zxcxz2002/PhoneErp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

delete 핸드폰 인증

Browse Source
This commit is contained in:
zxcxz2002
2022-12-27 00:11:55 +09:00
parent 93cfa0be3c
commit da831cbf61
10 changed files with 0 additions and 1172 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/ns/mobile/website/common/util/ExtraCertUtils.java
-377
View File
@@ -1,377 +0,0 @@
package com.ns.mobile.website.common.util;
import com.ns.mobile.website.web.auth.CertSessionUtils;
import com.ns.mobile.website.web.auth.PublicAccess;
import com.ns.mobile.website.web.controller.BaseController;
import com.ns.mobile.website.web.controller.extra.ResultCert;
import com.ns.mobile.website.web.properties.LaneduProperties;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.Date;
import java.util.Locale;
import java.util.Random;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@Slf4j
public class ExtraCertUtils {
private static String getNow() {
return LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyyMMddHHmmss"));
}
private static String getSeqNumber() {
LocalDateTime now = LocalDateTime.now();
int seq = (new Random()).nextInt(10000) + 1;
return String.format("%s%05d"
, now.format(DateTimeFormatter.ofPattern("yyyyMMddHHmmss"))
, seq);
}
public static String getTrCertData(String actionType, LaneduProperties laneduProperties) {
//tr_cert 데이터 변수 선언 ---------------------------------------------------------------
String tr_cert = "";
String cpId = "KBZM1052"; // 회원사ID
String urlCode = "002001"; // URL코드
urlCode = "004001"; // - localhost - 회원가입
urlCode = "005001"; // - localhost:8080 - 회원가입
urlCode = laneduProperties.getPhoneUrlCode();
System.out.println("#######################");
System.out.println("#######################");
System.out.println("#######################");
System.out.println(urlCode);
String certNum = getSeqNumber(); // 요청번호 ( 본인인증 요청시 중복되지 않게 생성해야함. (예-시퀀스번호) )
String date = getNow(); // 요청일시
String certMet = "M"; // 본인인증방법
String name = ""; // 성명
String phoneNo = ""; // 휴대폰번호
String phoneCorp = ""; // 이동통신사
String birthDay = ""; // 생년월일
String gender = ""; // 성별
String nation = ""; // 내외국인 구분
String plusInfo = ""; // 추가DATA정보
String extendVar = "0000000000000000"; // 확장변수
//End-tr_cert 데이터 변수 선언 ---------------------------------------------------------------
plusInfo = actionType;
String tr_add = "N"; // IFrame사용여부
//01. 한국모바일인증(주) 암호화 모듈 선언
com.icert.comm.secu.IcertSecuManager seed = new com.icert.comm.secu.IcertSecuManager();
//02. 1차 암호화 (tr_cert 데이터변수 조합 후 암호화)
String enc_tr_cert = "";
tr_cert = cpId +"/"+ urlCode +"/"+ certNum +"/"+ date +"/"+ certMet +"/"+ birthDay +"/"+ gender +"/"+ name +"/"+ phoneNo +"/"+ phoneCorp +"/"+ nation +"/"+ plusInfo +"/"+ extendVar;
enc_tr_cert = seed.getEnc(tr_cert, "");
//03. 1차 암호화 데이터에 대한 위변조 검증값 생성 (HMAC)
String hmacMsg = "";
hmacMsg = seed.getMsg(enc_tr_cert);
//04. 2차 암호화 (1차 암호화 데이터, HMAC 데이터, extendVar 조합 후 암호화)
tr_cert = seed.getEnc(enc_tr_cert + "/" + hmacMsg + "/" + extendVar, "");
return tr_cert;
}
private static Boolean paramChk(String patn, String param) {
Pattern pattern = Pattern.compile(patn);
Matcher matcher = pattern.matcher(param);
return matcher.matches();
}
private static ResultCert getTrCertData(String rec_cert, String k_certNum, String clientIp) {
// 파라미터 유효성 검증
if( rec_cert.length() == 0 || k_certNum.length() == 0 ){
return ResultCert.fail("[오류] 결과값 비정상");
}
// 변수선언 --------------------------------------------------------------------------------------------------------
//String rec_cert = ""; // 결과수신DATA
//String k_certNum = ""; // 파라미터로 수신한 요청번호
String certNum = ""; // 요청번호
String date = ""; // 요청일시
String CI = ""; // 연계정보(CI)
String DI = ""; // 중복가입확인정보(DI)
String phoneNo = ""; // 휴대폰번호
String phoneCorp = ""; // 이동통신사
String birthDay = ""; // 생년월일
String gender = ""; // 성별
String nation = ""; // 내국인
String name = ""; // 성명
String M_name = ""; // 미성년자 성명
String M_birthDay = ""; // 미성년자 생년월일
String M_Gender = ""; // 미성년자 성별
