jsp后台管理系统漏洞

String sql = "SELECT * FROM users WHERE username = ?";
PreparedStatement pstmt = connection.prepareStatement(sql);
pstmt.setString(1, username);
ResultSet rs = pstmt.executeQuery();

public String escapeHtml(String input) {
    return input.replaceAll("&", "&")
                .replaceAll("<", "&lt;")
                .replaceAll(">", "&gt;")
                .replaceAll("\"", "&quot;")
                .replaceAll("'", "&#x27;")
                .replaceAll("/", "&#x2F;");
}

// 在用户会话中生成并存储CSRF令牌
HttpSession session = request.getSession();
session.setAttribute("csrfToken", generateCsrfToken());

// 在表单中包含CSRF令牌
<input type="hidden" name="csrfToken" value="${sessionScope.csrfToken}">

// 验证CSRF令牌
String requestCsrfToken = request.getParameter("csrfToken");
if (!requestCsrfToken.equals(session.getAttribute("csrfToken"))) {
    throw new SecurityException("Invalid CSRF token");
}

// 检查文件类型和大小
if (!file.getContentType().equals("image/jpeg")) {
    throw new IllegalArgumentException("Invalid file type");
}
if (file.getSize() > MAX_FILE_SIZE) {
    throw new IllegalArgumentException("File size exceeds limit");
}

// 存储文件到安全目录
String safePath = "/secure/uploads/" + UUID.randomUUID().toString();
file.transferTo(new File(safePath));