{"@attributes":{"version":"2.0"},"channel":{"title":"Documentation \u2013 G\u00fcvenlik Notlar\u0131","link":"https:\/\/docs.aspose.com\/words\/tr\/java\/security\/","description":"Recent content in G\u00fcvenlik Notlar\u0131 on Documentation","generator":"Hugo -- gohugo.io","language":"tr","item":{"title":"Java: Kaynaklar\u0131 Y\u00fcklerken Web Uygulama G\u00fcvenli\u011fi","link":"https:\/\/docs.aspose.com\/words\/tr\/java\/web-applications-security-when-loading-external-resources\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/docs.aspose.com\/words\/tr\/java\/web-applications-security-when-loading-external-resources\/","description":"\n        \n        \n        <p>Varsay\u0131lan olarak, Aspose.Words i\u00e7in Java uzak kaynaklar\u0131, \u00f6rne\u011fin resimleri, CSS stilleri veya harici HTML belgelerini bir belge i\u00e7eri aktar\u0131rken veya g\u00f6r\u00fcnt\u00fcleri eklarken y\u00fckleyebilir. Bu davran\u0131\u015f belgeleri ayr\u0131nt\u0131l\u0131 olarak i\u015flemenizi sa\u011flar ancak k\u00fct\u00fcphane bir web uygulamas\u0131n\u0131n par\u00e7as\u0131d\u0131rsa g\u00fcvenlik riskleri olu\u015fturur.<\/p>\n<p>Bu makale, d\u0131\u015f kaynak y\u00fcklerken ortaya \u00e7\u0131kabilecek yayg\u0131n g\u00fcvenlik sorunlar\u0131na bak\u0131yor ve bu t\u00fcr problemleri \u00f6nlemek i\u00e7in tavsiyeler veriyor.<\/p>\n\n\n<div class=\"alert alert-primary\" role=\"alert\">\n\nAspose.Words bir antivir\u00fcs yaz\u0131l\u0131m\u0131 olarak i\u015flev g\u00f6rmez. Bu nedenle, belge i\u00e7inde k\u00f6t\u00fc ama\u00e7l\u0131 bile\u015fenlerin varl\u0131\u011f\u0131 hakk\u0131nda bilgi sa\u011flamaz. Verilerinizin g\u00fcvenli\u011fini sa\u011flamak i\u00e7in, bir d\u0131\u015f kaynaktan elde edilen belgeleri kendiniz kontrol edin. Buna kar\u015f\u0131l\u0131k, Aspose.Words harici kaynaklar\u0131n y\u00fcklenmesinde ortaya \u00e7\u0131kabilecek sorunlarla ba\u015fa \u00e7\u0131kmak i\u00e7in nas\u0131l davran\u0131lmas\u0131 gerekti\u011fi konusunda tavsiyeler sa\u011flar.\n<\/div>\n\n<h2 id=\"g\u00fcvenlik-sorunlar\u0131\">G\u00fcvenlik Sorunlar\u0131<\/h2>\n<p>D\u0131\u015f kaynak y\u00fcklerken bir dizi tipik g\u00fcvenlik sorunu vard\u0131r.<\/p>\n<h3 id=\"ba\u011fl\u0131-g\u00f6rseller-aras\u0131nda-kimlik-bilgisi-a\u00e7\u0131klamas\u0131\">Ba\u011fl\u0131 G\u00f6rseller Aras\u0131nda Kimlik Bilgisi A\u00e7\u0131klamas\u0131<\/h3>\n<p>Ba\u015flang\u0131\u00e7 Windows tabanl\u0131 ana bilgisayarlar, UNC yollar\u0131n\u0131 kullanan kaynaklara ba\u015fvuran belgeler gibi varsay\u0131lan olarak i\u015flenecektir * \u2018 \\ example.com \\ a \\ b *. Bir etki alan\u0131 ortam\u0131nda, bu ana bilgisayar\u0131n belirtilen sunucuya karma bir bi\u00e7imde etki alan\u0131 kimlik bilgilerini g\u00f6ndermesine neden olacakt\u0131r.