String M_nation = ""; // 미성년자 내외국인
String result = ""; // 결과값
String certMet = ""; // 인증방법
String ip = ""; // ip주소
String plusInfo = "";
String encPara = "";
String encMsg1 = "";
String encMsg2 = "";
String msgChk = "";
//-----------------------------------------------------------------------------------------------------------------
//01. 암호화 모듈 (jar) Loading
com.icert.comm.secu.IcertSecuManager seed = new com.icert.comm.secu.IcertSecuManager();
//02. 1차 복호화
//수신된 certNum를 이용하여 복호화
rec_cert = seed.getDec(rec_cert, k_certNum);
//03. 1차 파싱
int inf1 = rec_cert.indexOf("/",0);
int inf2 = rec_cert.indexOf("/",inf1+1);
encPara = rec_cert.substring(0,inf1); //암호화된 통합 파라미터
encMsg1 = rec_cert.substring(inf1+1,inf2); //암호화된 통합 파라미터의 Hash값
//04. 위변조 검증
encMsg2 = seed.getMsg(encPara);
if(encMsg2.equals(encMsg1)){
msgChk="Y";
}
if(msgChk.equals("N")){
//alert("비정상적인 접근입니다.!!<%=msgChk%>");
return ResultCert.fail("비정상적인 접근입니다.");
}
//05. 2차 복호화
rec_cert = seed.getDec(encPara, k_certNum);
System.out.println("##########################################");
System.out.println(rec_cert);
//06. 2차 파싱
int info1 = rec_cert.indexOf("/",0);
int info2 = rec_cert.indexOf("/",info1+1);
int info3 = rec_cert.indexOf("/",info2+1);
int info4 = rec_cert.indexOf("/",info3+1);
int info5 = rec_cert.indexOf("/",info4+1);
int info6 = rec_cert.indexOf("/",info5+1);
int info7 = rec_cert.indexOf("/",info6+1);
int info8 = rec_cert.indexOf("/",info7+1);
int info9 = rec_cert.indexOf("/",info8+1);
int info10 = rec_cert.indexOf("/",info9+1);
int info11 = rec_cert.indexOf("/",info10+1);
int info12 = rec_cert.indexOf("/",info11+1);
int info13 = rec_cert.indexOf("/",info12+1);
int info14 = rec_cert.indexOf("/",info13+1);
int info15 = rec_cert.indexOf("/",info14+1);
int info16 = rec_cert.indexOf("/",info15+1);
int info17 = rec_cert.indexOf("/",info16+1);
int info18 = rec_cert.indexOf("/",info17+1);
certNum = rec_cert.substring(0,info1);
date = rec_cert.substring(info1+1,info2);
CI = rec_cert.substring(info2+1,info3);
phoneNo = rec_cert.substring(info3+1,info4);
phoneCorp = rec_cert.substring(info4+1,info5);
birthDay = rec_cert.substring(info5+1,info6);
gender = rec_cert.substring(info6+1,info7);
nation = rec_cert.substring(info7+1,info8);
name = rec_cert.substring(info8+1,info9);
result = rec_cert.substring(info9+1,info10);
certMet = rec_cert.substring(info10+1,info11);
ip = rec_cert.substring(info11+1,info12);
M_name = rec_cert.substring(info12+1,info13);
M_birthDay = rec_cert.substring(info13+1,info14);
M_Gender = rec_cert.substring(info14+1,info15);
M_nation = rec_cert.substring(info15+1,info16);
plusInfo = rec_cert.substring(info16+1,info17);
DI = rec_cert.substring(info17+1,info18);
//07. CI, DI 복호화
CI = seed.getDec(CI, k_certNum);
DI = seed.getDec(DI, k_certNum);
// 파라미터 유효성 검증 --------------------------------------------
boolean b = true;
String regex = "";
if( certNum.length() == 0 || certNum.length() > 40){
return ResultCert.fail("[오류] 요청번호 비정상");
}
regex = "[0-9]*";
if( date.length() != 14 || !paramChk(regex, date) ){
return ResultCert.fail("[오류] 요청일시 비정상");
}
regex = "[A-Z]*";
if( certMet.length() != 1 || !paramChk(regex, certMet) ){
return ResultCert.fail("[오류] 본인인증방법 비정상");
}
regex = "[0-9]*";
if( (phoneNo.length() != 10 && phoneNo.length() != 11) || !paramChk(regex, phoneNo) ){
return ResultCert.fail("[오류] 휴대폰번호 비정상");
}
regex = "[A-Z]*";
if( phoneCorp.length() != 3 || !paramChk(regex, phoneCorp) ){
return ResultCert.fail("[오류] 이동통신사 비정상");
}
regex = "[0-9]*";
if( birthDay.length() != 8 || !paramChk(regex, birthDay) ){
return ResultCert.fail("[오류] 생년월일 비정상");
}
regex = "[0-9]*";
if( gender.length() != 1 || !paramChk(regex, gender) ){
return ResultCert.fail("[오류] 성별 비정상");
}
regex = "[0-9]*";
if( nation.length() != 1 || !paramChk(regex, nation) ){
return ResultCert.fail("[오류] 내/외국인 비정상");
}
regex = "[\\sA-Za-z가-�R.,-]*";
if( name.length() > 60 || !paramChk(regex, name) ){
return ResultCert.fail("[오류] 성명 비정상");
