Vulnerability-goapp-Go语言漏洞平台审计过程

func Login(w http.ResponseWriter, r *http.Request) { // r为请求对象，w为返回对象
fmt.Println("method ", r.Method) // 通过r.Method获取请求的方式
if r.Method == "GET" {
if cookie.CheckSessionID(r) { // 通过CheckSessionID函数检查是否登录
http.Redirect(w, r, "/top", 302) // 登录了就直接跳转到top
} else {
t, _ := template.ParseFiles("./views/public/login.gtpl") // 读入模板文件
t.Execute(w, nil) // 模板解析并返回
}
} else if r.Method == "POST" {
        r.ParseForm() // 解析获取到的数据，GET/POST解析都要有这个语句才能使用r.Form[]
if isZeroString(r.FormValue("mail")) && isZeroString(r.FormValue("passwd")) {
fmt.Println("passwd", r.Form["passwd"])
fmt.Println("mail", r.Form["mail"])
            // r.FormValue和r.Form的区别是前者只获取同名的第一个数据值，后者会返回一个slice(数组形式)
mail := r.FormValue("mail")
id := SearchID(mail) // 通过邮箱获取一个用户id
if id != 0 { 
passwd := r.FormValue("passwd")
name := CheckPasswd(id, passwd) // 验证密码
if name != "" { // 如果登录成功
fmt.Println(name) 
t, _ := template.ParseFiles("./views/public/logined.gtpl") // 读入logined.gtpl模板
encodeMail := base64.StdEncoding.EncodeToString([]byte(mail))
fmt.Println(encodeMail)
cookieSID := &http.Cookie{
Name:  "SessionID",
Value: encodeMail,
}
cookieUserName := &http.Cookie{
Name:  "UserName",
Value: name,
}
StoreSID(id, encodeMail)
http.SetCookie(w, cookieUserName)
http.SetCookie(w, cookieSID)
                    // 以上部分是设置Cookies
p := Person{UserName: name} // 这里定义了p，传递到模板中进行解析
t.Execute(w, p) // 模板解析
} else {
fmt.Println(name)
t, _ := template.ParseFiles("./views/public/error.gtpl")
t.Execute(w, nil)
}
} else {
t, _ := template.ParseFiles("./views/public/error.gtpl")
t.Execute(w, nil)
}

} else {
fmt.Println("username or passwd are empty")
outErrorPage(w)
}
} else {
http.NotFound(w, nil)
}
}

func sayYourName(w http.ResponseWriter, r *http.Request) {
r.ParseForm()
fmt.Println(r.Form)
fmt.Println("path", r.URL.Path)
fmt.Println("scheme", r.URL.Scheme)
fmt.Println("r.Form", r.Form)
fmt.Println("r.Form[name]", r.Form["name"])
var Name string
for k, v := range r.Form { // 循环获取GET与POST参数与参数值
fmt.Println("key:", k)
Name = strings.Join(v, ",") // 将多个定义的参数进行拼接
}
fmt.Println(Name)
fmt.Fprintf(w, Name)
}

func RegisterUser(r *http.Request) bool {
db, err := sql.Open("mysql", "root:root@tcp(127.0.0.1:3306)/vulnapp")
if err != nil {
log.Fatal(err)
}
age, err := strconv.Atoi(r.FormValue("age"))
if err != nil {
fmt.Println(err)
return false
}
_, err = db.Exec("insert into user (name,mail,age,passwd) value(?,?,?,?)", r.FormValue("name"), r.FormValue("mail"), age, r.FormValue("passwd")) // value值都是从FormValue当中获取的
if err != nil {
fmt.Println(err)
return false
}
return true
}

func UpdateUserDetails(w http.ResponseWriter, r *http.Request) {
// 部分源码经过省略
    _, err = db.Exec("insert into vulnapp.userdetails (uid,userimage,address,animal,word) values (?,?,?,?,?)", uid, "noimage.png", address, animal, word)
    if err != nil {
        fmt.Printf("%+v\n", err)
        http.NotFound(w, nil)
        return
    }
}
// 部分源码经过省略