<\/p>\n<p>E\u011fer bir sald\u0131rgan, bir kullan\u0131c\u0131y\u0131 veya sunucuyu, bu t\u00fcr bir kaynak ba\u011flant\u0131s\u0131 ile i\u015faretlenmi\u015f bir belgeyi i\u015flemek i\u00e7in ikna edebiliyorsa, sald\u0131rgan kullan\u0131c\u0131 veya hizmet hesab\u0131 kimlik bilgilerini NTLM karmas\u0131 bi\u00e7iminde alacak. Bu veriler daha sonra bir klasik hash ge\u00e7me sald\u0131r\u0131s\u0131 ile yeniden kullan\u0131labilir, b\u00f6ylece sald\u0131rgan\u0131n ma\u011fdur kullan\u0131c\u0131 veya hizmet hesab\u0131 olarak herhangi bir kayna\u011fa eri\u015fmesine izin verilir.<\/p>\n<p>Soru i\u015flenen hesap zay\u0131f veya tahmin edilebilir bir parolay\u0131 kullan\u0131yorsa, sald\u0131rgan ayr\u0131ca bir parola k\u0131rma sald\u0131r\u0131s\u0131 ger\u00e7ekle\u015ftirebilir ve hesab\u0131n parolas\u0131n\u0131 k\u00f6t\u00fc ama\u00e7larla tekrar kullanmak i\u00e7in kurtarabilir.<\/p>\n<h3 id=\"yerel-g\u00f6r\u00fcnt\u00fc-a\u00e7\u0131klama-ba\u011flant\u0131l\u0131-g\u00f6r\u00fcnt\u00fclerle\">Yerel G\u00f6r\u00fcnt\u00fc A\u00e7\u0131klama Ba\u011flant\u0131l\u0131 G\u00f6r\u00fcnt\u00fclerle<\/h3>\n<p>\u00d6nceki \u00f6rnekte oldu\u011fu gibi, yerel bir g\u00f6r\u00fcnt\u00fc dosyas\u0131na referans i\u00e7eren bir belgeyi i\u015flemek bu dosyan\u0131n son belgeye dahil edilmesine yol a\u00e7acakt\u0131r. Bu hassas bilgilerin a\u00e7\u0131\u011fa \u00e7\u0131kar\u0131lmas\u0131na yol a\u00e7abilir.<\/p>\n<h3 id=\"hizmet-reddi\">Hizmet Reddi<\/h3>\n<p>Bir sald\u0131rgan, ya referans verdi ya da \u00e7ok b\u00fcy\u00fck resimleri dahil eden bir belgeyi y\u00fckleyebilir - bu &ldquo;bo\u015faltma bombalar\u0131&rdquo; olarak adland\u0131r\u0131lan. Bu g\u00f6r\u00fcnt\u00fcleri i\u015flerken, k\u00fct\u00fcphane b\u00fcy\u00fck miktarda bellek ve CPU zaman\u0131 t\u00fcketecek.<\/p>\n<h3 id=\"server---ba\u011flant\u0131l\u0131-i\u00e7erik-ile-yan\u0131lt\u0131c\u0131-istek\">Server - Ba\u011flant\u0131l\u0131 \u0130\u00e7erik \u0130le Yan\u0131lt\u0131c\u0131 \u0130stek<\/h3>\n<p>Sald\u0131rganlar, i\u00e7 IP adresi ve ba\u011flant\u0131 noktas\u0131 i\u00e7eren yayg\u0131n kombinasyonlarda g\u00f6m\u00fcl\u00fc ba\u011flant\u0131lar i\u00e7eren bir dizi belge olu\u015fturabilir, ard\u0131ndan bunlar\u0131 Aspose.Words k\u00fct\u00fcphanesini kullanarak belgeleri i\u015flemek i\u00e7in bir web hizmetine g\u00f6nderebilirler.<\/p>\n<p>Hizmetin bir belgeyi i\u015flemek i\u00e7in kulland\u0131\u011f\u0131 s\u00fcreye dayal\u0131 olarak, bir sald\u0131rgan belirli bir IP\/port kombinasyonunun bir g\u00fcvenlik duvar\u0131 taraf\u0131ndan filtrelenip filtrelenmedi\u011fini belirleyebilir:<\/p>\n<ul>\n<li>daha uzun i\u015flem s\u00fcresi, sunucunun g\u00f6nderdi\u011fi TCP SYN paketinin bir g\u00fcvenlik duvar\u0131 taraf\u0131ndan b\u0131rak\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6sterir<\/li>\n<li>h\u0131zl\u0131 i\u015flem s\u00fcresi ba\u015far\u0131l\u0131 bir ba\u011flant\u0131 yap\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6sterir<\/li>\n<\/ul>\n<h2 