架构经验总结：2 月薪3万的安全工程师，都在用这些免费工具！

// 一、XSS防御体系 
@ControllerAdvice 
public class XssDefender {
    @InitBinder 
    public void initBinder(WebDataBinder binder) {
        binder.registerCustomEditor(String.class,  
        new StringEscapeEditor(true, true));
    }
}

// 二、SQL注入防护 
public interface UserMapper {
    @Select("SELECT * FROM users WHERE username=#{username} 
    AND password=#{password}")
    User authenticate(@Param("username") String username,
     @Param("password") String password);
}

@Service 
public class AuthService {
    @Autowired private UserMapper userMapper;

    public User login(String username, String password) {
        validateInput(username);
        validateInput(password);
        return userMapper.authenticate(username,  password);
    }

    private void validateInput(String input) {
        if (!input.matches("^[a-zA-Z0-9_@.]{5,20}$"))  {
            throw new IllegalArgumentException("非法输入");
        }
    }
}

@Configuration 
public class SecurityConfig {
    @Bean 
    public SecurityFilterChain filterChain(HttpSecurity http) 
    throws Exception {
        return http 
            .csrf(csrf -> csrf 
                .csrfTokenRepository(
                CookieCsrfTokenRepository.withHttpOnlyFalse()) 
            )
            .headers(headers -> headers 
                .contentSecurityPolicy("script-src 'self'")
                .frameOptions(HeaderWriter.
                FrameOptionsPolicy.DENY)
            )
            .build();
    }
}

@PostMapping("/secure-upload")
public ResponseEntity<?> secureUpload(
    @RequestParam("file") MultipartFile file,
    @RequestHeader("Content-Type") String contentType) {

    // 防御1：内容类型校验
    if (!contentType.startsWith("image/")) {
        throw new IllegalFileTypeException("仅允许图片类型");
    }

    // 防御2：文件头校验
    byte[] fileHeader = Arrays.copyOfRange(file.getBytes(), 0, 8);
    if (!ImageValidator.isValidImageHeader(fileHeader)) {
        throw new IllegalFileTypeException("文件头不合法");
    }

    // 防御3：扩展名白名单
    String ext = FilenameUtils.getExtension(file.getOriginalFilename());
    if (!Set.of("jpg", "png").contains(ext.toLowerCase())) {
        throw new IllegalFileTypeException("不支持的文件扩展名");
    }

    // 防御4：文件重命名
    String newName = UUID.randomUUID() + "." + ext;
    Path dest = Paths.get("/non-web-upload", newName);

    // 防御5：病毒扫描
    if (VirusScanner.detectMalware(file.getInputStream())) {
        throw new SecurityException("检测到恶意内容");
    }

    file.transferTo(dest);
    return ResponseEntity.ok(Map.of(
        "url", "/download/" + newName,  // 通过安全路由访问
        "size", file.getSize()
    ));
}

<script setup>
const state = reactive({
  file: null,
  preview: '',
  errors: []
});

const validateFile = (file) => {
  const validTypes = ['image/jpeg', 'image/png'];
  const maxSize = 2 * 1024 * 1024; // 2MB

  if (!validTypes.includes(file.type)) {
    throw new Error('仅支持JPEG/PNG格式');
  }
  if (file.size > maxSize) {
    throw new Error('文件大小超过2MB限制');
  }

  // 客户端预览解析检测
  return new Promise((resolve) => {
    const reader = new FileReader();
    reader.onload = (e) => {
      const img = new Image();
      img.onload = () => resolve(true);
      img.onerror = () => reject(new Error('图片解析失败'));
      img.src = e.target.result;
    };
    reader.readAsDataURL(file);
  });
};

const handleUpload = async () => {
  try {
    await validateFile(state.file);

    const formData = new FormData();
    formData.append('file', state.file);
    formData.append('signature', await calculateSHA256(state.file));

    const { data } = await axios.post('/api/secure-upload', formData, {
      headers: {
        'X-Content-Check': 'strict',
        'Content-Security-Policy': 'default-src self'
      },
      timeout: 10000
    });

    // 处理成功响应
  } catch (err) {
    state.errors.push(err.message);
  }
};
</script>

# 上传目录禁止脚本执行
location ~* ^/uploads/.*\.(php|jsp|asp)$ {
    deny all;
}

# 强制下载处理而非执行
location ~* ^/downloads/ {
    add_header Content-Disposition "attachment";
    types { }
    default_type application/octet-stream;
}

import hashlib
hashlib.sha256("hello123".encode()).hexdigest() 
# 输出：a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3

// Spring后端
public String hashWithBCrypt(String password) {
    return BCrypt.hashpw(password, BCrypt.gensalt(12)); 
}

// Vue前端
async function preHash(pwd) {
    const msgBuffer = new TextEncoder().encode(pwd);
    const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer);
    return Array.from(new Uint8Array(hashBuffer)).map(b => b.toString(16)).join('');
}

from Crypto.Cipher import AES
cipher = AES.new(key, AES.MODE_GCM)
ciphertext = cipher.encrypt(b"secret data")

// Spring配置
@Bean
public AESService aesService() {
    return new AESService(
        KeyGenerator.getInstance("AES")
           .generateKey(), // 从KMS获取实际密钥
        "AES/GCM/NoPadding");
}

// Vue加密
const encryptAES = (data, key) => {
  const iv = crypto.getRandomValues(new Uint8Array(12));
  return { iv, ciphertext: await crypto.subtle.encrypt(
    { name: "AES-GCM", iv },
    key,
    data
  )};
};

from Crypto.PublicKey import RSA
cipher = PKCS1_OAEP.new(public_key)
ciphertext = cipher.encrypt(b"sensitive")

# Nginx配置
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
ssl_stapling on;
ssl_stapling_verify on;

# 证书钉扎
add_header Public-Key-Pins 'pin-sha256="base64+primary=="; max-age=2592000';

FROM nginx:1.20
RUN git clone https://github.com/SpiderLabs/ModSecurity /opt/modsecurity && \
    cd /opt/modsecurity && ./build.sh && make install
COPY owasp-crs /etc/nginx/owasp-crs

# 使用Trivy扫描Docker镜像
docker pull myapp:latest
trivy image --severity CRITICAL myapp:latest

# vault.hcl
storage "raft" {
  path = "/vault/data"
}
listener "tcp" {
  tls_disable = 1
}

// 使用NSFWJS检测图片
const model = await nsfwjs.load()
const img = document.getElementById('img')
const predictions = await model.classify(img)

# 使用PyFlink实现简单风控
env = StreamExecutionEnvironment.get_execution_environment()
transactions = env.add_source(KafkaSource())
fraud_patterns = transactions.key_by(lambda t: t.user_id) \
    .process(FraudPatternDetector())