}
regex = "[A-Z]*";
if( result.length() != 1 || !paramChk(regex, result) ){
return ResultCert.fail("[오류] 결과값 비정상");
}
regex = "[\\sA-Za-z가-?.,-]*";
if( M_name.length() != 0 ){
if( M_name.length() > 60 || !paramChk(regex, M_name) ){
return ResultCert.fail("[오류] 미성년자 성명 비정상");
}
}
regex = "[0-9]*";
if( M_birthDay.length() != 0 ){
if( M_birthDay.length() != 8 || !paramChk(regex, M_birthDay) ){
return ResultCert.fail("[오류] 미성년자 생년월일 비정상");
}
}
regex = "[0-9]*";
if( M_Gender.length() != 0 ){
if( M_Gender.length() != 1 || !paramChk(regex, M_Gender) ){
return ResultCert.fail("[오류] 미성년자 성별 비정상");
}
}
regex = "[0-9]*";
if( M_nation.length() != 0 ){
if( M_nation.length() != 1 || !paramChk(regex, M_nation) ){
return ResultCert.fail("[오류] 미성년자 내/외국인 비정상");
}
}
// End 파라미터 유효성 검증 --------------------------------------------
// Start - 수신내역 유효성 검증(사설망의 사설 IP로 인해 미사용, 공용망의 경우 확인 후 사용) *********************/
// 1. date 값 검증
SimpleDateFormat formatter = new SimpleDateFormat("yyyyMMddHHmmss", Locale.KOREAN); // 현재 서버 시각 구하기
String strCurrentTime = formatter.format(new Date());
try {
Date toDate = formatter.parse(strCurrentTime);
Date fromDate = formatter.parse(date);
long timediff = toDate.getTime()-fromDate.getTime();
if ( timediff < -30*60*1000 || 30*60*100 < timediff ){
//return ResultCert.fail("[오류] 비정상적인 접근입니다. (요청시간경과)");
}
} catch (ParseException e) {
//e.printStackTrace();
return ResultCert.fail("[오류] 비정상적인 접근입니다. (요청시간경과)-2");
}
// 2. ip 값 검증
String client_ip = clientIp;//request.getHeader("HTTP_X_FORWARDED_FOR"); // 사용자IP 구하기
/*
if ( client_ip != null ){
if( client_ip.indexOf(",") != -1 )
client_ip = client_ip.substring(0,client_ip.indexOf(","));
}
if ( client_ip==null || client_ip.length()==0 ){
client_ip = request.getRemoteAddr();
}
*/
/*
// 전화하니까 IP체크 하지 않아도 된다네 ㅡㅡ;;
if( !client_ip.equals(ip) ){
return ResultCert.fail("[오류] 비정상적인 접근입니다. (IP불일치)");
}
*/
ResultCert rValue = ResultCert.success();
rValue.setCertNum(certNum);
rValue.setDate(date);
rValue.setCI(CI);
rValue.setPhoneNo(phoneNo);
rValue.setPhoneCorp(phoneCorp);
rValue.setBirthDay(birthDay);
rValue.setGender(gender);
rValue.setNation(nation);
rValue.setName(name);
rValue.setResult(result);
rValue.setCertMet(certMet);
rValue.setIp(ip);
rValue.setM_name(M_name);
rValue.setM_birthDay(M_birthDay);
rValue.setM_Gender(M_Gender);
rValue.setM_nation(M_nation);
rValue.setPlusInfo(plusInfo);
rValue.setDI(DI);
rValue.setSuccess(true);
return rValue;
}
}
src/main/java/com/ns/mobile/website/config/CaptchaConfiguration.java
-18
View File
@@ -1,18 +0,0 @@
package com.ns.mobile.website.config;
import com.captcha.botdetect.web.servlet.CaptchaServlet;
import org.springframework.boot.web.servlet.ServletRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@Configuration
public class CaptchaConfiguration {
@Bean
public ServletRegistrationBean captchaServletRegistration() {
ServletRegistrationBean srb = new ServletRegistrationBean();
srb.setServlet(new CaptchaServlet());
srb.addUrlMappings("/botdetectcaptcha");
return srb;
}
}
src/main/java/com/ns/mobile/website/config/WebMvcConfiguration.java
-12
View File
@@ -3,7 +3,6 @@ package com.ns.mobile.website.config;
import com.ns.mobile.website.web.interceptor.FrontInterceptor;
import com.ns.mobile.website.biz.properties.FileUrlProperties;
import com.navercorp.lucy.security.xss.servletfilter.XssEscapeServletFilter;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@@ -20,17 +19,6 @@ public class WebMvcConfiguration implements WebMvcConfigurer {
this.fileUrlProperties = fileUrlProperties;
}
//Lucy Xss filter
@Bean
public FilterRegistrationBean<XssEscapeServletFilter> getFilterRegistrationBean() {
FilterRegistrationBean<XssEscapeServletFilter> filterRegistration = new FilterRegistrationBean<>();
filterRegistration.setFilter(new XssEscapeServletFilter());
filterRegistration.setOrder(1);
filterRegistration.addUrlPatterns("/*");
return filterRegistration;
}
@Bean
FrontInterceptor getFrontInterceptor() {