id=\"g\u00fcvenlik-sorunlar\u0131n\u0131n-\u00e7\u00f6z\u00fcmleri\">G\u00fcvenlik Sorunlar\u0131n\u0131n \u00c7\u00f6z\u00fcmleri<\/h2>\n<p>Yukar\u0131da a\u00e7\u0131klanan sorunlar\u0131 \u00e7\u00f6zmek ve internet uygulamalar\u0131n\u0131n g\u00fcvenli\u011fini geli\u015ftirmek i\u00e7in, <a href=\"https:\/\/reference.aspose.com\/words\/java\/com.aspose.words\/iresourceloadingcallback\/\">IResourceLoadingCallback<\/a> kullanarak harici kaynaklar\u0131n y\u00fcklenmesini kontrol edebilir veya devre d\u0131\u015f\u0131 b\u0131rakabilirsiniz.<\/p>\n<p>A\u015fa\u011f\u0131daki kod \u00f6rne\u011fi, harici resim y\u00fcklemesini devre d\u0131\u015f\u0131 b\u0131rakmay\u0131 g\u00f6sterir:<\/p>\n<p><strong>Java<\/strong>\n<div class=\"highlight\"><pre class=\"chroma\"><code class=\"language-csharp\" data-lang=\"csharp\"><span class=\"k\">public<\/span> <span class=\"k\">void<\/span> <span class=\"n\">loadDocument<\/span><span class=\"p\">(<\/span><span class=\"n\">String<\/span> <span class=\"n\">documentFilename<\/span><span class=\"p\">)<\/span> <span class=\"n\">throws<\/span> <span class=\"n\">Exception<\/span>\n<span class=\"p\">{<\/span>\n\t<span class=\"n\">LoadOptions<\/span> <span class=\"n\">disableExternalImagesOptions<\/span> <span class=\"p\">=<\/span> <span class=\"k\">new<\/span> <span class=\"n\">LoadOptions<\/span><span class=\"p\">();<\/span>\n\t<span class=\"n\">disableExternalImagesOptions<\/span><span class=\"p\">.<\/span><span class=\"n\">setResourceLoadingCallback<\/span><span class=\"p\">(<\/span><span class=\"k\">new<\/span> <span class=\"n\">DisableExternalImagesHandler<\/span><span class=\"p\">());<\/span>\n\n\t<span class=\"n\">Document<\/span> <span class=\"n\">doc<\/span> <span class=\"p\">=<\/span> <span class=\"k\">new<\/span> <span class=\"n\">Document<\/span><span class=\"p\">(<\/span><span class=\"n\">documentFilename<\/span><span class=\"p\">,<\/span> <span class=\"n\">disableExternalImagesOptions<\/span><span class=\"p\">);<\/span>\n<span class=\"p\">}<\/span>\n\n<span class=\"k\">public<\/span> <span class=\"k\">static<\/span> <span class=\"k\">class<\/span> <span class=\"nc\">DisableExternalImagesHandler<\/span> <span class=\"n\">implements<\/span> <span class=\"n\">IResourceLoadingCallback<\/span>\n<span class=\"p\">{<\/span>\n\t<span class=\"k\">public<\/span> <span class=\"cm\">\/*ResourceLoadingAction*\/<\/span><span class=\"kt\">int<\/span> <span class=\"n\">resourceLoading<\/span><span class=\"p\">(<\/span><span class=\"n\">ResourceLoadingArgs<\/span> <span class=\"n\">args<\/span><span class=\"p\">)<\/span>\n\t<span class=\"p\">{<\/span>\n\t\t<span class=\"c1\">\/\/ Skip external images loading.\n<\/span><span class=\"c1\"><\/span>\t\t<span class=\"k\">return<\/span> <span class=\"p\">(<\/span><span class=\"n\">args<\/span><span class=\"p\">.