Spring boot rest mvc json解析器没有验证非法的或有尾随数据的输入json数据

Question

在我的rest客户端中，我传递以下JSON请求数据：

  { 
    "jobName":"test1", 
    "source":{ "name":"prod1","type":"teradata"}, 
    "target":{ "name":"prod2","type":"teradata"}, 
    "objects":{ "name":"table1"}<br/>
    } 
junkdata ; @#%$@#% 

所以额外的“垃圾数据;@#%$@#%“ 未经其余客户端或 spring jackson 开箱即用消息转换器验证。
我确实调试了代码，SpringHttpServletRequest主体具有完整的数据，包括垃圾数据。因此，它没有失败，Spring正在忽略垃圾数据并将起始JSON数据转换为Java对象。
我确实尝试在Rest控制器调用中添加注释，例如@JsonFormat@RequestBody（@RestController）。但它没有验证似乎Spring开箱即用的消息转换器jackson没有正确验证传入的请求JSON数据。

Answer 1

在研究了使用Google gson的不同方法之后.jar，@Pete是的，我已经验证了无效的JSON输入。google gson api 正在正确验证它，我们需要使用自定义消息转换器在其余的 WebMvcConfigurationSupport 类中验证它。

@Configuration
@ComponentScan(basePackages = { "com.teradata.datamovement.rest.controllers",
        "com.teradata.rest.controller" })
public class RestControllerConfiguration extends WebMvcConfigurationSupport
{
       @Override
        public void configureMessageConverters(List<HttpMessageConverter<?>> converters) {
            log.debug("Adding custom message converter.");
            converters.add(new AbstractHttpMessageConverter<Object>(MediaType.APPLICATION_JSON, new MediaType("application", "*+json")){
                @Override
                protected Object readInternal(Class<? extends Object> clazz,
                                              HttpInputMessage inputMessage) throws IOException, HttpMessageNotReadableException {
                    try{
                        log.debug("Converting and validating the http request body data.");
                        String httpRequestBody = convertStreamToString(inputMessage.getBody());
                        log.debug("Http request body data:"+httpRequestBody);
                        return new Gson().fromJson(httpRequestBody, clazz);
                    }
                    catch(JsonSyntaxException e){
                        throw new HttpMessageNotReadableException("Invalid input JSON data: " + e.getMessage(), e);
                    } 
                }
                private String convertStreamToString(InputStream is) throws IOException {
                    if (is != null) {
                        Writer writer = new StringWriter();
                        char[] buffer = new char[1024];
                        try {
                            Reader reader = new BufferedReader(new InputStreamReader(is, "UTF-8"));
                            int n;
                            while ((n = reader.read(buffer)) != -1) {
                                writer.write(buffer, 0, n);
                            }
                        } finally {
                            is.close();
                        }
                        return writer.toString();
                    } else {
                        return "";
                    }
                }
                @Override
                protected boolean supports(Class clazz) {
                    return true;
                }
                @Override
                protected void writeInternal(Object t, HttpOutputMessage outputMessage)
                        throws IOException, HttpMessageNotWritableException {
                     outputMessage.getBody().write(new Gson().toJson(t).getBytes());
                }
            });
        }

}

但我注意到的奇怪的是，只有当我将其设置为匿名类或在同一文件中添加类时，它才有效。如果我在这个RestControllerConfiguration.java文件之外创建这个自定义消息转换器，那么它就不会验证它。下面是一个示例：

{
"jobName":"test1",
"source":{ "name":"prod1","type":"teradata"},
"target":{ "name":"prod2","type":"teradata"},
"objects":{ "name":"table1"}
}
junkdata ; @#%$@#%

这将得到验证，并将抛出错误，如

{"message":"Invalid input JSON data: com.google.gson.stream.MalformedJsonException: Expected EOF at line 7 column 1; nested exception is com.google.gson.JsonSyntaxException: com.google.gson.stream.MalformedJsonException: Expected EOF at line 7 column 1"}

Answer 2

现在，spring jackson中修复了这个问题（跟踪令牌或数据失败）https://github.com/FasterXML/jackson-databind/issues/1583使用反序列化功能。FAIL_ON_TRAILING_TOKENS，下面是修复该问题的代码示例：

@Configuration
public class RestControllerConfiguration extends WebMvcConfigurationSupport
{
    @Override
    public void configureMessageConverters(List<HttpMessageConverter<?>> converters) {
    ObjectMapper objectMapper = new ObjectMapper();
    objectMapper.configure(DeserializationFeature.FAIL_ON_TRAILING_TOKENS, true);
    converters.add(new MappingJackson2HttpMessageConverter(objectMapper));
    }
}