src/main/java/com/ns/mobile/website/web/auth/CertSessionUtils.java
-49
View File
@@ -1,49 +0,0 @@
package com.ns.mobile.website.web.auth;
import com.ns.mobile.website.common.util.StringUtils;
import com.ns.mobile.website.web.controller.extra.ResultCert;
import lombok.experimental.UtilityClass;
import org.apache.catalina.manager.util.SessionUtils;
import javax.servlet.http.HttpSession;
@UtilityClass
public class CertSessionUtils {
private final static String CERT_VALUE = "cert_value";
public static boolean isCert(HttpSession session) {
if (session != null && session.getAttribute(CERT_VALUE) != null) {
ResultCert resultCert = (ResultCert)session.getAttribute(CERT_VALUE);
return resultCert.isSuccess();
}
return false;
}
public static void setCert(HttpSession session, ResultCert resultCert) {
session.setAttribute(CERT_VALUE, resultCert);
}
public static String getCertPhone(HttpSession session) {
if (session != null && session.getAttribute(CERT_VALUE) != null) {
ResultCert resultCert = (ResultCert)session.getAttribute(CERT_VALUE);
return resultCert.getPhoneNo();
}
return StringUtils.Empty;
}
public static String getCertName(HttpSession session) {
if (session != null && session.getAttribute(CERT_VALUE) != null) {
ResultCert resultCert = (ResultCert)session.getAttribute(CERT_VALUE);
return resultCert.getName();
}
return StringUtils.Empty;
}
}
src/main/java/com/ns/mobile/website/web/auth/EmailSessionUtils.java
-1
View File
@@ -2,7 +2,6 @@ package com.ns.mobile.website.web.auth;
import com.ns.mobile.website.common.util.StringUtils;
import com.ns.mobile.website.web.controller.extra.ResultCert;
import lombok.experimental.UtilityClass;
import javax.servlet.http.HttpSession;
src/main/java/com/ns/mobile/website/web/controller/extra/ExtraCertController.java
-472
View File
@@ -1,472 +0,0 @@
package com.ns.mobile.website.web.controller.extra;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.Date;
import java.util.Locale;
import java.util.Random;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import com.ns.mobile.website.common.util.RequestUtils;
import com.ns.mobile.website.web.auth.CertSessionUtils;
import com.ns.mobile.website.web.auth.PublicAccess;
import com.ns.mobile.website.web.controller.BaseController;
import com.ns.mobile.website.web.properties.LaneduProperties;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
@Slf4j
@RequiredArgsConstructor
@Controller
public class ExtraCertController extends BaseController {
private final LaneduProperties laneduProperties;
private String getNow() {
return LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyyMMddHHmmss"));
}
private String getSeqNumber() {
LocalDateTime now = LocalDateTime.now();
int seq = (new Random()).nextInt(10000) + 1;
return String.format("%s%05d"
, now.format(DateTimeFormatter.ofPattern("yyyyMMddHHmmss"))
, seq);
}
private String getTrCertData(String actionType) {
//tr_cert 데이터 변수 선언 ---------------------------------------------------------------
String tr_cert = "";
String cpId = "KBZM1052"; // 회원사ID
String urlCode = "002001"; // URL코드
urlCode = "004001"; // - localhost - 회원가입
urlCode = "005001"; // - localhost:8080 - 회원가입
urlCode = laneduProperties.getPhoneUrlCode();
System.out.println("#######################");
System.out.println("#######################");
System.out.println("#######################");
System.out.println(urlCode);
String certNum = getSeqNumber(); // 요청번호 ( 본인인증 요청시 중복되지 않게 생성해야함. (예-시퀀스번호) )
String date = getNow(); // 요청일시
String certMet = "M"; // 본인인증방법
String name = ""; // 성명
String phoneNo = ""; // 휴대폰번호
String phoneCorp = ""; // 이동통신사
String birthDay = ""; // 생년월일
String gender = ""; // 성별
String nation = ""; // 내외국인 구분
String plusInfo = ""; // 추가DATA정보
String extendVar = "0000000000000000"; // 확장변수
//End-tr_cert 데이터 변수 선언 ---------------------------------------------------------------
plusInfo = actionType;
String tr_add = "N"; // IFrame사용여부
//01. 한국모바일인증(주) 암호화 모듈 선언
