Question

SuperMap iServer 11i(2023) (v11.1.1）解决 DOM‑XSS 漏洞，用官方的SuperMap iServer 11i(2023) SP2 for Windows(x64)(Setup包)可以吗，业务项目、工作空间、许可兼容吗

Answer 1

您好，可以的，需要配置XssFilter解决，可以参考https://help.supermap.com/iServer/zh/Subject_introduce/Security/otherSecurity/attrackConfig.htm

配置文件为【 安装目录】\webapps\iserver\WEB-INF\web.xml）。

配置开启防护跨站点脚本攻击如下所示：

<filter> 

      <filter-name><FONT style="BACKGROUND-COLOR: #0078d7" color=#ffffff>XssFilter</FONT></filter-name>

      <display-name><FONT style="BACKGROUND-COLOR: #0078d7" color=#ffffff>XssFilter</FONT></display-name>

      <filter-class>com.supermap.server.host.webapp.<FONT style="BACKGROUND-COLOR: #0078d7" color=#ffffff>XssFilter</FONT></filter-class>

      <async-supported>true</async-supported>

      <init-param>

            <param-name>processMode</param-name>

            <!-- 可选值：CLEAN、THROWERROR分别表示清除危险字符，抛出异常 -->

            <param-value>THROWERROR</param-value>

      </init-param>

      <init-param>

            <param-name>antisamyName</param-name>

            <!-- 可选值：antisamy-myspace.xml、antisamy-ebay.xml、antisamy-tinymce.xml、antisamy-slashdot.xml -->

            <param-value>antisamy-ebay.xml</param-value>

      </init-param>

      <init-param>

             <param-name>xsrfDefendEnable</param-name>

             <!-- 可选值：true、false分别表示开启和关闭防护跨站请求伪造 -->

             <param-value>true</param-value>

       </init-param>

      <init-param>

             <param-name>xsrfDefendTime</param-name>

             <!-- 开启防护跨站请求伪造后，可以设置防护跨站请求时间间隔，单位毫秒 -->

             <param-value>1000</param-value>

       </init-param>

       <init-param>

             <param-name>refererWhiteList</param-name>

             <!-- 开启防护跨站请求伪造后，可以设置跨站请求白名单 -->

             <param-value>域名1;域名2;域名3</param-value>

       </init-param>

       <init-param>

             <param-name>hostWhiteList</param-name>

             <!-- 开启防护跨站请求伪造后，可以设置host请求头白名单 -->

             <param-value>ip1:port1;ip2:port2;ip3:port3</param-value>

       </init-param>

</filter>

<filter-mapping>

      <filter-name><FONT style="BACKGROUND-COLOR: #0078d7" color=#ffffff>XssFilter</FONT></filter-name>

      <url-pattern>/