最好的保护是通过使用索引、间接引用图或其他易于验证的间接方法来避免直接对象引用。如果必须使用一个直接对象引用，确保用户在美国之前被授权

https://cwiki.apache.org/S2PLUGINS/request-parameter-to-action-object-mapping-plugin-for-insecure-direct-object-references.html JSP Parameter to Action Object Mapping (Security) Plugin does this great thing. Here is also a short overview of what it does and why a developer would want to use it. Many applications expose their internal object references to users. Attackers use parameter tampering to change references and violate the intended but unenforced access control policy. Frequently, these references point to file systems and databases, but any exposed application construct could be vulnerable. The best protection is to avoid exposing direct object references to users by using an index, indirect reference map, or other indirect method that is easy to validate. If a direct object reference must be used, ensure that the user is authorized before using it. Avoid exposing your private object references to users whenever possible, such as primar