Spring MVC中对http请求参数进行对象绑定，造成漏洞的解决办法

利用@InitBinder注解和WebDataBinder对允许的绑定到对象的属性进行设置，代码如下

在Controller层编写

设置一个允许绑定的属性数组

final String[] ALLOW_FIELD = new String[]{"token","kb_date","professionKey","quotaTypeKey","rpt_id","handPwd","userName","pwd","phone","smsCode","mark"};

编写数据绑定初始化的方法进行允许字段的设置

@InitBinder
public void initDataBind(WebDataBinder webDataBinder){
    webDataBinder.setAllowedFields(ALLOW_FIELD);
}