Question

将安全版本升级到4.2.4后，

我们正在获得包含分号

的url的异常

例如：

https://url/name=somevalue;value=somevalue

 org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String ";"

        at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:140) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

        at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:120) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:193) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:185) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

        at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

因此，我们对httpfirewall的自定义实现进行了一些配置

      @Bean

      public HttpFirewall allowUrlEncodedSlashHttpFirewall()

      {

        StrictHttpFirewall firewall = new StrictHttpFirewall();

        firewall.setAllowUrlEncodedSlash(true);

        firewall.setAllowSemicolon(true);

        return firewall;

      }

和

   @Override

    public void configure(WebSecurity web) throws Exception

     {

       super.configure(web);

       web.httpFirewall(this.httpFirewall);

      }

配置完成后，我们面临同样的问题。

然后我调试了内置类StrictHttpFirewall.getFirewalledRequest(HttpServletRequest request)

有时我们会收到如下嵌套请求：

firewalledRequest[ firewallwedRequest [ …  (request).

我检查了dofilter()

中的filterchainProxy方法

它没有清除SecurityContextHolder，因此FilterChainProxy实际上在链中发生了两次。

如何在saml中解决firewall.RequestRejectedException

0 个答案: