Java Web应用的安全性分析及对策  

An Analysis of and Solution to the Security of Java Web Applications

作　　者：王一兵[1] 

机构地区：[1]安徽理工大学网络信息中心,安徽232001

出　　处：《网络安全技术与应用》2005年第5期21-23,20,共4页Network Security Technology & Application

摘　　要：本文分析了JavaWeb应用中可能存在的安全隐患,给出了JavaWeb应用中系统资源的保护措施,并提出在浏览器与服务器交互的过程中,根据客户端向服务器请求的方法、表单控件所提交数据的表示形式,利用J2SE中java.util.regex类库,通过正则表达式对提交的数据过滤、分析。根据对用户请求方法和提交数据的表示形式的预计进行安全评估,依据评估的结果再进行相应的处理,从而提高JavaWeb应用的安全性。In this article an analysis is made of the existing security concerns in Java Web applications, and a method is provided to protect the system resources of the applications. Proposed is also an idea to filter and analyze, by using java.util.regex class libraries and regular expressions, the data submitted according to the petition from the client-side to the server and the expressions of the data submitted by the form during the interaction between the browser and the server. A suggestion is put forward at the end of the article that evaluation of the security is conducted according to the petition and the prediction of the expressions and treatment is performed on the basis of the results of the evaluation. In this way, the security of Java Web applications will be enhanced.

关 键 词：Web应用 JAVA 安全性分析 表示形式 正则表达式 安全隐患 保护措施 系统资源 表单控件 JAVA J2SE 数据过滤 安全评估 用户请求 服务器 浏览器 客户端 交互 类库 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]