网络安全

1. Web 安全攻击与防御

1.1 XSS (跨站脚本攻击)

反射型 XSS

// 攻击示例
http://example.com/search?q=<script>alert('XSS')</script>

// 防御方法
function escapeHtml(str) {
  return str.replace(/[&<>"']/g, function(match) {
    const escape = {
      '&': '&amp;',
      '<': '&lt;',
      '>': '&gt;',
      '"': '&quot;',
      "'": '&#39;'
    };
    return escape[match];
  });
}

存储型 XSS

// 攻击示例
const comment = '<img src="x" onerror="alert(document.cookie)">';

// 防御方法
// 1. 输入过滤
const sanitize = require('xss');
const safeComment = sanitize(comment);

// 2. CSP 策略
Content-Security-Policy: default-src 'self'

DOM型 XSS

// 攻击示例
location.hash = '<script>alert(1)</script>';
document.write(location.hash.substring(1));

// 防御方法
// 1. 避免使用 innerHTML、document.write
element.textContent = userInput;

// 2. 使用 DOMPurify
import DOMPurify from 'dompurify';
const clean = DOMPurify.sanitize(dirty);

1.2 CSRF (跨站请求伪造)

攻击原理

<!-- 攻击示例 -->
<form action="http://bank.com/transfer" method="POST">
  <input type="hidden" name="account" value="hacker"/>
  <input type="hidden" name="amount" value="10000"/>
</form>
<script>document.forms[0].submit();</script>

防御方法

// 1. Token 验证
const csrfToken = generateToken();
// 在表单中添加 token
<input type="hidden" name="_csrf" value="${csrfToken}">

// 2. 验证 Referer
app.use((req, res, next) => {
  const referer = req.headers.referer;
  if (isValidReferer(referer)) {
    next();
  } else {
    res.status(403).send('Invalid referer');
  }
});

// 3. SameSite Cookie
Set-Cookie: session=123; SameSite=Strict

1.3 SQL 注入

攻击示例

-- 1. 基本注入
SELECT * FROM users WHERE username = 'admin' OR '1'='1'

-- 2. 联合查询注入
SELECT * FROM users WHERE id = '1' UNION SELECT username,password FROM admin--'

-- 3. 时间盲注
SELECT * FROM users WHERE id = '1' AND IF(SUBSTR(database(),1,1)='a',SLEEP(5),0)

防御方法

// 1. 参数化查询
const sql = 'SELECT * FROM users WHERE id = ?';
connection.query(sql, [userId]);

// 2. ORM
const user = await User.findOne({
  where: { id: userId }
});

// 3. 输入验证
function validateUserId(id) {
  return /^\d+$/.test(id);
}

2. 加密技术

2.1 对称加密

// AES 加密示例
const crypto = require('crypto');

function encrypt(text, key) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
  
  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  
  const authTag = cipher.getAuthTag();
  
  return {
    iv: iv.toString('hex'),
    encrypted,
    authTag: authTag.toString('hex')
  };
}

function decrypt(encrypted, key, iv, authTag) {
  const decipher = crypto.createDecipheriv('aes-256-gcm', key, Buffer.from(iv, 'hex'));
  decipher.setAuthTag(Buffer.from(authTag, 'hex'));
  
  let decrypted = decipher.update(encrypted, 'hex', 'utf8');
  decrypted += decipher.final('utf8');
  
  return decrypted;
}

2.2 非对称加密

// RSA 加密示例
const crypto = require('crypto');

// 生成密钥对
const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem'
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem'
  }
});

// 加密
function encrypt(text, publicKey) {
  const encrypted = crypto.publicEncrypt(
    publicKey,
    Buffer.from(text)
  );
  return encrypted.toString('base64');
}

// 解密
function decrypt(encrypted, privateKey) {
  const decrypted = crypto.privateDecrypt(
    privateKey,
    Buffer.from(encrypted, 'base64')
  );
  return decrypted.toString('utf8');
}

2.3 哈希算法

// 密码哈希示例
const crypto = require('crypto');

// 使用 PBKDF2
async function hashPassword(password) {
  const salt = crypto.randomBytes(16);
  const iterations = 100000;
  const keylen = 64;
  
  return new Promise((resolve, reject) => {
    crypto.pbkdf2(password, salt, iterations, keylen, 'sha512', (err, derivedKey) => {
      if (err) reject(err);
      resolve({
        hash: derivedKey.toString('hex'),
        salt: salt.toString('hex'),
        iterations
      });
    });
  });
}

// 验证密码
async function verifyPassword(password, hash, salt, iterations) {
  return new Promise((resolve, reject) => {
    crypto.pbkdf2(password, Buffer.from(salt, 'hex'), iterations, 64, 'sha512', (err, derivedKey) => {
      if (err) reject(err);
      resolve(derivedKey.toString('hex') === hash);
    });
  });
}

3. 网络攻击防御

3.1 DDoS 防御

// 速率限制中间件
const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15分钟
  max: 100 // 限制每个IP 100个请求
});

app.use(limiter);

3.2 WAF 配置

# Nginx WAF 配置示例
http {
  # 限制请求大小
  client_max_body_size 10m;
  
  # 限制连接数
  limit_conn_zone $binary_remote_addr zone=addr:10m;
  limit_conn addr 100;
  
  # 防止 SQL 注入
  if ($request_uri ~* ".*[;'<>].*") {
    return 403;
  }
  
  # 禁止特定 User-Agent
  if ($http_user_agent ~* (Wget|Curl)) {
    return 403;
  }
}