com.icert.comm.secu.IcertSecuManager seed = new com.icert.comm.secu.IcertSecuManager();
//02. 1차 암호화 (tr_cert 데이터변수 조합 후 암호화)
String enc_tr_cert = "";
tr_cert = cpId + "/" + urlCode + "/" + certNum + "/" + date + "/" + certMet + "/" + birthDay + "/" + gender + "/" + name + "/" + phoneNo + "/" + phoneCorp + "/" + nation + "/" + plusInfo + "/" + extendVar;
enc_tr_cert = seed.getEnc(tr_cert, "");
//03. 1차 암호화 데이터에 대한 위변조 검증값 생성 (HMAC)
String hmacMsg = "";
hmacMsg = seed.getMsg(enc_tr_cert);
//04. 2차 암호화 (1차 암호화 데이터, HMAC 데이터, extendVar 조합 후 암호화)
tr_cert = seed.getEnc(enc_tr_cert + "/" + hmacMsg + "/" + extendVar, "");
return tr_cert;
}
@PublicAccess
@GetMapping(value = {"/extra/cert"})
public String cert(Model model, HttpServletRequest request) {
String actionType = RequestUtils.getString(request, "actionType");
String trCertData = getTrCertData(actionType);
String trUrl = laneduProperties.getBaseSiteUrl() + "/extra/cert/result"; // 본인인증서비스 결과수신 POPUP URL
model.addAttribute("tr_cert", trCertData);
model.addAttribute("tr_url", trUrl);
model.addAttribute("tr_add", "N");
return "extra/cert";
}
private Boolean paramChk(String patn, String param) {
Pattern pattern = Pattern.compile(patn);
Matcher matcher = pattern.matcher(param);
return matcher.matches();
}
private ResultCert getTrCertData(String rec_cert, String k_certNum, String clientIp) {
// 파라미터 유효성 검증
if (rec_cert.length() == 0 || k_certNum.length() == 0) {
return ResultCert.fail("[오류] 결과값 비정상");
}
// 변수선언 --------------------------------------------------------------------------------------------------------
//String rec_cert = ""; // 결과수신DATA
//String k_certNum = ""; // 파라미터로 수신한 요청번호
String certNum = ""; // 요청번호
String date = ""; // 요청일시
String CI = ""; // 연계정보(CI)
String DI = ""; // 중복가입확인정보(DI)
String phoneNo = ""; // 휴대폰번호
String phoneCorp = ""; // 이동통신사
String birthDay = ""; // 생년월일
String gender = ""; // 성별
String nation = ""; // 내국인
String name = ""; // 성명
String M_name = ""; // 미성년자 성명
String M_birthDay = ""; // 미성년자 생년월일
String M_Gender = ""; // 미성년자 성별
String M_nation = ""; // 미성년자 내외국인
String result = ""; // 결과값
String certMet = ""; // 인증방법
String ip = ""; // ip주소
String plusInfo = "";
String encPara = "";
String encMsg1 = "";
String encMsg2 = "";
String msgChk = "";
//-----------------------------------------------------------------------------------------------------------------
//01. 암호화 모듈 (jar) Loading
com.icert.comm.secu.IcertSecuManager seed = new com.icert.comm.secu.IcertSecuManager();
//02. 1차 복호화
//수신된 certNum를 이용하여 복호화
rec_cert = seed.getDec(rec_cert, k_certNum);
//03. 1차 파싱
int inf1 = rec_cert.indexOf("/", 0);
int inf2 = rec_cert.indexOf("/", inf1 + 1);
encPara = rec_cert.substring(0, inf1); //암호화된 통합 파라미터
encMsg1 = rec_cert.substring(inf1 + 1, inf2); //암호화된 통합 파라미터의 Hash값
//04. 위변조 검증
encMsg2 = seed.getMsg(encPara);
if (encMsg2.equals(encMsg1)) {
msgChk = "Y";
}
if (msgChk.equals("N")) {
//alert("비정상적인 접근입니다.!!<%=msgChk%>");
return ResultCert.fail("비정상적인 접근입니다.");
}
//05. 2차 복호화
rec_cert = seed.getDec(encPara, k_certNum);
System.out.println("##########################################");
System.out.println(rec_cert);
//06. 2차 파싱
int info1 = rec_cert.indexOf("/", 0);
int info2 = rec_cert.indexOf("/", info1 + 1);
int info3 = rec_cert.indexOf("/", info2 + 1);
int info4 = rec_cert.indexOf("/", info3 + 1);
int info5 = rec_cert.indexOf("/", info4 + 1);
int info6 = rec_cert.indexOf("/", info5 + 1);
int info7 = rec_cert.indexOf("/", info6 + 1);
int info8 = rec_cert.indexOf("/", info7 + 1);
int info9 = rec_cert.indexOf("/", info8 + 1);
int info10 = rec_cert.indexOf("/", info9 + 1);
int info11 = rec_cert.indexOf("/", info10 + 1);
int info12 = rec_cert.indexOf("/", info11 + 1);
int info13 = rec_cert.indexOf("/", info12 + 1);
int info14 = rec_cert.indexOf("/", info13 + 1);
int info15 = rec_cert.indexOf("/", info14 + 1);
int info16 = rec_cert.indexOf("/", info15 + 1);
int info17 = rec_cert.indexOf("/", info16 + 1);
int info18 = rec_cert.indexOf("/", info17 + 1);
