渗透测试，form对象类型转换，demo

最近公司的项目在的安全检测，涉及到项目安全渗透等方面的问题；

参与项目的渗透等改造，是一个机遇与挑战，今后对与项目安全等方面会思考更多；

下面说说form表单对象提交，为了防止抓包，后台做的类型转化；一个简单的DEMO思路

1、数据库对象bean，属相与数据库中字段相同，有Integer，Boolean，Double等类型

2、form表单的对象formbean，所有属性都是String

3、将formbean的值赋值到bean对象，在赋值过程中对数据的安全性（类型转化的问题）进行判断，

form对象

package february.week1.safe;
/**   
 * Description: form表单的数据类型
 * @Package february.week1.safe 
 * @author  BIQI IS BEST   
 * @date    2018年2月5日 上午10:38:33 
 */
public class PersonForm {
    
    private String name;
    
    private String sex;
    
    private String age;
    
    private String phoneNumber;
    
    private String salary;

    public PersonForm(String name, String sex, String age, String phoneNumber, String salary) {
        super();
        this.name = name;
        this.sex = sex;
        this.age = age;
        this.phoneNumber = phoneNumber;
        this.salary = salary;
    }

    public PersonForm() {
        super();
    }
    
    
    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    public String getSex() {
        return sex;
    }

    public void setSex(String sex) {
        this.sex = sex;
    }

    public String getAge() {
        return age;
    }

    public void setAge(String age) {
        this.age = age;
    }

    public String getPhoneNumber() {
        return phoneNumber;
    }

    public void setPhoneNumber(String phoneNumber) {
        this.phoneNumber = phoneNumber;
    }

    public String getSalary() {
        return salary;
    }

    public void setSalary(String salary) {
        this.salary = salary;
    }

    @Override
    public String toString() {
        return "PersonForm [name=" + name + ", sex=" + sex + ", age=" + age + ", phoneNumber=" + phoneNumber
                + ", salary=" + salary + "]";
    }
    
}

后台对象：

package february.week1.safe;
/**   
 * Description: 后台类型
 * @Package february.week1.safe 
 * @author  BIQI IS BEST   
 * @date    2018年2月5日 上午10:38:33 
 */
public class Person {
    
    private String name;
    
    private String sex;
    
    private Integer age;
    
    private String phoneNumber;
    
    private Double salary;

    public Person() {
        super();
    }

    public Person(String name, String sex, Integer age, String phoneNumber, Double salary) {
        super();
        this.name = name;
        this.sex = sex;
        this.age = age;
        this.phoneNumber = phoneNumber;
        this.salary = salary;
    }

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    public String getSex() {
        return sex;
    }

    public void setSex(String sex) {
        this.sex = sex;
    }

    public Integer getAge() {
        return age;
    }

    public void setAge(Integer age) {
        this.age = age;
    }

    public String getPhoneNumber() {
        return phoneNumber;
    }

    public void setPhoneNumber(String phoneNumber) {
        this.phoneNumber = phoneNumber;
    }

    public Double getSalary() {
        return salary;
    }

    public void setSalary(Double salary) {
        this.salary = salary;
    }

    @Override
    public String toString() {
        return "Person [name=" + name + ", sex=" + sex + ", age=" + age + ", phoneNumber=" + phoneNumber + ", salary="
                + salary + "]";
    }
    
    
    
}

测试的类：

package february.week1.safe;
/**   
 * Description: 转化字段的属性，并且捕获异常
 *                 form表单提交时候，数据类型不一致的问题，防止渗透
 * @Package february.week1.safe 
 * @author  BIQI IS BEST   
 * @date    2018年2月5日 上午10:38:33 
 */

import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.util.HashMap;
import java.util.Map;

public class ChangeFilterType {
    
    public static void main(String[] args) {
        PersonForm personForm = new PersonForm();
        personForm.setName("10");
        personForm.setSalary("1212123");
        personForm.setAge("qwe");
        Person person2 = new Person();
        changeFilter(personForm,person2);
    }
    
    private static boolean changeFilter(Object objectForm,Object object2){
        Map<String, String> map = getObjectFiled(objectForm);
        try {
            putValueToBean(map,object2);
        } catch (Exception e) {
            System.out.println(e.toString());
        }
        System.out.println(object2.toString());
        return false;
    }
    
    
    /** 
     * Description: 获得属性的map,以及属性的值
     * @param bean
     * @return
     * @author  BIQI 2018年2月5日 下午2:22:31
     * @return  TreeMap<String,String>  @throws  
     */
    private static Map<String, String> getObjectFiled(Object bean){
        Map<String, String> map = new HashMap<>(30);
        Field[] fields = bean.getClass().getDeclaredFields();
          for(Field field:fields){
//              System.out.println(field.getName());
//              System.out.println(field.getType().toString());
//              System.out.println(getFieldValueByName(field.getName(),bean));
              map.put(field.getName(), (String) getFieldValueByName(field.getName(),bean));
          }
        return map;
    }
    
    /** 
     * Description: 属性的值
     * @param fieldName
     * @param bean
     * @return
     * @author  BIQI 2018年2月5日 上午11:23:15
     * @return  Object  @throws  
     */
    private static Object getFieldValueByName(String fieldName, Object bean) {  
           try {    
               String firstLetter = fieldName.substring(0, 1).toUpperCase();    
               String getter = "get" + firstLetter + fieldName.substring(1);  
               Method method = bean.getClass().getMethod(getter, new Class[] {});    
               Object value = method.invoke(bean, new Object[] {});    
               return value;    
           } catch (Exception e) {    
               return null;    
           }    
       }   
    
    /** 
     * Description: 属性的转化 值的传入
     * @param treeMap
     * @param bean
     * @author  BIQI 2018年2月5日 上午11:55:52
     * @return  void  @throws  
     * @throws Exception 
     */
    public static void putValueToBean(Map<String, String> treeMap,Object bean) throws Exception{
        
        Field[] fields = bean.getClass().getDeclaredFields();
        // 属性的长度判断
        if (fields.length!= treeMap.size()) {
            System.out.println("转换的对象不对");
            throw new Exception("转换的对象不对");
        }
    
        for(Field field:fields){
            String fieldName = field.getName();
            String fieldValue = treeMap.get(fieldName);
            String firstLetter = fieldName.substring(0, 1).toUpperCase();    
            String setter = "set" + firstLetter + fieldName.substring(1);  
            
            Method method = bean.getClass().getMethod(setter, field.getType());
            String type = field.getType().toString();
            try {
                if ("class java.lang.String".equals(type)) {
                    method.invoke(bean,fieldValue);
                }
                if ("class java.lang.Integer".equals(type)) {
                    if (null == fieldValue || "".equals(fieldValue)) {
                        method.invoke(bean,0);
                        continue;
                    }
                    Integer temp = Integer.valueOf(fieldValue);
                    method.invoke(bean,temp);
                }
                if ("class java.lang.Double".equals(type)) {
                    if (null == fieldValue || "".equals(fieldValue)) {
                        method.invoke(bean,0);
                        continue;
                    }
                    Double temp = Double.valueOf(fieldValue);
                    method.invoke(bean,temp);
                }
                //其他的类型if(....){}
            } catch (Exception e) {
                throw new Exception("转换("+bean.getClass().getName()+")的属性："+fieldName+" 值"+fieldValue+" 出现问题");
            }
        }
    }

    
}