http - 如果 %2F 是 JBOSS 中 GET URL 的一部分，则会收到 HTTP 400 错误

Question

每当将包含 %2F(/ 的十六进制代码)的 URL 发布到我的 JBOSS 服务器时，我都会收到错误消息:

HTTP 400 Bad Request error message. 

这是网址:

http://localhost:8080/application/**abc%2Fhi**?msg=hello"

如果我从 URL 中删除 %2F，链接就可以正常工作。

此 %2F 必须是 URL 的一部分，不能是请求参数。

Answer 1

终于找到了这个原因(JBoss 和 Apache 都一样)。这两个应用程序都故意拒绝带有编码斜杠的 URI(%2F 用于 / 和 %5C 用于 \)以防止可能的安全漏洞。

链接:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0450

http://securitytracker.com/id/1018110 (看第4节解决方案)

下面是他们提供的用于在 JBoss 中启用此行为的说明:

Note: In response to CVE-2007-0450, JBoss AS considers encoded slashes and backslashes in URLs invalid and its usage will result in HTTP 400 error. It is possible to allow encoded slashes and backslashes by following the steps outlined below, however doing so will expose you to CVE-2007-0450 related attacks:

a) If you use the /var/lib/jbossas/bin/run.sh setup, please edit /etc/jbossas/run.conf and append

- -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true

- -Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=true to the string assigned to JAVA_OPTS

b) If you use the init script setup to run multiple JBoss AS services and you wish to allow encoding by default on all services, please edit /etc/jbossas/jbossas.conf and add the line JAVA_OPTS="${JAVA_OPTS}

- -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true

- -Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=true"

c) If you use the init script setup to run multiple JBoss AS services and want to allow encoding of slashes and backslashes for a particular service, please edit /etc/sysconfig/${NAME} (where NAME is the name of your service) and add the line JAVA_OPTS="${JAVA_OPTS} - -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true - -Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=true"

对于 Apache，它就像在您的 apache conf 或 vhost conf 中的某处设置“AllowEncodedSlashes NoDecode”一样简单(但是在 .htaccess 中不起作用)。

Apache 链接:http://httpd.apache.org/docs/current/mod/core.html#allowencodedslashes