垂直越权防范 修复建议

合规方案：
建议系统通过全局过滤器来检测用户是否登录、是否对资源具有访问权限。

    public class PrivilegeFilter implements Filter {
        private Properties properties = new Properties();
        @Override
        public void destroy() {
            properties = null;
        }
        @Override
        public void init(FilterConfig config) throws ServletException {
//获取资源访问权限配置
            String fileName = config.getInitParameter("privilegeFile");
            String realPath = config.getServletContext().getRealPath(fileName);
            try {
                properties.load(new FileInputStream(realPath));
            } catch (Exception e) {
                config.getServletContext().log("读取权限控制文件失败", e);
            }
        }
        @Override
        public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
                throws IOException, ServletException {
            HttpServletRequest request = (HttpServletRequest) req;
            HttpServletResponse response = (HttpServletResponse) res;
            String requestUri = request.getRequestURI().replace(request.getContextPath() + "/", "");
            String action = request.getParameter("action");
            action = action == null ? "" : action;
            String uri = requestUri + "?action=" + action;
            String role = (String) request.getSession().getAttribute("role");
            role = role == null ? "guest" : role;
            boolean authen = false;
            for (Object obj : properties.keySet()) {
                String key = (String) obj;
                if (uri.matches(key.replace("?", "\\?").replace(".", "\\.").replace("*", ".*"))) {
                    if (role.equals(properties.get(key))) {
                        authen = true;
                        break;
                    }
                }
            }
            if (!authen) {
                throw new RuntimeException("您无权访问该页面，请以合适的身份登录后查看。");
            }
            chain.doFilter(request, response);
        }
    }

admin.do?action=*  =  administrator
list.do?action=add  =  admin
list.do?action=view  =  guest

<filter>
  <filter-name>privilegeFilter</filter-name>
  <filter-class>com.filter.privilegeFilter</filter-class>
  <init-param>
    <param-name>privilegeFile</param-name>
    <param-value>/WEB-INF/privilege.properties</param-value>
  </init-param>
</filter>