spring security 4.2与spring MVC@MatrixVariable中的

Question

@GetMapping(path = "/{param}")
public void example(@PathVariable String param,
                    @MatrixVariable Map<String, String> matrix) {
    //...
}

mockMvc.perform(get("/someparam;key=value"))

org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String ";"

at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:140)

顺便说一句：javadoc不正确https://docs.spring.io/autorepo/docs/spring-security/4.2.x/apidocs/index.html？org/springframework/security/web/firewall/strithttpfirewall.html

自：

5.0.1

我猜是被倒车了？

Answer 1

您可以使用自定义的StrictHttpFirewall实例稀释默认Spring Security防火墙（风险自负）

@Bean
public HttpFirewall allowUrlEncodedSlashHttpFirewall() {
    StrictHttpFirewall firewall = new StrictHttpFirewall();
    firewall.setAllowUrlEncodedSlash(true);
    firewall.setAllowSemicolon(true);
    return firewall;
}

然后在WebSecurity中使用此自定义防火墙bean（Spring boot不需要此更改）

@Override
public void configure(WebSecurity web) throws Exception {
  super.configure(web);
  // @formatter:off
  web.httpFirewall(allowUrlEncodedSlashHttpFirewall());
...
}

这将适用于Spring Security 4.2.4+，但当然会带来一些风险！