certNum = rec_cert.substring(0, info1);
date = rec_cert.substring(info1 + 1, info2);
CI = rec_cert.substring(info2 + 1, info3);
phoneNo = rec_cert.substring(info3 + 1, info4);
phoneCorp = rec_cert.substring(info4 + 1, info5);
birthDay = rec_cert.substring(info5 + 1, info6);
gender = rec_cert.substring(info6 + 1, info7);
nation = rec_cert.substring(info7 + 1, info8);
name = rec_cert.substring(info8 + 1, info9);
result = rec_cert.substring(info9 + 1, info10);
certMet = rec_cert.substring(info10 + 1, info11);
ip = rec_cert.substring(info11 + 1, info12);
M_name = rec_cert.substring(info12 + 1, info13);
M_birthDay = rec_cert.substring(info13 + 1, info14);
M_Gender = rec_cert.substring(info14 + 1, info15);
M_nation = rec_cert.substring(info15 + 1, info16);
plusInfo = rec_cert.substring(info16 + 1, info17);
DI = rec_cert.substring(info17 + 1, info18);
//07. CI, DI 복호화
CI = seed.getDec(CI, k_certNum);
DI = seed.getDec(DI, k_certNum);
// 파라미터 유효성 검증 --------------------------------------------
boolean b = true;
String regex = "";
if (certNum.length() == 0 || certNum.length() > 40) {
return ResultCert.fail("[오류] 요청번호 비정상");
}
regex = "[0-9]*";
if (date.length() != 14 || !paramChk(regex, date)) {
return ResultCert.fail("[오류] 요청일시 비정상");
}
regex = "[A-Z]*";
if (certMet.length() != 1 || !paramChk(regex, certMet)) {
return ResultCert.fail("[오류] 본인인증방법 비정상");
}
regex = "[0-9]*";
if ((phoneNo.length() != 10 && phoneNo.length() != 11) || !paramChk(regex, phoneNo)) {
return ResultCert.fail("[오류] 휴대폰번호 비정상");
}
regex = "[A-Z]*";
if (phoneCorp.length() != 3 || !paramChk(regex, phoneCorp)) {
return ResultCert.fail("[오류] 이동통신사 비정상");
}
regex = "[0-9]*";
if (birthDay.length() != 8 || !paramChk(regex, birthDay)) {
return ResultCert.fail("[오류] 생년월일 비정상");
}
regex = "[0-9]*";
if (gender.length() != 1 || !paramChk(regex, gender)) {
return ResultCert.fail("[오류] 성별 비정상");
}
regex = "[0-9]*";
if (nation.length() != 1 || !paramChk(regex, nation)) {
return ResultCert.fail("[오류] 내/외국인 비정상");
}
regex = "[\\sA-Za-z가-�R.,-]*";
if (name.length() > 60 || !paramChk(regex, name)) {
return ResultCert.fail("[오류] 성명 비정상");
}
regex = "[A-Z]*";
if (result.length() != 1 || !paramChk(regex, result)) {
return ResultCert.fail("[오류] 결과값 비정상");
}
regex = "[\\sA-Za-z가-?.,-]*";
if (M_name.length() != 0) {
if (M_name.length() > 60 || !paramChk(regex, M_name)) {
return ResultCert.fail("[오류] 미성년자 성명 비정상");
}
}
regex = "[0-9]*";
if (M_birthDay.length() != 0) {
if (M_birthDay.length() != 8 || !paramChk(regex, M_birthDay)) {
return ResultCert.fail("[오류] 미성년자 생년월일 비정상");
}
}
regex = "[0-9]*";
if (M_Gender.length() != 0) {
if (M_Gender.length() != 1 || !paramChk(regex, M_Gender)) {
return ResultCert.fail("[오류] 미성년자 성별 비정상");
}
}
regex = "[0-9]*";
if (M_nation.length() != 0) {
if (M_nation.length() != 1 || !paramChk(regex, M_nation)) {
return ResultCert.fail("[오류] 미성년자 내/외국인 비정상");
}
}
// End 파라미터 유효성 검증 --------------------------------------------
// Start - 수신내역 유효성 검증(사설망의 사설 IP로 인해 미사용, 공용망의 경우 확인 후 사용) *********************/
// 1. date 값 검증
SimpleDateFormat formatter = new SimpleDateFormat("yyyyMMddHHmmss", Locale.KOREAN); // 현재 서버 시각 구하기
String strCurrentTime = formatter.format(new Date());
try {
Date toDate = formatter.parse(strCurrentTime);
Date fromDate = formatter.parse(date);
long timediff = toDate.getTime() - fromDate.getTime();
if (timediff < -30 * 60 * 1000 || 30 * 60 * 100 < timediff) {
//return ResultCert.fail("[오류] 비정상적인 접근입니다. (요청시간경과)");
}
} catch (ParseException e) {
//e.printStackTrace();
return ResultCert.fail("[오류] 비정상적인 접근입니다. (요청시간경과)-2");
}
// 2. ip 값 검증
String client_ip = clientIp;//request.getHeader("HTTP_X_FORWARDED_FOR"); // 사용자IP 구하기
/*
if ( client_ip != null ){
if( client_ip.indexOf(",") != -1 )
client_ip = client_ip.substring(0,client_ip.indexOf(","));
}
if ( client_ip==null || client_ip.length()==0 ){
client_ip = request.getRemoteAddr();
}
*/
/*
// 전화하니까 IP체크 하지 않아도 된다네 ㅡㅡ;;
if( !client_ip.equals(ip) ){
