客户端跨框架脚本攻击解决方案
[英]Client Cross Frame Scripting Attack resolution
问题描述
We have developed a new application, and before moving the changes we did a static scan of code using checkmarx. 
我们开发了一个新的应用程序，在移动更改之前，我们使用checkmarx对代码进行了静态扫描。 There is a medium level vulnerablity that is found in the code named Client Cross Frame Scripting Attack. 在名为Client Cross Frame Scripting Attack的代码中可以找到中等级别的漏洞。
This is detacted at first line of the JSP page : 这在JSP页面的第一行被删除：
<!DOCTYPE html>
Can you please help me understand this attack and what should be done to eliminate this? 你能帮助我理解这次攻击吗？应该采取什么措施来消除这种攻击？
3 个解决方案
解决方案1
5 2015-01-12 12:07:49
The Client Cross Site Scripting Attack query finds if the page protects itself against being embedded in an IFrame. 客户端跨站点脚本攻击查询查找页面是否保护自己不嵌入IFrame。 It searches for conditions such as: 它搜索以下条件：
if (top != self)
if (top.location != location)
if (top.frames.length != 0)
and so on. 等等。
This specific file, I believe, has no such conditions, so it MOST LIKELY does not protect itself, and this is why the query has found and marked it. 我相信这个特定的文件没有这样的条件，所以它最不能保护自己，这就是查询找到并标记它的原因。 Since we are looking for a missing line here, the result just shows you the file, and cannot show you where the problem is. 由于我们在这里寻找缺失的行，结果只显示文件，并且无法显示问题所在。
Hope it helps, 希望能帮助到你，
Adar from Checkmarx . 来自Checkmarx的 Adar。
解决方案2
1 2015-03-17 17:35:08
For more depth to this issue, and to actually fix the Cross-Frame Scripting problem check out https://css-tricks.com/snippets/javascript/break-out-of-iframe/ 有关此问题的更深入，并实际修复跨框架脚本问题，请查看https://css-tricks.com/snippets/javascript/break-out-of-iframe/
Basically throw this into your parent-most layout file (_Layout.cshtml in C# MVC) 基本上把它扔进你父亲的布局文件（C＃MVC中的_Layout.cshtml）
(function (window) { // Prevent Cross-Frame Scripting attacks
if (window.location !== window.top.location)
window.top.location = window.location;
})(this);
解决方案3
1 2017-01-13 06:27:18
Just add the following piece of code in your HTML file. 只需在HTML文件中添加以下代码即可。
<style id='antiClickjack'>
body{display:none !important;}
</style>
<script type='text/javascript'>
if (self === top) {
var antiClickjack = document.getElementById('antiClickjack');
antiClickjack.parentNode.removeChild(antiClickjack);
} else {
top.location = self.location;
}
</script>
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.