{"id":477158,"date":"2023-08-09T09:08:09","date_gmt":"2023-08-09T09:08:09","guid":{"rendered":""},"modified":"2023-09-05T11:14:08","modified_gmt":"2023-09-05T11:14:08","slug":"expression-language-injection","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/cn\/wiki\/expression-language-injection\/","title":{"rendered":"\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165"},"content":{"rendered":"<h2>\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165<\/h2>\n<p>\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u662f Web \u5e94\u7528\u7a0b\u5e8f\u4e2d\u53d1\u751f\u7684\u4e00\u79cd\u5b89\u5168\u6f0f\u6d1e\u3002\u5b83\u5141\u8bb8\u653b\u51fb\u8005\u901a\u8fc7\u5c06\u6076\u610f\u8868\u8fbe\u5f0f\u6ce8\u5165\u5e94\u7528\u7a0b\u5e8f\u7684\u8868\u8fbe\u5f0f\u8bed\u8a00\u6846\u67b6\u6765\u6267\u884c\u4efb\u610f\u4ee3\u7801\u6216\u8bbf\u95ee\u654f\u611f\u4fe1\u606f\u3002\u8fd9\u79cd\u7c7b\u578b\u7684\u653b\u51fb\u5bf9\u4e8e OneProxy (oneproxy.pro) \u7b49\u4ee3\u7406\u670d\u52a1\u5668\u63d0\u4f9b\u5546\u5c24\u5176\u4ee4\u4eba\u62c5\u5fe7\uff0c\u56e0\u4e3a\u5b83\u53ef\u7528\u4e8e\u7ed5\u8fc7\u5b89\u5168\u63a7\u5236\u5e76\u83b7\u5f97\u5bf9\u8d44\u6e90\u7684\u672a\u7ecf\u6388\u6743\u7684\u8bbf\u95ee\u3002<\/p>\n<h2>\u5386\u53f2\u548c\u9996\u6b21\u63d0\u53ca<\/h2>\n<p>\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u7684\u6982\u5ff5\u968f\u7740\u52a8\u6001 Web \u5e94\u7528\u7a0b\u5e8f\u7684\u51fa\u73b0\u548c\u8868\u8fbe\u5f0f\u8bed\u8a00\u6846\u67b6\u7684\u5f15\u5165\u800c\u51fa\u73b0\u3002\u6700\u65e9\u63d0\u5230\u6b64\u6f0f\u6d1e\u53ef\u4ee5\u8ffd\u6eaf\u5230 2000 \u5e74\u4ee3\u4e2d\u671f\uff0c\u5f53\u65f6 Web \u5f00\u53d1\u4eba\u5458\u5f00\u59cb\u5c06\u8868\u8fbe\u5f0f\u8bed\u8a00\u5408\u5e76\u5230\u4ed6\u4eec\u7684\u5e94\u7528\u7a0b\u5e8f\u4e2d\u4ee5\u589e\u5f3a\u52a8\u6001\u5185\u5bb9\u751f\u6210\u3002<\/p>\n<p>\u968f\u7740 Web \u5e94\u7528\u7a0b\u5e8f\u53d8\u5f97\u8d8a\u6765\u8d8a\u590d\u6742\uff0c\u5f00\u53d1\u4eba\u5458\u5f00\u59cb\u4f7f\u7528 JavaServer Pages (JSP) \u8868\u8fbe\u5f0f\u8bed\u8a00 (EL) \u548c\u7edf\u4e00\u8868\u8fbe\u5f0f\u8bed\u8a00 (UEL) \u7b49\u8868\u8fbe\u5f0f\u8bed\u8a00\u6765\u64cd\u4f5c\u6570\u636e\u5e76\u5728\u7f51\u9875\u4e2d\u52a8\u6001\u751f\u6210\u5185\u5bb9\u3002\u7136\u800c\uff0c\u8fd9\u79cd\u65b0\u53d1\u73b0\u7684\u80fd\u529b\u4e5f\u5e26\u6765\u4e86\u6f5c\u5728\u7684\u5b89\u5168\u98ce\u9669\u3002<\/p>\n<h2>\u4e86\u89e3\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165<\/h2>\n<p>\u5f53\u653b\u51fb\u8005\u627e\u5230\u4e00\u79cd\u65b9\u6cd5\u5c06\u6076\u610f\u4ee3\u7801\u6216\u8868\u8fbe\u5f0f\u63d2\u5165\u5230 Web \u5e94\u7528\u7a0b\u5e8f\u7684\u8f93\u5165\u5b57\u6bb5\u6216\u53c2\u6570\u4e2d\uff08\u6700\u7ec8\u7531\u5e94\u7528\u7a0b\u5e8f\u7684\u8868\u8fbe\u5f0f\u8bed\u8a00\u6846\u67b6\u8bc4\u4f30\uff09\u65f6\uff0c\u5c31\u4f1a\u53d1\u751f\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u3002\u8fd9\u4f7f\u5f97\u4ed6\u4eec\u80fd\u591f\u5728\u5e94\u7528\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4ee3\u7801\uff0c\u4ece\u800c\u5bfc\u81f4\u5404\u79cd\u540e\u679c\uff0c\u4f8b\u5982\u672a\u7ecf\u6388\u6743\u7684\u6570\u636e\u8bbf\u95ee\u3001\u6743\u9650\u5347\u7ea7\uff0c\u751a\u81f3\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002<\/p>\n<h2>\u5185\u90e8\u7ed3\u6784\u548c\u529f\u80fd<\/h2>\n<p>\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u7684\u5de5\u4f5c\u539f\u7406\u56f4\u7ed5\u4ee5\u4e0b\u7ec4\u4ef6\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u8868\u8fbe\u8bed\u8a00<\/strong>\uff1aJSP EL \u548c UEL \u7b49\u8868\u8fbe\u5f0f\u8bed\u8a00\u65e8\u5728\u8bc4\u4f30 Web \u5e94\u7528\u7a0b\u5e8f\u4e2d\u7684\u52a8\u6001\u8868\u8fbe\u5f0f\u3002\u5b83\u4eec\u63d0\u4f9b\u4e86\u4e00\u79cd\u8bbf\u95ee\u548c\u64cd\u4f5c\u5b58\u50a8\u5728\u5404\u79cd\u8303\u56f4\u5185\u7684\u5bf9\u8c61\u548c\u6570\u636e\u7684\u65b9\u6cd5\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u7528\u6237\u8f93\u5165<\/strong>\uff1a\u653b\u51fb\u8005\u901a\u8fc7\u7528\u6237\u53ef\u63a7\u7684\u8f93\u5165\u5b57\u6bb5\uff08\u4f8b\u5982\u8868\u5355\u3001cookie \u6216 HTTP \u6807\u5934\uff09\u6ce8\u5165\u6076\u610f\u8868\u8fbe\u5f0f\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u8868\u8fbe\u8bc4\u4f30<\/strong>\uff1a\u5e94\u7528\u7a0b\u5e8f\u7684\u8868\u8fbe\u5f0f\u8bed\u8a00\u6846\u67b6\u5904\u7406\u8f93\u5165\u5e76\u8bc4\u4f30\u6ce8\u5165\u7684\u8868\u8fbe\u5f0f\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u4ee3\u7801\u6267\u884c<\/strong>\uff1a\u5982\u679c\u8f93\u5165\u6ca1\u6709\u7ecf\u8fc7\u6b63\u786e\u7684\u6e05\u7406\u548c\u9a8c\u8bc1\uff0c\u6076\u610f\u8868\u8fbe\u5f0f\u5c31\u4f1a\u5728\u5e94\u7528\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\uff0c\u4ece\u800c\u5bfc\u81f4\u672a\u7ecf\u6388\u6743\u7684\u64cd\u4f5c\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u7684\u4e3b\u8981\u7279\u5f81<\/h2>\n<p>\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u5177\u6709\u51e0\u4e2a\u91cd\u8981\u7684\u7279\u6027\uff0c\u5305\u62ec\uff1a<\/p>\n<ul>\n<li>\n<p><strong>\u57fa\u4e8e\u60c5\u5883<\/strong>\uff1a\u5f71\u54cd\u7684\u4e25\u91cd\u7a0b\u5ea6\u53d6\u51b3\u4e8e\u6ce8\u5165\u53d1\u751f\u7684\u73af\u5883\u3002\u67d0\u4e9b\u4e0a\u4e0b\u6587\u53ef\u80fd\u5177\u6709\u6709\u9650\u7684\u6743\u9650\uff0c\u800c\u5176\u4ed6\u4e0a\u4e0b\u6587\u5219\u6388\u4e88\u5bf9\u654f\u611f\u6570\u636e\u548c\u7cfb\u7edf\u8d44\u6e90\u7684\u5b8c\u5168\u8bbf\u95ee\u6743\u9650\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u6570\u636e\u66b4\u9732<\/strong>\uff1a\u653b\u51fb\u8005\u53ef\u4ee5\u8bbf\u95ee\u548c\u64cd\u7eb5\u5e94\u7528\u7a0b\u5e8f\u5185\u7684\u6570\u636e\