web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentia

原创已于 2022-08-15 14:42:45 修改 · 4.8k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#前端 #java #servlet

于 2019-12-18 20:17:47 首次发布

java 专栏收录该内容

11 篇文章

订阅专栏

本文探讨了Spring Security中因URL包含潜在恶意字符串而引发的RequestRejectedException异常，并提供了解决方案，通过自定义过滤器跳过特定请求的检查。

spring security 自带url 校验失败因为请求的url不合法，但是对接方又不能修改，只能平台适配

org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String "%2E"
   at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:265)
   at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:245)
   at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:193)
   at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
   at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347)
   at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263)
   at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
   at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
   at
   at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
   at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
   at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)
   at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
   at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
   at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
   at org.springframework.boot.actuate.autoconfigure.MetricsFilter.doFilterInternal(MetricsFilter.java:100)
   at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
   at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
   at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
   at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
   at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
   at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:65)
   at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
   at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
   at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
   at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
   at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
   at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
   at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
   at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
   at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
   at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
   at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
   at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
   at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
   at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
   at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
   at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
   at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
   at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
   at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
   at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
   at io.undertow.server.Connectors.executeRootHandler(Connectors.java:336)
   at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
   at java.lang.Thread.run(Thread.java:748)

解决方法

在对应请求在对过滤链进行放行处理

@Configuration
@EnableWebMvc
public  class WebConfig extends WebMvcConfigurerAdapter {


    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
//将所有/static/** 访问都映射到classpath:/static/ 目录下
        registry.addResourceHandler("/**").addResourceLocations("classpath:/static/");
        registry.addResourceHandler("/swagger-ui.html").addResourceLocations("classpath:/META-INF/resources/");
        registry.addResourceHandler("/webjars/**").addResourceLocations("classpath:/META-INF/resources/webjars/");
        registry.addResourceHandler("/update/**").addResourceLocations("classpath:/update/");
    }


    @Override
    public void configureMessageConverters(List<HttpMessageConverter<?>> converters) {
        MappingJackson2HttpMessageConverter converter = new MappingJackson2HttpMessageConverter();

        ObjectMapper mapper = new ObjectMapper();
        mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
        mapper.setDateFormat(new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSSXXX"));
        converter.setObjectMapper(mapper);
        converters.add(converter);
    }


    @Bean
    public ViewResolver getViewResolver(){
        InternalResourceViewResolver resolver = new InternalResourceViewResolver();
        resolver.setPrefix("/static/");
        resolver.setSuffix(".html");
        return resolver;
    }

    @Bean
    public FilterRegistrationBean myUpdateFilterRegistration() {
        FilterRegistrationBean registration = new FilterRegistrationBean();
        registration.setFilter(new MyUpdateFilter());
        registration.addUrlPatterns("/*");
        registration.addUrlPatterns();
        registration.setName("myUpdateFilter");
        registration.setOrder(-102);
        return registration;
    }


}

public class MyUpdateFilter implements Filter {

    private KikGaLogger log = LogUtil.get();

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)throws IOException, ServletException {
        final HttpServletRequest request = (HttpServletRequest) servletRequest;
        final HttpServletResponse response = (HttpServletResponse) servletResponse;
        String servletPath = request.getServletPath();
        //update下载
        if (StringUtils.isNotBlank(servletPath) && servletPath.contains("/update/")) {
            log.info("MyUpdateFilter filter:" + servletPath);
            skipFilter(filterChain);
        }
        filterChain.doFilter(servletRequest, servletResponse);

    }

    @Override
    public void destroy() {

    }
    /**
     * 方法名称：skipFilter
     * 方法描述：跳过filter（）
     * 返回值描述：
     */
    private void skipFilter(FilterChain chain) {
        try {
            Field field = chain.getClass().getDeclaredField("filters");
            field.setAccessible(true);
            List<ManagedFilter> filters = (List<ManagedFilter>) field.get(chain);
            int k = 0;
            Iterator<ManagedFilter> iterators = filters.iterator();
            while (iterators.hasNext()){
                ManagedFilter filter = iterators.next();
                if (filter==null) {
                    continue;
                }
                String name = filter.getFilterInfo().getName();
                //cas过滤
                if(name.contains("cas")||name.contains("Security")){
                    iterators.remove();
                }
            }
            //field.set("filters",filters);
            field.setAccessible(false);
        } catch (Exception e) {
            log.error("skipFilter error",e);
        }
    }

}