<\/span><span class=\"n\">getResourceType<\/span><span class=\"p\">()<\/span> <span class=\"p\">==<\/span> <span class=\"n\">ResourceType<\/span><span class=\"p\">.<\/span><span class=\"n\">IMAGE<\/span><span class=\"p\">)<\/span>\n\t\t\t<span class=\"p\">?<\/span> <span class=\"n\">ResourceLoadingAction<\/span><span class=\"p\">.<\/span><span class=\"n\">SKIP<\/span>\n\t\t\t<span class=\"p\">:<\/span> <span class=\"n\">ResourceLoadingAction<\/span><span class=\"p\">.<\/span><span class=\"n\">DEFAULT<\/span><span class=\"p\">;<\/span>\n\t<span class=\"p\">}<\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div><\/p>\n<p>A\u015fa\u011f\u0131daki kod \u00f6rne\u011fi uzaktan kaynaklar\u0131n nas\u0131l devre d\u0131\u015f\u0131 b\u0131rak\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6stermektedir:<\/p>\n<p><strong>Java<\/strong>\n<div class=\"highlight\"><pre class=\"chroma\"><code class=\"language-csharp\" data-lang=\"csharp\"><span class=\"k\">public<\/span> <span class=\"k\">void<\/span> <span class=\"n\">loadDocument2<\/span><span class=\"p\">(<\/span><span class=\"n\">String<\/span> <span class=\"n\">documentFilename<\/span><span class=\"p\">)<\/span> <span class=\"n\">throws<\/span> <span class=\"n\">Exception<\/span>\n<span class=\"p\">{<\/span>\n\t<span class=\"n\">LoadOptions<\/span> <span class=\"n\">disableRemoteResourcesOptions<\/span> <span class=\"p\">=<\/span> <span class=\"k\">new<\/span> <span class=\"n\">LoadOptions<\/span><span class=\"p\">();<\/span>\n\t<span class=\"n\">disableRemoteResourcesOptions<\/span><span class=\"p\">.<\/span><span class=\"n\">setResourceLoadingCallback<\/span><span class=\"p\">(<\/span><span class=\"k\">new<\/span> <span class=\"n\">DisableRemoteResourcesHandler<\/span><span class=\"p\">());<\/span>\n\t\n\t<span class=\"n\">Document<\/span> <span class=\"n\">doc<\/span> <span class=\"p\">=<\/span> <span class=\"k\">new<\/span> <span class=\"n\">Document<\/span><span class=\"p\">(<\/span><span class=\"n\">documentFilename<\/span><span class=\"p\">,<\/span> <span class=\"n\">disableRemoteResourcesOptions<\/span><span class=\"p\">);<\/span>\n<span class=\"p\">}<\/span>\t\n\n<span class=\"k\">private<\/span> <span class=\"k\">static<\/span> <span class=\"k\">class<\/span> <span class=\"nc\">DisableRemoteResourcesHandler<\/span> <span class=\"n\">implements<\/span> <span class=\"n\">IResourceLoadingCallback<\/span>\n<span class=\"p\">{<\/span>\n\t<span class=\"k\">public<\/span> <span class=\"cm\">\/*ResourceLoadingAction*\/<\/span><span class=\"kt\">int<\/span> <span class=\"n\">resourceLoading<\/span><span class=\"p\">(<\/span><span class=\"n\">ResourceLoadingArgs<\/span> <span class=\"n\">args<\/span><span class=\"p\">)<\/span> <span class=\"n\">throws<\/span> <span class=\"n\">Exception<\/span>\n\t<span class=\"p\">{<\/span>\n\t\t<span class=\"k\">return<\/span> <span class=\"n\">isLocalResource<\/span><span class=\"p\">(<\/span><span class=\"n\">args<\/span><span class=\"p\">.