uff0c\u5305\u62ec\u6570\u636e\u5e93\u3001\u4f1a\u8bdd\u4fe1\u606f\u548c\u540e\u7aef\u7cfb\u7edf\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u4ee3\u7801\u6267\u884c<\/strong>\uff1a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u7684\u80fd\u529b\u4f7f\u653b\u51fb\u8005\u80fd\u591f\u63a7\u5236\u5e94\u7528\u7a0b\u5e8f\u751a\u81f3\u6574\u4e2a\u4e3b\u673a\u7cfb\u7edf\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u8fde\u9501\u5f0f\u5265\u524a<\/strong>\uff1a\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u53ef\u4ee5\u4e0e\u5176\u4ed6\u6f0f\u6d1e\u7ed3\u5408\u4f7f\u7528\u6765\u63d0\u5347\u6743\u9650\u5e76\u8fbe\u5230\u66f4\u663e\u7740\u7684\u5f71\u54cd\u3002<\/p>\n<\/li>\n<\/ul>\n<h2>\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u7684\u7c7b\u578b<\/h2>\n<p>\u6839\u636e\u5e95\u5c42\u8868\u8fbe\u5f0f\u8bed\u8a00\u548c\u6ce8\u5165\u4e0a\u4e0b\u6587\uff0c\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u53ef\u4ee5\u5206\u4e3a\u4e0d\u540c\u7c7b\u578b\u3002\u5e38\u89c1\u7c7b\u578b\u5305\u62ec\uff1a<\/p>\n<table>\n<thead>\n<tr>\n<th>\u7c7b\u578b<\/th>\n<th>\u63cf\u8ff0<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>JSP \u8868\u8fbe\u5f0f\u8bed\u8a00 (EL) \u6ce8\u5165<\/td>\n<td>\u53d1\u751f\u5728 JavaServer Pages (JSP) \u5e94\u7528\u7a0b\u5e8f\u4e2d\uff0c\u653b\u51fb\u8005\u5c06\u6076\u610f\u8868\u8fbe\u5f0f\u6ce8\u5165 JSP EL \u6807\u8bb0\u6216\u5c5e\u6027\u4e2d\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u7edf\u4e00\u8868\u8fbe\u8bed\u8a00 (UEL) \u6ce8\u5165<\/td>\n<td>\u5b58\u5728\u4e8e\u4f7f\u7528\u7edf\u4e00\u8868\u8fbe\u8bed\u8a00 (UEL) \u7684\u5e94\u7528\u7a0b\u5e8f\u4e2d\uff0c\u8be5\u8bed\u8a00\u662f JSP EL \u7684\u8d85\u96c6\u3002\u653b\u51fb\u8005\u5229\u7528\u8f93\u5165\u9a8c\u8bc1\u7f3a\u9677\u6ce8\u5165\u6709\u5bb3\u8868\u8fbe\u5f0f\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u6a21\u677f\u5f15\u64ce\u6ce8\u5165<\/td>\n<td>\u4e0e\u6a21\u677f\u5f15\u64ce\u76f8\u5173\uff0c\u653b\u51fb\u8005\u64cd\u7eb5\u6a21\u677f\u5316\u8868\u8fbe\u5f0f\u6765\u6267\u884c\u975e\u9884\u671f\u4ee3\u7801\u3002\u8fd9\u79cd\u7c7b\u578b\u4e0d\u4ec5\u9650\u4e8e EL \u7b49\u8868\u8fbe\u5f0f\u8bed\u8a00\uff0c\u8fd8\u5f71\u54cd\u5176\u4ed6\u6a21\u677f\u7cfb\u7edf\uff0c\u5982 Thymeleaf\u3001Freemarker \u7b49\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u4f7f\u7528\u3001\u95ee\u9898\u53ca\u89e3\u51b3\u65b9\u6848<\/h2>\n<p>\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u7684\u4f7f\u7528\u65b9\u5f0f\u591a\u79cd\u591a\u6837\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u6570\u636e\u68c0\u7d22<\/strong>\uff1a\u653b\u51fb\u8005\u53ef\u4ee5\u4f7f\u7528 EL \u6ce8\u5165\u6765\u8bbf\u95ee\u654f\u611f\u4fe1\u606f\uff0c\u4f8b\u5982\u7528\u6237\u51ed\u636e\u3001\u4e2a\u4eba\u6570\u636e\u6216\u7cfb\u7edf\u914d\u7f6e\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u547d\u4ee4\u6267\u884c<\/strong>\uff1a\u901a\u8fc7\u6ce8\u5165\u6076\u610f\u8868\u8fbe\u5f0f\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u6267\u884c\u7cfb\u7edf\u547d\u4ee4\uff0c\u53ef\u80fd\u5bfc\u81f4\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u5b89\u5168\u7ed5\u8fc7<\/strong>\uff1a\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u53ef\u7528\u4e8e\u7ed5\u8fc7\u8bbf\u95ee\u63a7\u5236\u3001\u8eab\u4efd\u9a8c\u8bc1\u673a\u5236\u548c\u5176\u4ed6\u5b89\u5168\u63aa\u65bd\u3002<\/p>\n<\/li>\n<\/ol>\n<p>\u4e3a\u4e86\u7f13\u89e3\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\uff0c\u5f00\u53d1\u4eba\u5458\u548c\u4ee3\u7406\u670d\u52a1\u5668\u63d0\u4f9b\u5546\u5e94\u8003\u8651\u4ee5\u4e0b\u89e3\u51b3\u65b9\u6848\uff1a<\/p>\n<ul>\n<li>\n<p><strong>\u8f93\u5165\u9a8c\u8bc1<\/strong>\uff1a\u9a8c\u8bc1\u5e76\u6e05\u7406\u6240\u6709\u7528\u6237\u8f93\u5165\uff0c\u4ee5\u9632\u6b62\u6ce8\u5165\u6076\u610f\u8868\u8fbe\u5f0f\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u7279\u5b9a\u4e8e\u4e0a\u4e0b\u6587\u7684\u8f6c\u4e49<\/strong>\uff1a\u6839\u636e\u4f7f\u7528\u6570\u636e\u7684\u4e0a\u4e0b\u6587\u6b63\u786e\u8f6c\u4e49\u548c\u7f16\u7801\u6570\u636e\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u6700\u5c0f\u7279\u6743\u539f\u5219<\/strong>\uff1a\u5e94\u7528\u6700\u5c0f\u6743\u9650\u539f\u5219\u6765\u9650\u5236\u5bf9\u654f\u611f\u8d44\u6e90\u7684\u8bbf\u95ee\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u5b89\u5168\u5ba1\u8ba1<\/strong>\uff1a\u5b9a\u671f\u5b89\u5168\u5ba1\u8ba1\u548c\u4ee3\u7801\u5ba1\u67e5\u53ef\u4ee5\u5e2e\u52a9\u8bc6\u522b\u548c\u89e3\u51b3\u6f5c\u5728\u7684\u6f0f\u6d1e\u3002<\/p>\n<\/li>\n<\/ul>\n<h2>\u4e0e\u7c7b\u4f3c\u672f\u8bed\u7684\u6bd4\u8f83<\/h2>\n<p>\u4ee5\u4e0b\u662f\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u4e0e\u7c7b\u4f3c\u672f\u8bed\u7684\u6bd4\u8f83\uff1a<\/p>\n<table>\n<thead>\n<tr>\n<th>\u5b66\u671f<\/th>\n<th>\u63cf\u8ff0<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>SQL\u6ce8\u5165<\/td>\n<td>\u901a\u8fc7\u6ce8\u5165\u6076\u610f SQL \u67e5\u8be2\u6765\u7784\u51c6\u5e94\u7528\u7a0b\u5e8f\u7684\u6570\u636e\u5e93\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u8de8\u7ad9\u811a\u672c (XSS)<\/td>\n<td>\u5c06\u6076\u610f\u811a\u672c\u6ce8\u5165\u5176\u4ed6\u7528\u6237\u67e5\u770b\u7684\u7f51\u9875\u4e2d\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u547d\u4ee4\u6ce8\u5165<\/td>\n<td>\u6d89\u53ca\u5728\u4e3b\u673a\u4e0a\u6ce8\u5165\u548c\u6267\u884c\u6076\u610f\u7cfb\u7edf\u547d\u4ee4\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u670d\u52a1\u5668\u7aef\u8bf7\u6c42\u4f2a\u9020 (SSRF)<\/td>\n<td>\u5229\u7528\u670d\u52a1\u5668\u5411\u5185\u90e8\u8d44\u6e90\u6216\u5176\u4ed6\u670d\u52a1\u5668\u53d1\u51fa\u8bf7\u6c42\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u672a\u6765\u524d\u666f\u548c\u6280\u672f<\/h2>\n<p>\u968f\u7740\u6280\u672f\u683c\u5c40\u7684\u53d1\u5c55\uff0c\u7f51\u7edc\u653b\u51fb\u8005\u7684\u7b56\u7565\u4e5f\u5728\u4e0d\u65ad\u53d8\u5316\u3002\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u7684\u672a\u6765\u4e0e Web \u5e94\u7528\u7a0b\u5e8f\u6846\u67b6\u3001\u8bed\u8a00\u548c\u5b89\u5168\u63aa\u65bd\u7684\u8fdb\u6b65\u5bc6\u5207\u76f8\u5173\u3002\u5f00\u53d1\u4eba\u5458\u548c\u4ee3\u7406\u670d\u52a1\u5668\u63d0\u4f9b\u5546\u9700\u8981\u4fdd\u6301\u8b66\u60d5\uff0c\u91c7\u7528\u65b0\u6280\u672f\u548c\u6700\u4f73\u5b9e\u8df5\u6765\u9632\u5fa1\u4e0d\u65ad\u6f14\u53d8\u7684\u653b\u51fb\u3002<\/p>\n<h2>\u4ee3\u7406\u670d\u52a1\u5668\u548c\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165<\/h2>\n<p>\u4ee3\u7406\u670d\u52a1\u5668\uff08\u4f8b\u5982 OneProxy\uff09\u53ef\u4ee5\u5728\u51cf\u8f7b\u4e0e\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u76f8\u5173\u7684\u98ce\u9669\u65b9\u9762\u53d1\u6325\u81f3\u5173\u91cd\u8981\u7684\u4f5c\u7528\u3002\u901a\u8fc7\u5b9e\u65bd\u5404\u79cd\u5b89\u5168\u673a\u5236\uff0c\u4f8b\u5982\u8bf7\u6c42\u8fc7\u6ee4\u3001\u8f93\u5165\u9a8c\u8bc1\u548c\u6d41\u91cf\u76d1\u63a7\uff0c\u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u5145\u5f53\u7528\u6237\u548c Web \u5e94\u7528\u7a0b\u5e8f\u4e4b\u95f4\u7684\u5c4f\u969c\u3002\u4ed6\u4eec\u53ef\u4ee5\u5728\u5c06\u4f20\u5165\u8bf7\u6c42\u8f6c\u53d1\u5230\u5e94\u7528\u7a0b\u5e8f\u670d\u52a1\u5668\u4e4b\u524d\u68c0\u67e5\u548c\u6e05\u7406\u4f20\u5165\u8bf7\u6c42\uff0c\u4ece\u800c\u964d\u4f4e\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u653b\u51fb\u7684\u53ef\u80fd\u6027\u3002<\/p>\n<h2>\u76f8\u5173\u94fe\u63a5<\/h2>\n<p>\u6709\u5173\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u548c Web \u5e94\u7528\u7a0b\u5e8f\u5b89\u5168\u6027\u7684\u66f4\u591a\u4fe1\u606f\uff0c\u8bf7\u53c2\u9605\u4ee5\u4e0b\u8d44\u6e90\uff1a<\/p>\n<ol>\n<li>OWASP \u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\uff1a <a href=\"https:\/\/owasp.org\/www-community\/attacks\/Expression_Language_Injection\" target=\"_new\" rel=\"noopener nofollow\">https:\/\/owasp.org\/www-community\/attacks\/Expression_Language_Injection<\/a><\/li>\n<li>SANS Institute \u2013 \u5e38\u89c1 Web \u5e94\u7528\u7a0b\u5e8f\u6f0f\u6d1e\uff1a <a href=\"https:\/\/www.sans.org\/blog\/top-5-web-application-vulnerabilities\/\" target=\"_new\" rel=\"noopener nofollow\">https:\/\/www.sans.org\/blog\/top-5-web-application-vulnerabilities\/<\/a><\/li>\n<li>Oracle JavaServer Pages \u89c4\u8303\uff1a <a href=\"https:\/\/docs.oracle.com\/javaee\/5\/tutorial\/doc\/bnaph.html\" target=\"_new\" rel=\"noopener nofollow\">https:\/\/docs.oracle.com\/javaee\/5\/tutorial\/doc\/bnaph.html<\/a><\/li>\n<li>\u7edf\u4e00\u8868\u8fbe\u8bed\u8a00\uff08UEL\uff09\u7b80\u4ecb\uff1a <a href=\"https:\/\/www.oracle.com\/technical-resources\/articles\/java\/introduction-unified-expression-language.html\" target=\"_new\" rel=\"noopener nofollow\">https:\/\/www.oracle.com\/technical-resources\/articles\/java\/introduction-unified-expression-language.html<\/a><\/li>\n<\/ol>\n<p>\u901a\u8fc7\u9075\u5faa\u6700\u4f73\u5b9e\u8df5\u5e76\u4e0d\u65ad\u9488\u5bf9\u65b0\u51fa\u73b0\u7684\u5a01\u80c1\u8fdb\u884c\u81ea\u6211\u6559\u80b2\uff0c\u5f00\u53d1\u4eba\u5458\u548c\u4ee3\u7406\u670d\u52a1\u5668\u63d0\u4f9b\u5546\u53ef\u4ee5\u5e2e\u52a9\u4fdd\u62a4\u5176 Web \u5e94\u7528\u7a0b\u5e8f\u548c\u7528\u6237\u514d\u53d7\u8868\u8fbe\u5f0f\u8bed\u8a00\u6ce8\u5165\u7684\u5371\u9669\u3002<\/p>","protected":false},"featured_media":477159,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477158","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>Expression Language Injection: An Overview<\/mark>","faq_items":[{"question":"What is Expression Language Injection?","answer":"<p>Expression Language Injection is a type of security vulnerability found in web applications. It allows attackers to insert malicious code or expressions into the application's expression language framework, potentially leading to unauthorized access, data manipulation, or even remote code execution.<\/p>"},{"question":"How did Expression Language Injection originate?","answer":"<p>Expression Language Injection emerged with the rise of dynamic web applications and the adoption of expression languages like JSP EL and UEL. Its earliest mentions date back to the mid-2000s, when web developers started using these languages to enhance dynamic content generation.<\/p>"},{"question":"How does Expression Language Injection work?","answer":"<p>Attackers inject malicious expressions into input fields or parameters within the web application. The application's expression language framework processes these inputs and evaluates the injected expressions. If not properly validated, the malicious code executes within the application's context, granting unauthorized access or control.<\/p>"},{"question":"What are the key features of Expression Language Injection?","answer":"<p>Expression Language Injection's key features include its context-based impact, potential data exposure, code execution capabilities, and the possibility of combining it with other vulnerabilities for more significant impacts.<\/p>"},{"question":"What types of Expression Language Injection exist?","answer":"<p>There are several types of Expression Language Injection, such as JSP Expression Language (EL) Injection, Unified Expression Language (UEL) Injection, and Template Engine Injection.