return ResultCert.fail("[오류] 비정상적인 접근입니다. (IP불일치)");
}
*/
ResultCert rValue = ResultCert.success();
rValue.setCertNum(certNum);
rValue.setDate(date);
rValue.setCI(CI);
rValue.setPhoneNo(phoneNo);
rValue.setPhoneCorp(phoneCorp);
rValue.setBirthDay(birthDay);
rValue.setGender(gender);
rValue.setNation(nation);
rValue.setName(name);
rValue.setResult(result);
rValue.setCertMet(certMet);
rValue.setIp(ip);
rValue.setM_name(M_name);
rValue.setM_birthDay(M_birthDay);
rValue.setM_Gender(M_Gender);
rValue.setM_nation(M_nation);
rValue.setPlusInfo(plusInfo);
rValue.setDI(DI);
rValue.setSuccess(true);
return rValue;
}
//http://lanedu.aircode.kr/extra/cert/result
//http://localhost:8081/extra/cert/result
@PublicAccess
@RequestMapping("/extra/cert/result")
public String certResult(Model model, HttpServletRequest request, HttpServletResponse response, HttpSession session) {
String rec_cert = ""; // 결과값(암호화)
String certNum = ""; // certNum
rec_cert = RequestUtils.getString(request, "rec_cert").trim();
certNum = RequestUtils.getString(request, "certNum").trim();
ResultCert resultCert = null;
try {
resultCert = getTrCertData(rec_cert, certNum, RequestUtils.getClientIP(request));
} catch (Exception e) {
log.info(e.getMessage());
resultCert = ResultCert.fail(e.getMessage());
}
//02-2033-8565
/*
resultCert.setSuccess(true);
resultCert.setPhoneNo("01096128903");
resultCert.setBirthDay("19760820");
resultCert.setName("박규태");
*/
if ("FIND_UID".equals(resultCert.getPlusInfo())) {
//인증한 핸드폰에 대한 정보가 존재하는지 확인 후 처리
// if (!userService.existPhone(resultCert.getPhoneNo())) {
// resultCert = ResultCert.fail("가입된 전화번호가 아닙니다.");
// model.addAttribute("resultCert", resultCert);
// return "extra/cert_result";
// }
}
CertSessionUtils.setCert(session, resultCert);
//ResultCert(
// success=true,
// errorMessage=null,
// encMsg1=null,
// encMsg2=null,
// certNum=2021070110295605344,
// date=20210701102956,
// CI=oKnuCufcXakGshtAl37Fxnl8UrbQuPFlC6UoJMhqZo/f2MzZcdOKeTdNyluNqiUxRsj27/E4QobkAIyxtz+ASw==,
// DI=MC0GCCqGSIb3DQIJAyEAas6UAn1woyuHzcEY7MVDMCQcR0aO8cXjfpEnCjDpCDE=,
// phoneNo=01096128901,
// phoneCorp=LGT,
// birthDay=19760820,
// nation=0,
// gender=0,
// name=박규태,
// result=Y,
// certMet=M,
// ip=61.74.252.104,
// M_name=,
// M_birthDay=,
// M_Gender=,
// M_nation=,
// plusInfo=,
// rec_cert=null
// )
System.out.println("##################################");
System.out.println(resultCert.toString());
model.addAttribute("resultCert", resultCert);
return "extra/cert_result";
}
}
src/main/java/com/ns/mobile/website/web/controller/extra/ResultCert.java
-62
View File
@@ -1,62 +0,0 @@
package com.ns.mobile.website.web.controller.extra;
import lombok.Builder;
import lombok.Data;
import lombok.NoArgsConstructor;
import lombok.experimental.SuperBuilder;
import lombok.extern.slf4j.Slf4j;
import java.io.Serializable;
@Slf4j
@Data
@SuperBuilder
public class ResultCert implements Serializable {
private static final long serialVersionUID = -3895896097653379454L;
private boolean success;
private String errorMessage;
String encMsg1;//위,변조여부1
String encMsg2;//위,변조여부2
String certNum;//요청번호
String date;//요청일시
String CI;//연계정보(CI)
String DI;//중복가입확인정보(DI)
String phoneNo;//휴대폰번호
String phoneCorp;//이동통신사
String birthDay;//생년월일
String nation;//내국인
String gender;//성별
String name;//성명
String result;//결과값
String certMet;//인증방법
String ip;//ip주소
String M_name;//미성년자 성명
String M_birthDay;//미성년자 생년월일
String M_Gender;//미성년자 성별
String M_nation;//미성년자 내외국인
String plusInfo;//추가DATA정보
String rec_cert;
public static ResultCert fail(String errorMessage) {
return ResultCert.builder()
.success(false)
.errorMessage(errorMessage)
.build();
}
public static ResultCert success() {
return ResultCert.builder()
.success(true)
.build();
}
public boolean isFail() {
return !success;
}
}
src/main/resources/lucy-xss-servlet-filter-rule.xml
-73
View File
@@ -1,73 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<config xmlns="http://www.navercorp.com/lucy-xss-servlet">