func ShowAddPostPage(w http.ResponseWriter, r *http.Request) {
if r.Method == "GET" {
// 代码经过省略
} else if r.Method == "POST" {
if cookie.CheckSessionID(r) {
// 代码经过省略
postText := r.FormValue("post")
fmt.Println(reflect.TypeOf(postText))
StorePost(uid, postText) // 传递到这
http.Redirect(w, r, "/post", 301)
}
} else {
http.NotFound(w, nil)
}
}

func StorePost(uid int, postText string) {
db, err := sql.Open("mysql", "root:root@tcp(127.0.0.1:3306)/vulnapp")
if err != nil {
fmt.Printf("%+v\n", err)
return
}
defer db.Close()

_, err = db.Exec("insert into vulnapp.posts(uid,post) values (?,?)", uid, postText) // 前面都没有经过过滤
if err != nil {
fmt.Printf("%+v\n", err)
return
}
}

if err := db.QueryRow("select id from user where mail=?", mail).Scan(&userID); err != nil {
fmt.Println("no set :", err)
}
log.Println(userID)

func SearchPosts(w http.ResponseWriter, r *http.Request) {
if r.Method == "POST" {
searchWord := r.FormValue("post")
fmt.Println("value : ", searchWord)
testStr := "mysql -h 127.0.0.1 -u root -proot -e 'select post,created_at from vulnapp.posts where post like \"%" + searchWord + "%\"'"
fmt.Println(testStr)
testres, err := exec.Command("sh", "-c", testStr).Output()
// 部分源码经过省略
} else {
http.NotFound(w, nil)
}
}

func UploadImage(w http.ResponseWriter, r *http.Request) {
if r.Method == "POST" {
// 部分源码经过省略 
if cookie.CheckSessionID(r) {
file, handler, err := r.FormFile("uploadfile")  // 获取文件数据
if err != nil {
fmt.Printf("%+v\n", err)
return
}
defer file.Close() 
f, err := os.OpenFile("./assets/img/"+handler.Filename, os.O_WRONLY|os.O_CREATE, 0666)
            // 创建一个文件
if err != nil {
fmt.Printf("%+v\n", err)
return
}
defer f.Close()
io.Copy(f, file) // 将获取到的文件数据写入到本地创建的那个文件中去
UpdateDatabase(r, handler.Filename) // 更新数据库中的用户信息
            http.Redirect(w, r, "/profile", 301)
}
} else {
http.NotFound(w, nil)
}
}

func ShowAdminPage(w http.ResponseWriter, r *http.Request) {
if r.Method == "GET" {
adminSID, err := r.Cookie("adminSID") // 通过Cookie获取adminSID
if err != nil {
fmt.Printf("%+v\n", err)
}
fmt.Println(adminSID.Value)
adminUid, err := GetAdminSid(adminSID.Value) // 调用了GetAdminSid
// 部分源码经过省略 
} else {
http.NotFound(w, nil)
}
}

func GetAdminSid(adminSessionCookie string) (results string, err error) {
commandLine := "mysql -h mysql -u root -prootwolf -e 'select adminsid from vulnapp.adminsessions where adminsessionid=\"" + adminSessionCookie + "\";'"
res, err := exec.Command("sh", "-c", commandLine).Output()
if err != nil {
fmt.Println(err)
}
results = string(res)
if results != "" {
return results, nil
}
err = xerrors.New("recode was not set")
return "", err
}

func ConfirmPasswdChange(w http.ResponseWriter, r *http.Request) {
if r.Method == "POST" {
if cookie.CheckSessionID(r) {
if r.Referer() == "http://127.0.0.1/profile/changepasswd" {
// 接着进行修改密码的操作
} else {
http.NotFound(w, nil)
}
}