<\/p>"},{"question":"How can Expression Language Injection be used, and how can it be mitigated?","answer":"<p>Attackers can use Expression Language Injection for data retrieval, command execution, and security bypass. To mitigate this vulnerability, developers and proxy server providers should implement input validation, context-specific escaping, and adhere to the principle of least privilege.<\/p>"},{"question":"How does Expression Language Injection compare to similar terms like SQL Injection and Cross-Site Scripting (XSS)?","answer":"<p>Expression Language Injection differs from SQL Injection, XSS, and Command Injection in its specific focus on manipulating expression languages within web applications.<\/p>"},{"question":"What is the future outlook for Expression Language Injection?","answer":"<p>The future of Expression Language Injection is closely tied to advancements in web application frameworks and security measures. Developers and proxy server providers must stay vigilant and adopt new technologies and best practices to defend against evolving attacks.<\/p>"},{"question":"How can proxy servers like OneProxy help with Expression Language Injection?","answer":"<p>Proxy servers, like OneProxy, can act as a protective barrier for web applications by filtering and validating incoming requests, reducing the risk of Expression Language Injection attacks.<\/p>"},{"question":"Where can I find more information about Expression Language Injection?","answer":"<p>For further details on Expression Language Injection and web application security, refer to the following resources:<\/p><ol><li>OWASP Expression Language Injection: <a href=\"https:\/\/owasp.org\/www-community\/attacks\/Expression_Language_Injection\" target=\"_new\">https:\/\/owasp.org\/www-community\/attacks\/Expression_Language_Injection<\/a><\/li><li>SANS Institute - Common Web Application Vulnerabilities: <a href=\"https:\/\/www.sans.org\/blog\/top-5-web-application-vulnerabilities\/\" target=\"_new\">https:\/\/www.sans.org\/blog\/top-5-web-application-vulnerabilities\/<\/a><\/li><li>Oracle JavaServer Pages Specification: <a href=\"https:\/\/docs.oracle.com\/javaee\/5\/tutorial\/doc\/bnaph.html\" target=\"_new\">https:\/\/docs.oracle.com\/javaee\/5\/tutorial\/doc\/bnaph.html<\/a><\/li><li>Introduction to Unified Expression Language (UEL): <a href=\"https:\/\/www.oracle.com\/technical-resources\/articles\/java\/introduction-unified-expression-language.html\" target=\"_new\">https:\/\/www.oracle.com\/technical-resources\/articles\/java\/introduction-unified-expression-language.html<\/a><\/li><\/ol>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477158\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media\/477159"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media?parent=477158"}],"curies":[{"name":"\u53ef\u6e7f\u6027\u7c89\u5242","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}