个人中心
gpt4 book ai didi

spring mvc url匹配禁用后缀访问操作

转载 作者：qq735679552 更新时间：2022-09-29 22:32:09 29 4
gpt4 key购买 nike

CFSDN坚持开源创造价值，我们致力于搭建一个资源共享平台，让每一个IT人在这里找到属于你的精彩世界.

这篇CFSDN的博客文章spring mvc url匹配禁用后缀访问操作由作者收集整理，如果你对这篇文章有兴趣，记得点赞哟.

spring mvc url匹配禁用后缀访问

在spring mvc中默认 访问url 加任意后缀名都能访问 。

比如：你想访问 /login ，但是通过 /login.do /login.action /login.json 都能访问 。

通常来说可能没有影响，但对于权限控制，这就严重了.

权限控制通常有两种思路：

1）弱权限控制

允许所有url通过，仅对个别重要的url做权限控制。此种方式比较简单，不需要对所有url资源进行配置，只配置重要的资源.

2）强权限控制

默认禁止所有url请求通过，仅开放授权的资源。此种方式对所有的url资源进行控制。在系统种需要整理所有的请求，或者某一目录下所有的url资源。这种方式安全控制比较严格，操作麻烦，但相对安全.

如果用第二种方式，则上面spring mvc的访问策略对安全没有影响.

但如果用第一种安全策略，则会有很大的安全风险.

例如：我们控制了/login 的访问，但是我们默认除/login的资源不受权限控制约束，那么攻击者就可以用 /login.do /login.xxx 来访问我们的资源.

在spring 3.1之后，url找对应方法的处理步骤，第一步，直接调用RequestMappingHandlerMapping查找到相应的处理方法，第二步，调用RequestMappingHandlerAdapter进行处理 。

我们在RequestMappingHandlerMapping中可以看到 。

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
/**
  * Whether to use suffix pattern match for registered file extensions only
  * when matching patterns to requests.
  * <p>If enabled, a controller method mapped to "/users" also matches to
  * "/users.json" assuming ".json" is a file extension registered with the
  * provided {@link #setContentNegotiationManager(ContentNegotiationManager)
  * contentNegotiationManager}. This can be useful for allowing only specific
  * URL extensions to be used as well as in cases where a "." in the URL path
  * can lead to ambiguous interpretation of path variable content, (e.g. given
  * "/users/{user}" and incoming URLs such as "/users/john.j.joe" and
  * "/users/john.j.joe.json").
  * <p>If enabled, this flag also enables
  * {@link #setUseSuffixPatternMatch(boolean) useSuffixPatternMatch}. The
  * default value is {@code false}.
  */
public void setUseRegisteredSuffixPatternMatch( boolean useRegisteredSuffixPatternMatch) {
    this .useRegisteredSuffixPatternMatch = useRegisteredSuffixPatternMatch;
    this .useSuffixPatternMatch = (useRegisteredSuffixPatternMatch || this .useSuffixPatternMatch);
}

那么如何来配置呢?

?
1
2
3
< mvc:annotation-driven >
   < mvc:path-matching suffix-pattern = "false" />
</ mvc:annotation-driven >

在匹配模式时是否使用后缀模式匹配，默认值为true。这样你想访问 /login ，通过 /login.* 就不能访问了.

spring mvc 之 请求url 带后缀的情况

RequestMappingInfoHandlerMapping 在处理http请求的时候， 如果 请求url 有后缀，如果找不到精确匹配的那个@RequestMapping方法.

那么，就把后缀去掉，然后.* 去匹配，这样，一般都可以匹配。 比如有一个@RequestMapping("/rest"), 那么精确匹配的情况下， 只会匹配/rest请求.

但如果我前端发来一个 /rest.abcdef 这样的请求， 又没有配置 @RequestMapping("/rest.abcdef") 这样映射的情况下， 那么@RequestMapping("/rest") 就会生效.

原理呢？处理链是这样的：

?
1
2
3
4
5
6
7
8
9
10
11
12
13
at org.springframework.web.servlet.mvc.condition.PatternsRequestCondition.getMatchingPattern(PatternsRequestCondition.java: 254 )
at org.springframework.web.servlet.mvc.condition.PatternsRequestCondition.getMatchingPatterns(PatternsRequestCondition.java: 230 )
at org.springframework.web.servlet.mvc.condition.PatternsRequestCondition.getMatchingCondition(PatternsRequestCondition.java: 210 )
at org.springframework.web.servlet.mvc.method.RequestMappingInfo.getMatchingCondition(RequestMappingInfo.java: 214 )
at org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping.getMatchingMapping(RequestMappingInfoHandlerMapping.java: 79 )
at org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping.getMatchingMapping(RequestMappingInfoHandlerMapping.java: 56 )
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.addMatchingMappings(AbstractHandlerMethodMapping.java: 358 )
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.lookupHandlerMethod(AbstractHandlerMethodMapping.java: 328 )
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java: 299 )
at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java: 57 )
at org.springframework.web.servlet.handler.AbstractHandlerMapping.getHandler(AbstractHandlerMapping.java: 299 )
at org.springframework.web.servlet.DispatcherServlet.getHandler(DispatcherServlet.java: 1104 )
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java: 916 )

