渗透测试，form对象类型转换，简单demo

最近公司的项目在的安全检测，涉及到项目安全渗透等方面的问题；

参与项目的渗透等改造，是一个机遇与挑战，今后对与项目安全等方面会思考更多；

下面说说form表单对象提交，为了防止抓包，后台做的类型转化；一个简单的DEMO思路

1、数据库对象bean，属相与数据库中字段相同，有Integer，Boolean，Double等类型

2、form表单的对象formbean，所有属性都是String

3、将formbean的值赋值到bean对象，在赋值过程中对数据的安全性（类型转化的问题）进行判断，

form对象

 package february.week1.safe;
 /**
  * Description: form表单的数据类型
  * @Package february.week1.safe
  * @author  BIQI IS BEST
  * @date    2018年2月5日 上午10:38:33
  */
 public class PersonForm {

     private String name;

     private String sex;

     private String age;

     private String phoneNumber;

     private String salary;

     public PersonForm(String name, String sex, String age, String phoneNumber, String salary) {
         super();
         this.name = name;
         this.sex = sex;
         this.age = age;
         this.phoneNumber = phoneNumber;
         this.salary = salary;
     }

     public PersonForm() {
         super();
     }

     public String getName() {
         return name;
     }

     public void setName(String name) {
         this.name = name;
     }

     public String getSex() {
         return sex;
     }

     public void setSex(String sex) {
         this.sex = sex;
     }

     public String getAge() {
         return age;
     }

     public void setAge(String age) {
         this.age = age;
     }

     public String getPhoneNumber() {
         return phoneNumber;
     }

     public void setPhoneNumber(String phoneNumber) {
         this.phoneNumber = phoneNumber;
     }

     public String getSalary() {
         return salary;
     }

     public void setSalary(String salary) {
         this.salary = salary;
     }

     @Override
     public String toString() {
         return "PersonForm [name=" + name + ", sex=" + sex + ", age=" + age + ", phoneNumber=" + phoneNumber
                 + ", salary=" + salary + "]";
     }

 }

后台对象：

 package february.week1.safe;
 /**
  * Description: 后台类型
  * @Package february.week1.safe
  * @author  BIQI IS BEST
  * @date    2018年2月5日 上午10:38:33
  */
 public class Person {

     private String name;

     private String sex;

     private Integer age;

     private String phoneNumber;

     private Double salary;

     public Person() {
         super();
     }

     public Person(String name, String sex, Integer age, String phoneNumber, Double salary) {
         super();
         this.name = name;
         this.sex = sex;
         this.age = age;
         this.phoneNumber = phoneNumber;
         this.salary = salary;
     }

     public String getName() {
         return name;
     }

     public void setName(String name) {
         this.name = name;
     }

     public String getSex() {
         return sex;
     }

     public void setSex(String sex) {
         this.sex = sex;
     }

     public Integer getAge() {
         return age;
     }

     public void setAge(Integer age) {
         this.age = age;
     }

     public String getPhoneNumber() {
         return phoneNumber;
     }

     public void setPhoneNumber(String phoneNumber) {
         this.phoneNumber = phoneNumber;
     }

     public Double getSalary() {
         return salary;
     }

     public void setSalary(Double salary) {
         this.salary = salary;
     }

     @Override
     public String toString() {
         return "Person [name=" + name + ", sex=" + sex + ", age=" + age + ", phoneNumber=" + phoneNumber + ", salary="
                 + salary + "]";
     }

 }

测试的类：

 package february.week1.safe;
 /**
  * Description: 转化字段的属性，并且捕获异常
  *                 form表单提交时候，数据类型不一致的问题，防止渗透
  * @Package february.week1.safe
  * @author  BIQI IS BEST
  * @date    2018年2月5日 上午10:38:33
  */

 import java.lang.reflect.Field;
 import java.lang.reflect.Method;
 import java.util.HashMap;
 import java.util.Map;

 public class ChangeFilterType {

     public static void main(String[] args) {
         PersonForm personForm = new PersonForm();
         personForm.setName("10");
         personForm.setSalary("1212123");
         personForm.setAge("qwe");
         Person person2 = new Person();
         changeFilter(personForm,person2);
     }

     private static boolean changeFilter(Object objectForm,Object object2){
         Map<String, String> map = getObjectFiled(objectForm);
         try {
             putValueToBean(map,object2);
         } catch (Exception e) {
             System.out.println(e.toString());
         }
         System.out.println(object2.toString());
         return false;
     }

     /**
      * Description: 获得属性的map,以及属性的值
      * @param bean
      * @return
      * @author  BIQI 2018年2月5日 下午2:22:31
      * @return  TreeMap<String,String>  @throws
      */
     private static Map<String, String> getObjectFiled(Object bean){
         Map<String, String> map = new HashMap<>(30);
         Field[] fields = bean.getClass().getDeclaredFields();
           for(Field field:fields){
 //              System.out.println(field.getName());
 //              System.out.println(field.getType().toString());
 //              System.out.println(getFieldValueByName(field.getName(),bean));
               map.put(field.getName(), (String) getFieldValueByName(field.getName(),bean));
           }
         return map;
     }

     /**
      * Description: 属性的值
      * @param fieldName
      * @param bean
      * @return
      * @author  BIQI 2018年2月5日 上午11:23:15
      * @return  Object  @throws
      */
     private static Object getFieldValueByName(String fieldName, Object bean) {
            try {
                String firstLetter = fieldName.substring(0, 1).toUpperCase();
                String getter = "get" + firstLetter + fieldName.substring(1);
                Method method = bean.getClass().getMethod(getter, new Class[] {});
                Object value = method.invoke(bean, new Object[] {});
                return value;
            } catch (Exception e) {
                return null;
            }
        }   

     /**
      * Description: 属性的转化 值的传入
      * @param treeMap
      * @param bean
      * @author  BIQI 2018年2月5日 上午11:55:52
      * @return  void  @throws
      * @throws Exception
      */
     public static void putValueToBean(Map<String, String> treeMap,Object bean) throws Exception{

         Field[] fields = bean.getClass().getDeclaredFields();
         // 属性的长度判断
         if (fields.length!= treeMap.size()) {
             System.out.println("转换的对象不对");
             throw new Exception("转换的对象不对");
         }

         for(Field field:fields){
             String fieldName = field.getName();
             String fieldValue = treeMap.get(fieldName);
             String firstLetter = fieldName.substring(0, 1).toUpperCase();
             String setter = "set" + firstLetter + fieldName.substring(1);  

             Method method = bean.getClass().getMethod(setter, field.getType());
             String type = field.getType().toString();
             try {
                 if ("class java.lang.String".equals(type)) {
                     method.invoke(bean,fieldValue);
                 }
                 if ("class java.lang.Integer".equals(type)) {
                     if (null == fieldValue || "".equals(fieldValue)) {
                         method.invoke(bean,0);
                         continue;
                     }
                     Integer temp = Integer.valueOf(fieldValue);
                     method.invoke(bean,temp);
                 }
                 if ("class java.lang.Double".equals(type)) {
                     if (null == fieldValue || "".equals(fieldValue)) {
                         method.invoke(bean,0);
                         continue;
                     }
                     Double temp = Double.valueOf(fieldValue);
                     method.invoke(bean,temp);
                 }
                 //其他的类型if(....){}
             } catch (Exception e) {
                 throw new Exception("转换("+bean.getClass().getName()+")的属性："+fieldName+" 值"+fieldValue+" 出现问题");
             }
         }
     }

 }