<defenders>
<!-- XssPreventer 등록 -->
<defender>
<name>xssPreventerDefender</name>
<class>com.navercorp.lucy.security.xss.servletfilter.defender.XssPreventerDefender</class>
</defender>
<!-- XssSaxFilter 등록 -->
<defender>
<name>xssSaxFilterDefender</name>
<class>com.navercorp.lucy.security.xss.servletfilter.defender.XssSaxFilterDefender</class>
<init-param>
<param-value>lucy-xss-sax.xml</param-value> <!-- lucy-xss-filter의 sax용 설정파일 -->
<param-value>false</param-value> <!-- 필터링된 코멘트를 남길지 여부, 성능 효율상 false 추천 -->
</init-param>
</defender>
<!-- XssFilter 등록 -->
<defender>
<name>xssFilterDefender</name>
<class>com.navercorp.lucy.security.xss.servletfilter.defender.XssFilterDefender</class>
<init-param>
<param-value>lucy-xss.xml</param-value> <!-- lucy-xss-filter의 dom용 설정파일 -->
<param-value>false</param-value> <!-- 필터링된 코멘트를 남길지 여부, 성능 효율상 false 추천 -->
</init-param>
</defender>
</defenders>
<!-- default defender 선언, 별다른 defender 선언이 없으면 default defender를 사용해 필터링 한다. -->
<default>
<defender>xssPreventerDefender</defender>
</default>
<!-- global 필터링 룰 선언 -->
<global>
<!-- 모든 url에서 들어오는 globalParameter 파라메터는 필터링 되지 않으며
또한 globalPrefixParameter로 시작하는 파라메터도 필터링 되지 않는다. -->
<params>
<param name="globalParameter" useDefender="false"/>
<param name="globalPrefixParameter" usePrefix="true" useDefender="false"/>
</params>
</global>
<!-- url 별 필터링 룰 선언 -->
<url-rule-set>
<!-- url disable이 true이면 지정한 url 내의 모든 파라메터는 필터링 되지 않는다. -->
<url-rule>
<url disable="true">/disableUrl1.do</url>
</url-rule>
<!-- url1 내의 url1Parameter는 필터링 되지 않으며 또한 url1PrefixParameter로 시작하는 파라메터도 필터링 되지 않는다. -->
<url-rule>
<url>/url1.do</url>
<params>
<param name="url1Parameter" useDefender="false"/>
<param name="url1PrefixParameter" usePrefix="true" useDefender="false"/>
</params>
</url-rule>
<!-- url2 내의 url2Parameter1만 필터링 되지 않으며 url2Parameter2는 xssSaxFilterDefender를 사용해 필터링 한다. -->
<url-rule>
<url>/url2.do</url>
<params>
<param name="url2Parameter1" useDefender="false"/>
<param name="url2Parameter2">
<defender>xssSaxFilterDefender</defender>
</param>
</params>
</url-rule>
</url-rule-set>
</config>
src/main/resources/lucy-xss-superset-sax.xml
-39
View File
@@ -1,39 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<config xmlns="http://www.nhncorp.com/lucy-xss"
extends="lucy-xss-default-sax.xml">
<elementRule>
<element name="body" disable="true" /> <!-- <BODY ONLOAD=alert("XSS")>, <BODY BACKGROUND="javascript:alert('XSS')"> -->
<element name="embed" disable="true" />
<element name="iframe" disable="true" /> <!-- <IFRAME SRC=”http://hacker-site.com/xss.html”> -->
<element name="meta" disable="true" />
<element name="object" disable="true" />
<element name="script" disable="true" /> <!-- <SCRIPT> alert(“XSS”); </SCRIPT> -->
<element name="style" disable="true" />
<element name="link" disable="true" />
<element name="base" disable="true" />
</elementRule>
<attributeRule>
<attribute name="data" base64Decoding="true">
<notAllowedPattern><![CDATA[(?i:s\\*c\\*r\\*i\\*p\\*t\\*:)]]></notAllowedPattern>
<notAllowedPattern><![CDATA[(?i:d\\*a\\*t\\*a\\*:)]]></notAllowedPattern>
<notAllowedPattern><![CDATA[&[#\\%x]+[\da-fA-F][\da-fA-F]+]]></notAllowedPattern>
</attribute>
<attribute name="src" base64Decoding="true">
<notAllowedPattern><![CDATA[(?i:s\\*c\\*r\\*i\\*p\\*t\\*:)]]></notAllowedPattern>
<notAllowedPattern><![CDATA[(?i:d\\*a\\*t\\*a\\*:)]]></notAllowedPattern>
<notAllowedPattern><![CDATA[&[#\\%x]+[\da-fA-F][\da-fA-F]+]]></notAllowedPattern>
</attribute>
<attribute name="style">
<notAllowedPattern><![CDATA[(?i:j\\*a\\*v\\*a\\*s\\*c\\*r\\*i\\*p\\*t\\*:)]]></notAllowedPattern>
<notAllowedPattern><![CDATA[(?i:e\\*x\\*p\\*r\\*e\\*s\\*s\\*i\\*o\\*n)]]></notAllowedPattern>
<notAllowedPattern><![CDATA[&[#\\%x]+[\da-fA-F][\da-fA-F]+]]></notAllowedPattern>
</attribute>
<attribute name="href">
<notAllowedPattern><![CDATA[(?i:j\\*a\\*v\\*a\\*s\\*c\\*r\\*i\\*p\\*t\\*:)]]></notAllowedPattern>
</attribute>
</attributeRule>
</config>