关键是PatternsRequestCondition， 具体来说是这个方法：

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
AbstractHandlerMethodMapping 的getHandlerInternal：
     protected HandlerMethod getHandlerInternal(HttpServletRequest request) throws Exception {
         String lookupPath = this .getUrlPathHelper().getLookupPathForRequest(request);
         if ( this .logger.isDebugEnabled()) {
             this .logger.debug( "Looking up handler method for path " + lookupPath);
         }
         HandlerMethod handlerMethod = this .lookupHandlerMethod(lookupPath, request); // 这里是关键，它去寻找，找到了就找到了，找不到就不会再去寻找了
         if ( this .logger.isDebugEnabled()) {
             if (handlerMethod != null ) {
                 this .logger.debug( "Returning handler method [" + handlerMethod + "]" );
             } else {
                 this .logger.debug( "Did not find handler method for [" + lookupPath + "]" );
             }
         }
         return handlerMethod != null ? handlerMethod.createWithResolvedBean() : null ;
     }
    
    
     protected HandlerMethod lookupHandlerMethod(String lookupPath, HttpServletRequest request) throws Exception {
         List<AbstractHandlerMethodMapping<T>.Match> matches = new ArrayList();
         List<T> directPathMatches = (List) this .urlMap.get(lookupPath); // directPathMatches， 直接匹配， 也可以说是 精确匹配
         if (directPathMatches != null ) {
             this .addMatchingMappings(directPathMatches, matches, request); // 如果能够精确匹配， 就会进来这里
         }
         if (matches.isEmpty()) {
             this .addMatchingMappings( this .handlerMethods.keySet(), matches, request); // 如果无法精确匹配， 就会进来这里
         }
         if (!matches.isEmpty()) {
             Comparator<AbstractHandlerMethodMapping<T>.Match> comparator = new AbstractHandlerMethodMapping.MatchComparator( this .getMappingComparator(request));
             Collections.sort(matches, comparator);
             if ( this .logger.isTraceEnabled()) {
                 this .logger.trace( "Found " + matches.size() + " matching mapping(s) for [" + lookupPath + "] : " + matches);
             }
             AbstractHandlerMethodMapping<T>.Match bestMatch = (AbstractHandlerMethodMapping.Match)matches.get( 0 );
             if (matches.size() > 1 ) {
                 AbstractHandlerMethodMapping<T>.Match secondBestMatch = (AbstractHandlerMethodMapping.Match)matches.get( 1 );
                 if (comparator.compare(bestMatch, secondBestMatch) == 0 ) {
                     Method m1 = bestMatch.handlerMethod.getMethod();
                     Method m2 = secondBestMatch.handlerMethod.getMethod();
                     throw new IllegalStateException( "Ambiguous handler methods mapped for HTTP path '" + request.getRequestURL() + "': {" + m1 + ", " + m2 + "}" );
                 }
             }
             this .handleMatch(bestMatch.mapping, lookupPath, request);
             return bestMatch.handlerMethod;
         } else {
             return this .handleNoMatch( this .handlerMethods.keySet(), lookupPath, request);
         }
     }
    
     public List<String> getMatchingPatterns(String lookupPath) {
         List<String> matches = new ArrayList();
         Iterator var3 = this .patterns.iterator();
         while (var3.hasNext()) {
             String pattern = (String)var3.next(); // pattern 是 @RequestMapping 提供的映射
             String match = this .getMatchingPattern(pattern, lookupPath); //  lookupPath + .*  后能够匹配pattern， 那么就不为空
             if (match != null ) {
                 matches.add(match); // 对于有后缀的情况， .* 后
             }
         }
         Collections.sort(matches, this .pathMatcher.getPatternComparator(lookupPath));
         return matches;
     }
     最关键是这里 getMatchingPatterns ：
     private String getMatchingPattern(String pattern, String lookupPath) {
         if (pattern.equals(lookupPath)) {
             return pattern;
         } else {
             if ( this .useSuffixPatternMatch) {
                 if (! this .fileExtensions.isEmpty() && lookupPath.indexOf( 46 ) != - 1 ) {
                     Iterator var5 = this .fileExtensions.iterator();
                     while (var5.hasNext()) {
                         String extension = (String)var5.next();
                         if ( this .pathMatcher.match(pattern + extension, lookupPath)) {
                             return pattern + extension;
                         }
                     }
                 } else {
                     boolean hasSuffix = pattern.indexOf( 46 ) != - 1 ;
                     if (!hasSuffix && this .pathMatcher.match(pattern + ".*" , lookupPath)) {
                         return pattern + ".*" ; // 关键是这里
                     }
                 }
             }
             if ( this .pathMatcher.match(pattern, lookupPath)) {
                 return pattern;
             } else {
                 return this .useTrailingSlashMatch && !pattern.endsWith( "/" ) && this .pathMatcher.match(pattern + "/" , lookupPath) ? pattern + "/" : null ;
             }
         }
     }

