serializable warning에 대해

Leave a reply

이클립스에서 열심히 작업을 하다 보면 보는 경고가 있다.

JDK 5.x대에서 새롭게 추가된 점인듯 하다.

The serializable class XXX does not declare a static final serialVersionUID field of type long

이 문제를 해결하기 위해 찾아보던중 다음과 같은 내용을 발견하였다.

ANY-ACCESS-MODIFIER static final long serialVersionUID = 42L;
If a serializable class does not explicitly declare a serialVersionUID, then the serialization runtime will calculate a default serialVersionUID value for that class based on various aspects of the class, as described in the Java(TM) Object Serialization Specification. However, it is strongly recommended that all serializable classes explicitly declare serialVersionUID values, since the default serialVersionUID computation is highly sensitive to class details that may vary depending on compiler implementations, and can thus result in unexpected InvalidClassExceptions during deserialization. Therefore, to guarantee a consistent serialVersionUID value across different java compiler implementations, a serializable class must declare an explicit serialVersionUID value. It is also strongly advised that explicit serialVersionUID declarations use the private modifier where possible, since such declarations apply only to the immediately declaring class–serialVersionUID fields are not useful as inherited members.

사실 무슨 말인지 정확히 모르겠지만, serializable class를 사용할 경우 serialVersionUID 를 등록하여야 한다는 말인듯 하다.

보안적인 측면에서인듯 하다.

static final long serialVersionUID = 42L;

를 클래스안에 추가해 주면 된다.

krcert에서 제공하는 mod_security 예시

Leave a reply

krcert에서 내놓은 mod_security rule 예제입니다. 왠만한 인젝션과 XSS해킹 기법의 차단을 하도록 되어있습니다.

[CODE]##### Configuration #####
SecFilterEngine On
SecFilterScanPost On
SecFilterScanOutput Off
SecFilterOutputMimeTypes “(null) text/html text/plain”

##### Validation #####
SecFilterCheckURLEncoding On
SecUploadDir /tmp
SecUploadKeepFiles Off
SecFilterCheckUnicodeEncoding Off
SecFilterForceByteRange 1 255
SecFilterDefaultAction “log,deny,status:403”

##### Logging #####
SecFilterDebugLog logs/modsec_debug.log
SecFilterDebugLevel 1
SecAuditEngine RelevantOnly
SecAuditLog logs/modsec_audit.log

##### Hardening #####
# Body를 가진 GET 또는 HEAD 요청 차단(공격 가능성 높음)
SecFilterSelective REQUEST_METHOD “^(GET|HEAD)$” chain
SecFilterSelective HTTP_Content-Length “!^$”
SecFilterSelective SERVER_PROTOCOL “!^HTTP/(0\.9|1\.0|1\.1)$”
# Content-Length가 없는 POST 요청 차단
SecFilterSelective REQUEST_METHOD “^POST$” chain
SecFilterSelective HTTP_Content-Length “^$”
SecFilterSelective HTTP_Transfer-Encoding “!^$”

##### General #####
SecFilterSelective HTTP_Host|HTTP_User-Agent|HTTP_Accept “^$”
SecFilterSelective HTTP_User-Agent “(libwhisker|paros|wget|libwww|perl|curl|java)”

##### SQL Injection Attacks #####
SecFilterSignatureAction “log,deny,msg:’SQL Injection attack'”
SecFilterSelective ARGS “delete[[:space:]]+from”
SecFilterSelective ARGS “drop[[:space:]]+database”
SecFilterSelective ARGS “drop[[:space:]]+table”
SecFilterSelective ARGS “drop[[:space:]]+column”
SecFilterSelective ARGS “drop[[:space:]]+procedure”
SecFilterSelective ARGS “create[[:space:]]+table”
SecFilterSelective ARGS “update.+set.+=”
SecFilterSelective ARGS “insert[[:space:]]+into.+values”
SecFilterSelective ARGS “select.+from”
SecFilterSelective ARGS “bulk[[:space:]]+insert”
SecFilterSelective ARGS “union.+select”
SecFilterSelective ARGS “or.+1[[:space:]]*=[[:space:]]1”
SecFilterSelective ARGS “alter[[:space:]]+table”
SecFilterSelective ARGS “or 1=1–‘”
SecFilterSelective ARGS “‘.+–“
SecFilterSelective ARGS “into[[:space:]]+outfile”
SecFilterSelective ARGS “load[[:space:]]+data”
SecFilterSelective ARGS “/\*.+\*/”

##### XSS Attacks #####
SecFilterSignatureAction “log,deny,msg:’XSS attack'”
SecFilterSelective ARGS “<script”
SecFilterSelective ARGS “”
SecFilterSelective ARGS “vbscript:”
SecFilterSelective ARGS “document\.cookie”
SecFilterSelective ARGS “document\.location”
SecFilterSelective ARGS “document\.write”

##### Command Execution #####
SecFilterSignatureAction “log,deny,msg:’Command execution attack'”
SecFilterSelective ARGS_VALUES “;[[:space:]]*(ls|id|pwd|wget)”

##### PHP Attacks #####
SecFilterSignatureAction “log,deny,msg:’PHP Injection Attacks'”
SecFilterSelective ARGS_VALUES “^http:/”
SecFilterSelective ARGS_NAMES “(^globals\[|^globals$)”[/HTML][/CODE]

다음은 관련 문서입니다.
1035310335.pdf