azure - 如何防止Azure表注入(inject)？

Question

有没有通用的方法来防止azure存储注入(inject)。

如果查询包含用户输入的字符串，例如他的姓名。然后可以进行一些注入(inject)，例如:jan + ' 或 PartitionKey eq 'kees。这将得到一个对象 jan 和一个带有partitionKey kees的对象。

一个选项是 URLEncoding。在这种情况下 ' 和 "被编码。并且上述注入(inject)不再可能。

这是最好的选择还是有更好的选择？

Answer 1

根据我的经验，我意识到有两种通用方法可以防止 azure 存储表注入(inject)。一种是将字符串 ' 替换为其他字符串，例如 ; , "或 URLEncode 字符串 '。这是您的选择。另一种是使用编码格式(例如Base64)而不是明文内容来存储表 key 。

这是我的测试Java程序，如下:

import org.apache.commons.codec.binary.Base64;

import com.microsoft.azure.storage.CloudStorageAccount;
import com.microsoft.azure.storage.table.CloudTable;
import com.microsoft.azure.storage.table.CloudTableClient;
import com.microsoft.azure.storage.table.TableOperation;
import com.microsoft.azure.storage.table.TableQuery;
import com.microsoft.azure.storage.table.TableQuery.QueryComparisons;

public class TableInjectTest {

    private static final String storageConnectString = "DefaultEndpointsProtocol=http;" + "AccountName=<ACCOUNT_NAME>;"
            + "AccountKey=<ACCOUNT_KEY>";

    public static void reproduce(String query) {
        try {
            CloudStorageAccount storageAccount = CloudStorageAccount.parse(storageConnectString);
            CloudTableClient tableClient = storageAccount.createCloudTableClient();
            // Create table if not exist.
            String tableName = "people";
            CloudTable cloudTable = new CloudTable(tableName, tableClient);
            final String PARTITION_KEY = "PartitionKey";
            String partitionFilter = TableQuery.generateFilterCondition(PARTITION_KEY, QueryComparisons.EQUAL, query);
            System.out.println(partitionFilter);
            TableQuery<CustomerEntity> rangeQuery = TableQuery.from(CustomerEntity.class).where(partitionFilter);
            for (CustomerEntity entity : cloudTable.execute(rangeQuery)) {
                System.out.println(entity.getPartitionKey() + " " + entity.getRowKey() + "\t" + entity.getEmail() + "\t"
                        + entity.getPhoneNumber());
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    /*
     * The one way is replace ' with other symbol string
     */
    public static String preventByReplace(String query, String symbol) {
        return query.replaceAll("'", symbol);
    }

    public static void addEntityByBase64PartitionKey() {
        try {
            CloudStorageAccount storageAccount = CloudStorageAccount.parse(storageConnectString);
            CloudTableClient tableClient = storageAccount.createCloudTableClient();
            // Create table if not exist.
            String tableName = "people";
            CloudTable cloudTable = new CloudTable(tableName, tableClient);
            String partitionKey = Base64.encodeBase64String("Smith".getBytes());
            CustomerEntity customer = new CustomerEntity(partitionKey, "Will");
            customer.setEmail("<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="88ffe1e4e4a5fbe5e1fce0c8ebe7e6fce7fbe7a6ebe7e5" rel="noreferrer noopener nofollow">[email protected]</a>");
            customer.setPhoneNumber("400800600");
            TableOperation insertCustomer = TableOperation.insertOrReplace(customer);
            cloudTable.execute(insertCustomer);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    // The other way is store PartitionKey using encoding format such as Base64
    public static String preventByEncodeBase64(String query) {
        return Base64.encodeBase64String(query.getBytes());
    }

    public static void main(String[] args) {
        String queryNormal = "Smith";
        reproduce(queryNormal);
        /*
         * Output as follows:
         * PartitionKey eq 'Smith'
         * Smith Ben    <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="0446616a44676b6a706b776b2a676b69" rel="noreferrer noopener nofollow">[email protected]</a> 425-555-0102
         * Smith Denise <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="7d391813140e183d1e121309120e12531e1210" rel="noreferrer noopener nofollow">[email protected]</a>  425-555-0103
         * Smith Jeff   <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="ca80afacac8aa9a5a4bea5b9a5e4a9a5a7" rel="noreferrer noopener nofollow">[email protected]</a>    425-555-0105
         */
        String queryInjection = "Smith' or PartitionKey lt 'Z";
        reproduce(queryInjection);
        /*
         * Output as follows:
         * PartitionKey eq 'Smith' or PartitionKey lt 'Z'
         * Webber Peter <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="d787b2a3b2a597b4b8b9a3b8a4b8f9b4b8ba" rel="noreferrer noopener nofollow">[email protected]</a>   425-555-0101             <= This is my information
         * Smith Ben    <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="91d3f4ffd1f2feffe5fee2febff2fefc" rel="noreferrer noopener nofollow">[email protected]</a> 425-555-0102
         * Smith Denise <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="a0e4c5cec9d3c5e0c3cfced4cfd3cf8ec3cfcd" rel="noreferrer noopener nofollow">[email protected]</a>  425-555-0103
         * Smith Jeff   <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="d59fb0b3b395b6babba1baa6bafbb6bab8" rel="noreferrer noopener nofollow">[email protected]</a>    425-555-0105
         */
        reproduce(preventByReplace(queryNormal, "\"")); // The result same as queryNormal
        reproduce(preventByReplace(queryInjection, "\"")); // None result, because the query string is """PartitionKey eq 'Smith" or PartitionKey lt "Z'"""
        reproduce(preventByReplace(queryNormal, "&")); // The result same as queryNormal
        reproduce(preventByReplace(queryInjection, "&")); // None result, because the query string is """PartitionKey eq 'Smith& or PartitionKey lt &Z'"""
        /*
         * The second prevent way
         */
        addEntityByBase64PartitionKey(); // Will Smith
        reproduce(preventByEncodeBase64(queryNormal));
        /*
         * Output as follows:
         * PartitionKey eq 'U21pdGg='
         * U21pdGg= Will    <a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="0f78666363227c62667b674f6c60617b607c60216c6062" rel="noreferrer noopener nofollow">[email protected]</a>  400800600     <= The Base64 string can be decoded to "Smith"
         */
        reproduce(preventByEncodeBase64(queryInjection)); //None result
        /*
         * Output as follows:
         * PartitionKey eq 'U21pdGgnIG9yIFBhcnRpdGlvbktleSBsdCAnWg=='
         */
    }

}

我认为最好的选择是根据应用场景选择合适的方式来防止查询注入(inject)。

如有任何疑问，请随时告诉我。