而对于AbstractUrlHandlerMapping ，匹配不上就是匹配不上， 不会进行 +.* 后在匹配.

关键方法是这个：

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
protected Object lookupHandler(String urlPath, HttpServletRequest request) throws Exception {
         Object handler = this .handlerMap.get(urlPath);
         if (handler != null ) {
             if (handler instanceof String) {
                 String handlerName = (String)handler;
                 handler = this .getApplicationContext().getBean(handlerName);
             }
             this .validateHandler(handler, request);
             return this .buildPathExposingHandler(handler, urlPath, urlPath, (Map) null );
         } else {
             List<String> matchingPatterns = new ArrayList();
             Iterator var5 = this .handlerMap.keySet().iterator();
             while (var5.hasNext()) {
                 String registeredPattern = (String)var5.next();
                 if ( this .getPathMatcher().match(registeredPattern, urlPath)) {
                     matchingPatterns.add(registeredPattern);
                 }
             }
             String bestPatternMatch = null ;
             Comparator<String> patternComparator = this .getPathMatcher().getPatternComparator(urlPath);
             if (!matchingPatterns.isEmpty()) {
                 Collections.sort(matchingPatterns, patternComparator);
                 if ( this .logger.isDebugEnabled()) {
                     this .logger.debug( "Matching patterns for request [" + urlPath + "] are " + matchingPatterns);
                 }
                 bestPatternMatch = (String)matchingPatterns.get( 0 );
             }
             if (bestPatternMatch != null ) {
                 handler = this .handlerMap.get(bestPatternMatch);
                 String pathWithinMapping;
                 if (handler instanceof String) {
                     pathWithinMapping = (String)handler;
                     handler = this .getApplicationContext().getBean(pathWithinMapping);
                 }
                 this .validateHandler(handler, request);
                 pathWithinMapping = this .getPathMatcher().extractPathWithinPattern(bestPatternMatch, urlPath);
                 Map<String, String> uriTemplateVariables = new LinkedHashMap();
                 Iterator var9 = matchingPatterns.iterator();
                 while (var9.hasNext()) {
                     String matchingPattern = (String)var9.next();
                     if (patternComparator.compare(bestPatternMatch, matchingPattern) == 0 ) {
                         Map<String, String> vars = this .getPathMatcher().extractUriTemplateVariables(matchingPattern, urlPath);
                         Map<String, String> decodedVars = this .getUrlPathHelper().decodePathVariables(request, vars);
                         uriTemplateVariables.putAll(decodedVars);
                     }
                 }
                 if ( this .logger.isDebugEnabled()) {
                     this .logger.debug( "URI Template variables for request [" + urlPath + "] are " + uriTemplateVariables);
                 }
                 return this .buildPathExposingHandler(handler, bestPatternMatch, pathWithinMapping, uriTemplateVariables);
             } else {
                 return null ;
             }
         }
     }

当然， 或许我们可以设置自定义的PathMatcher ，从而到达目的。 默认的 是AntPathMatcher .

以上为个人经验，希望能给大家一个参考，也希望大家多多支持我.

原文链接：https://blog.csdn.net/ruipheng/article/details/65438703 。

最后此篇关于spring mvc url匹配禁用后缀访问操作的文章就讲到这里了,如果你想了解更多关于spring mvc url匹配禁用后缀访问操作的内容请搜索CFSDN的文章或继续浏览相关文章，希望大家以后支持我的博客！ 。

29 4 0
文章推荐： python项目--使用Tkinter的日历GUI应用程序
文章推荐： java上乘武功入门--反射
文章推荐： 回归预测分析python数据化运营线性回归总结
文章推荐： spring中向一个单例bean中注入非单例bean的方法详解
qq735679552
个人简介

我是一名优秀的程序员,十分优秀！

滴滴打车优惠券免费领取
滴滴打车优惠券
全站热门文章
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com