input['call_center'];
                {
                    $pending->where('contracts.call_center', '=', $call_center);
                    $active->where('contracts.call_center', '=', $call_center);
                    $cancelled_contracts->where('contracts.call_center', '=', $call_center);
                    $late_contracts->where('contracts.call_center', '=', $call_center);
                    $back_out_contracts->where('contracts.call_center', '=', $call_center);
                    $pending_late->where('contracts.call_center', '=', $call_center);
                    $pending_cancellation->where('contracts.call_center', '=', $call_center);
                }
            }
        }


        $pending = $pending->get()->first();
        $active = $active->get()->first();
        $cancelled_contracts = $cancelled_contracts->get()->first();
        $late_contracts = $late_contracts->get()->first();
        $back_out_contracts = $back_out_contracts->get()->first();
        $pending_late = $pending_late->get()->first();
        $pending_cancellation = $pending_cancellation->get()->first();


        View::share('active_nav', 'Dashboard');
        return view('dash.dash')
            ->with('pending_contracts', number_format($pending->total))
            ->with('month', $month)
            ->with('sellertype', $sellertype)
            ->with('active', number_format($active->total))
            ->with('companies', $companies)
            ->with('call_center', $call_center)
            ->with('year', date("Y"))
            ->with('cancelled_contracts', number_format($cancelled_contracts->total))
            ->with('late_contracts', number_format($late_contracts->total))
            ->with('back_out_contracts', number_format($back_out_contracts->total))
            ->with('pending_late', number_format($pending_late->total))
            ->with('pending_cancellation', number_format($pending_cancellation->total));

Answer 1

有 3 种方法可以解决这个问题，我能立即想到。

第一

为您的调用中心提供一个非连续数字的随机或半随机值​​。这样，人们就更难从调用中心 2 转到调用中心 3。如果他们有时间找出调用中心 3RG5，那么他们的空闲时间就会比等待时间多，除非他们建立开始尝试不同组合的脚本。那时，可能很容易发现他们的尝试，并且可能会向他们加载的下一页添加一条消息，例如锁定消息或他们在那一分钟内尝试了太多次。

第二个

如果您要在网站内POST导航，请使用正文而不是 URL。

PHP 获取 POST 的正文:

# Get JSON as a string
$json_str = file_get_contents('php://input');

# Get as an object
$json_obj = json_decode($json_str);

https://davidwalsh.name/php-json

使用 POST 正文进行 AJAX 调用的 JavaScript:

var xhr = new XMLHttpRequest();
  xhr.open(form.method, form.action, true);
  xhr.setRequestHeader('Content-Type', 'application/json; charset=UTF-8');

  // send the collected data as JSON
  xhr.send(JSON.stringify(data));  // This is the body of the POST

  xhr.onloadend = function () {
    // done
};

POST data in JSON format

用户仍然可以伪造这一点，但它涉及更多，并且不太可能是“任何人”都会这样做。

第三

通过验证用户(如果是登录用户)来确保用户有权访问该页面。如果他们尚未登录，则返回其他 2 个选项。