<\/span><span class=\"n\">getOriginalUri<\/span><span class=\"p\">())<\/span>\n\t\t\t<span class=\"p\">?<\/span> <span class=\"n\">ResourceLoadingAction<\/span><span class=\"p\">.<\/span><span class=\"n\">DEFAULT<\/span>\n\t\t\t<span class=\"p\">:<\/span> <span class=\"n\">ResourceLoadingAction<\/span><span class=\"p\">.<\/span><span class=\"n\">SKIP<\/span><span class=\"p\">;<\/span>\n\t<span class=\"p\">}<\/span>\n\n\t<span class=\"c1\">\/\/ Simplified code.\n<\/span><span class=\"c1\"><\/span>\t<span class=\"k\">private<\/span> <span class=\"k\">static<\/span> <span class=\"n\">boolean<\/span> <span class=\"n\">isLocalResource<\/span><span class=\"p\">(<\/span><span class=\"n\">String<\/span> <span class=\"n\">fileName<\/span><span class=\"p\">)<\/span> <span class=\"n\">throws<\/span> <span class=\"n\">Exception<\/span>\n\t<span class=\"p\">{<\/span>\n\t\t<span class=\"n\">String<\/span> <span class=\"n\">protocol<\/span> <span class=\"p\">=<\/span> <span class=\"k\">null<\/span><span class=\"p\">;<\/span>\n\t\n\t\t<span class=\"n\">URI<\/span> <span class=\"n\">uri<\/span> <span class=\"p\">=<\/span> <span class=\"k\">new<\/span> <span class=\"n\">URI<\/span><span class=\"p\">(<\/span><span class=\"n\">fileName<\/span><span class=\"p\">);<\/span>\n\t\t<span class=\"k\">if<\/span> <span class=\"p\">(<\/span><span class=\"n\">uri<\/span><span class=\"p\">.<\/span><span class=\"n\">isAbsolute<\/span><span class=\"p\">())<\/span>\n\t\t<span class=\"p\">{<\/span>\n\t\t\t<span class=\"n\">protocol<\/span> <span class=\"p\">=<\/span> <span class=\"n\">uri<\/span><span class=\"p\">.<\/span><span class=\"n\">getScheme<\/span><span class=\"p\">();<\/span>\n\t\t<span class=\"p\">}<\/span>\n\t\t<span class=\"k\">else<\/span>\n\t\t<span class=\"p\">{<\/span>\n\t\t\t<span class=\"n\">URL<\/span> <span class=\"n\">url<\/span> <span class=\"p\">=<\/span> <span class=\"k\">new<\/span> <span class=\"n\">URL<\/span><span class=\"p\">(<\/span><span class=\"n\">fileName<\/span><span class=\"p\">);<\/span>\n\t\t\t<span class=\"n\">protocol<\/span> <span class=\"p\">=<\/span> <span class=\"n\">url<\/span><span class=\"p\">.<\/span><span class=\"n\">getProtocol<\/span><span class=\"p\">();<\/span>\n\t\t<span class=\"p\">}<\/span>\n\t\n\t\t<span class=\"k\">return<\/span> <span class=\"s\">&#34;file&#34;<\/span><span class=\"p\">.<\/span><span class=\"n\">equalsIgnoreCase<\/span><span class=\"p\">(<\/span><span class=\"n\">protocol<\/span><span class=\"p\">);<\/span>\n\t<span class=\"p\">}<\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div><\/p>\n\n\n<div class=\"alert alert-primary\" role=\"alert\">\n\nBu makale Ba\u011f\u0131ms\u0131z G\u00fcvenlik De\u011ferlendiricileri dan\u0131\u015fmanl\u0131k firmas\u0131na dayan\u0131yor <a href=\"ise-aspose-report.pdf\">report<\/a>..\n<\/div>\n\n\n      "}}}