Question

我有一个JSP页面，其中包含指向GET http谓词的所有页面链接。我已使用安全扫描，但发现无法解决的问题之一。

这是下一页代码中导航的链接 GET / olwb / forgine / gteeseleion2.do？muid = 600

我在GET请求或Set-Cookie标头的查询字符串中找到了侵犯隐私的用户名。未知的应用程序测试旨在发现自定义和商业软件中的新漏洞。因此，没有特定的补丁程序或此问题的说明。

将登录信息保留在查询字符串或cookie值中，使攻击者可以轻松查看和篡改登录值。让开发人员或安全管理员检查此问题。建议包括确保登录信息是通过加密连接通过POST请求发送，并且敏感帐户信息保留在服务器上。

这是下面的代码

            def receive: Receive = {
        case GetMalletOutput(malletFile) => createMalletResult(malletFile).pipeTo(sender())
    }


          def createMalletResult(malletFile: String): Future[MalletModel] = {

            //sample malletResult
            val topics = Array(Topic("1", "2").toJson)
            var mM: Future[MalletModel] = Future{MalletModel("contentID", topics)}


            //first Future to save file in resource
            def saveFile(malletFile: String): Future[String] = Future {

                val res = MalletResult(malletFile)
                val converted = res.Score.parseJson.convertTo[MalletRepo]
                val fileName = converted.ContentId
                val fileTemp = new File("src/main/resources/new_corpus/" + fileName)

                val output = new BufferedWriter(new FileWriter("src/main/resources/new_corpus/" + fileName))
                output.write(converted.ContentText)
                //output.close()
                malletFile
              }

//Second Future to used the resource file and create new one
            def t2v(malletFile: String): Future[String] = Future{
              val tmpDir = "src/main/resources/"

              logger.debug(tmpDir.toString)

              logger.debug("t2v Started")
              Text2Vectors.main(("--input " + tmpDir + "new_corpus/ --keep-sequence --remove-stopwords " + "--output " + tmpDir + "new_corpus.mallet --use-pipe-from " + tmpDir + "corpus.mallet").split(" "))
              logger.debug("text2Vector Completed")
              malletFile
            }
        //another future to take file from resource and save in the new file back in resource
            def infer(malletFile: String): Future[String] = Future {
              val tmpDir = "src/main/resources/"
              val tmpDirNew = "src/main/resources/inferResult/"
              logger.debug("infer started")
              InferTopics.main(("--input " + tmpDir + "new_corpus.mallet --inferencer " + tmpDir + "inferencer " + "--output-doc-topics " + tmpDirNew + "doc-topics-new.txt --num-iterations 1000").split(" "))
              logger.debug("infer Completed")
              malletFile
            }

//final future to return the requested output using the saved future
            def response(malletFile: String): Future[MalletModel] = Future{
              logger.debug("response Started")

              val lines = Source.fromResource("src/main/resources/inferResult/doc-topics-new.txt")
                .getLines
                .toList
                .drop(1) match {
                case Nil => List.empty
                case x :: xs => x.split(" ").drop(2).mkString(" ") :: xs
              }

              logger.debug("response On")
              val result = MalletResult(malletFile)
              val convert = result.Score.parseJson.convertTo[MalletRepo]
              val contentID = convert.ContentId

              val inFile = lines.mkString(" ")


              val a = inFile.split(" ").zipWithIndex.collect { case (v, i) if (i % 2 == 0) =>
                (v, i)
              }.map(_._1)
              val b = inFile.split(" ").zipWithIndex.collect { case (v, i) if (i % 2 != 0) =>
                (v, i)
              }.map(_._1)
              val paired = a.zip(b) // [(s,t),(s,t)]

              val topics = paired.map(x => Topic(x._2, x._1).toJson)

              logger.debug("validating")
              logger.debug("mallet results...")
              logger.debug("response Done")
              MalletModel(contentID, topics)

            }

//calling one future after another to run future sequntially
            val result: Future[MalletModel] =
              saveFile(malletFile).flatMap(malletFile =>
                          t2v(malletFile).flatMap(mf =>
                            infer(mf).flatMap(mf =>
                            response(mf))))

            result
            }

          }

我需要拆分menuid并使用一些功能并在不更改链接的情况下撰写帖子

中级问题隐私冲突HTTP GET

0 个答案: