spring mvc url匹配禁用后缀访问
在spring mvc中默认 访问url 加任意后缀名都能访问
比如：你想访问 /login ，但是通过 /login.do /login.action /login.json 都能访问
通常来说可能没有影响，但对于权限控制，这就严重了。
权限控制通常有两种思路：
1）弱权限控制允许所有url通过，仅对个别重要的url做权限控制。此种方式比较简单，不需要对所有url资源进行配置，只配置重要的资源。
2）强权限控制默认禁止所有url请求通过，仅开放授权的资源。此种方式对所有的url资源进行控制。在系统种需要整理所有的请求，或者某一目录下所有的url资源。这种方式安全控制比较严格，操作麻烦，但相对安全。
如果用第二种方式，则上面spring mvc的访问策略对安全没有影响。
但如果用第一种安全策略，则会有很大的安全风险。
例如：我们控制了/login 的访问，但是我们默认除/login的资源不受权限控制约束，那么攻击者就可以用 /login.do /login.xxx 来访问我们的资源。
在spring 3.1之后，url找对应方法的处理步骤，第一步，直接调用RequestMappingHandlerMapping查找到相应的处理方法，第二步，调用RequestMappingHandlerAdapter进行处理
我们在RequestMappingHandlerMapping中可以看到
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
/** * Whether to use suffix pattern match for registered file extensions only * when matching patterns to requests. * <p>If enabled, a controller method mapped to "/users" also matches to * "/users.json" assuming ".json" is a file extension registered with the * provided {@link #setContentNegotiationManager(ContentNegotiationManager) * contentNegotiationManager}. This can be useful for allowing only specific * URL extensions to be used as well as in cases where a "." in the URL path * can lead to ambiguous interpretation of path variable content, (e.g. given * "/users/{user}" and incoming URLs such as "/users/john.j.joe" and * "/users/john.j.joe.json"). * <p>If enabled, this flag also enables * {@link #setUseSuffixPatternMatch(boolean) useSuffixPatternMatch}. The * default value is {@code false}. */ public void setUseRegisteredSuffixPatternMatch( boolean useRegisteredSuffixPatternMatch) { this .useRegisteredSuffixPatternMatch = useRegisteredSuffixPatternMatch; this .useSuffixPatternMatch = (useRegisteredSuffixPatternMatch || this .useSuffixPatternMatch); } |
那么如何来配置呢？
|
1 2 3 |
< mvc:annotation-driven > < mvc:path-matching suffix-pattern = "false" /> </ mvc:annotation-driven > |
在匹配模式时是否使用后缀模式匹配，默认值为true。这样你想访问 /login ，通过 /login.* 就不能访问了。
spring mvc 之 请求url 带后缀的情况
RequestMappingInfoHandlerMapping 在处理http请求的时候， 如果 请求url 有后缀，如果找不到精确匹配的那个@RequestMapping方法。
那么，就把后缀去掉，然后.* 去匹配，这样，一般都可以匹配。 比如有一个@RequestMapping("/rest"), 那么精确匹配的情况下， 只会匹配/rest请求。
但如果我前端发来一个 /rest.abcdef 这样的请求， 又没有配置 @RequestMapping("/rest.abcdef") 这样映射的情况下， 那么@RequestMapping("/rest") 就会生效。
原理呢？处理链是这样的：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
at org.springframework.web.servlet.mvc.condition.PatternsRequestCondition.getMatchingPattern(PatternsRequestCondition.java: 254 ) at org.springframework.web.servlet.mvc.condition.PatternsRequestCondition.getMatchingPatterns(PatternsRequestCondition.java: 230 ) at org.springframework.web.servlet.mvc.condition.PatternsRequestCondition.getMatchingCondition(PatternsRequestCondition.java: 210 ) at org.springframework.web.servlet.mvc.method.RequestMappingInfo.getMatchingCondition(RequestMappingInfo.java: 214 ) at org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping.getMatchingMapping(RequestMappingInfoHandlerMapping.java: 79 ) at org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping.getMatchingMapping(RequestMappingInfoHandlerMapping.java: 56 ) at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.addMatchingMappings(AbstractHandlerMethodMapping.java: 358 ) at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.lookupHandlerMethod(AbstractHandlerMethodMapping.java: 328 ) at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java: 299 ) at org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.getHandlerInternal(AbstractHandlerMethodMapping.java: 57 ) at org.springframework.web.servlet.handler.AbstractHandlerMapping.getHandler(AbstractHandlerMapping.java: 299 ) at org.springframework.web.servlet.DispatcherServlet.getHandler(DispatcherServlet.java: 1104 ) at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java: 916 ) |
关键是PatternsRequestCondition， 具体来说是这个方法：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 |
AbstractHandlerMethodMapping 的getHandlerInternal： protected HandlerMethod getHandlerInternal(HttpServletRequest request) throws Exception { String lookupPath = this .getUrlPathHelper().getLookupPathForRequest(request); if ( this .logger.isDebugEnabled()) { this .logger.debug( "Looking up handler method for path " + lookupPath); } HandlerMethod handlerMethod = this .lookupHandlerMethod(lookupPath, request); // 这里是关键，它去寻找，找到了就找到了，找不到就不会再去寻找了 if ( this .logger.isDebugEnabled()) { if (handlerMethod != null ) { this .logger.debug( "Returning handler method [" + handlerMethod + "]" ); } else { this .logger.debug( "Did not find handler method for [" + lookupPath + "]" ); } } return handlerMethod != null ? handlerMethod.createWithResolvedBean() : null ; }
protected HandlerMethod lookupHandlerMethod(String lookupPath, HttpServletRequest request) throws Exception { List<AbstractHandlerMethodMapping<T>.Match> matches = new ArrayList(); List<T> directPathMatches = (List) this .urlMap.get(lookupPath); // directPathMatches， 直接匹配， 也可以说是 精确匹配 if (directPathMatches != null ) { this .addMatchingMappings(directPathMatches, matches, request); // 如果能够精确匹配， 就会进来这里 } if (matches.isEmpty()) { this .addMatchingMappings( this .handlerMethods.keySet(), matches, request); // 如果无法精确匹配， 就会进来这里 } if (!matches.isEmpty()) { Comparator<AbstractHandlerMethodMapping<T>.Match> comparator = new AbstractHandlerMethodMapping.MatchComparator( this .getMappingComparator(request)); Collections.sort(matches, comparator); if ( this .logger.isTraceEnabled()) { this .logger.trace( "Found " + matches.size() + " matching mapping(s) for [" + lookupPath + "] : " + matches); } AbstractHandlerMethodMapping<T>.Match bestMatch = (AbstractHandlerMethodMapping.Match)matches.get( 0 ); if (matches.size() > 1 ) { AbstractHandlerMethodMapping<T>.Match secondBestMatch = (AbstractHandlerMethodMapping.Match)matches.get( 1 ); if (comparator测试数据pare(bestMatch, secondBestMatch) == 0 ) { Method m1 = bestMatch.handlerMethod.getMethod(); Method m2 = secondBestMatch.handlerMethod.getMethod(); throw new IllegalStateException( "Ambiguous handler methods mapped for HTTP path '" + request.getRequestURL() + "': {" + m1 + ", " + m2 + "}" ); } } this .handleMatch(bestMatch.mapping, lookupPath, request); return bestMatch.handlerMethod; } else { return this .handleNoMatch( this .handlerMethods.keySet(), lookupPath, request); } }
public List<String> getMatchingPatterns(String lookupPath) { List<String> matches = new ArrayList(); Iterator var3 = this .patterns.iterator(); while (var3.hasNext()) { String pattern = (String)var3.next(); // pattern 是 @RequestMapping 提供的映射 String match = this .getMatchingPattern(pattern, lookupPath); // lookupPath + .* 后能够匹配pattern， 那么就不为空 if (match != null ) { matches.add(match); // 对于有后缀的情况， .* 后 } } Collections.sort(matches, this .pathMatcher.getPatternComparator(lookupPath)); return matches; } 最关键是这里 getMatchingPatterns ： private String getMatchingPattern(String pattern, String lookupPath) { if (pattern.equals(lookupPath)) { return pattern; } else { if ( this .useSuffixPatternMatch) { if (! this .fileExtensions.isEmpty() && lookupPath.indexOf( 46 ) != - 1 ) { Iterator var5 = this .fileExtensions.iterator(); while (var5.hasNext()) { String extension = (String)var5.next(); if ( this .pathMatcher.match(pattern + extension, lookupPath)) { return pattern + extension; } } } else { boolean hasSuffix = pattern.indexOf( 46 ) != - 1 ; if (!hasSuffix && this .pathMatcher.match(pattern + ".*" , lookupPath)) { return pattern + ".*" ; // 关键是这里 } } } if ( this .pathMatcher.match(pattern, lookupPath)) { return pattern; } else { return this .useTrailingSlashMatch && !pattern.endsWith( "/" ) && this .pathMatcher.match(pattern + "/" , lookupPath) ? pattern + "/" : null ; } } } |
而对于AbstractUrlHandlerMapping ，匹配不上就是匹配不上， 不会进行 +.* 后在匹配。
关键方法是这个：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 |
protected Object lookupHandler(String urlPath, HttpServletRequest request) throws Exception { Object handler = this .handlerMap.get(urlPath); if (handler != null ) { if (handler instanceof String) { String handlerName = (String)handler; handler = this .getApplicationContext().getBean(handlerName); } this .validateHandler(handler, request); return this .buildPathExposingHandler(handler, urlPath, urlPath, (Map) null ); } else { List<String> matchingPatterns = new ArrayList(); Iterator var5 = this .handlerMap.keySet().iterator(); while (var5.hasNext()) { String registeredPattern = (String)var5.next(); if ( this .getPathMatcher().match(registeredPattern, urlPath)) { matchingPatterns.add(registeredPattern); } } String bestPatternMatch = null ; Comparator<String> patternComparator = this .getPathMatcher().getPatternComparator(urlPath); if (!matchingPatterns.isEmpty()) { Collections.sort(matchingPatterns, patternComparator); if ( this .logger.isDebugEnabled()) { this .logger.debug( "Matching patterns for request [" + urlPath + "] are " + matchingPatterns); } bestPatternMatch = (String)matchingPatterns.get( 0 ); } if (bestPatternMatch != null ) { handler = this .handlerMap.get(bestPatternMatch); String pathWithinMapping; if (handler instanceof String) { pathWithinMapping = (String)handler; handler = this .getApplicationContext().getBean(pathWithinMapping); } this .validateHandler(handler, request); pathWithinMapping = this .getPathMatcher().extractPathWithinPattern(bestPatternMatch, urlPath); Map<String, String> uriTemplateVariables = new LinkedHashMap(); Iterator var9 = matchingPatterns.iterator(); while (var9.hasNext()) { String matchingPattern = (String)var9.next(); if (patternComparator测试数据pare(bestPatternMatch, matchingPattern) == 0 ) { Map<String, String> vars = this .getPathMatcher().extractUriTemplateVariables(matchingPattern, urlPath); Map<String, String> decodedVars = this .getUrlPathHelper().decodePathVariables(request, vars); uriTemplateVariables.putAll(decodedVars); } } if ( this .logger.isDebugEnabled()) { this .logger.debug( "URI Template variables for request [" + urlPath + "] are " + uriTemplateVariables); } return this .buildPathExposingHandler(handler, bestPatternMatch, pathWithinMapping, uriTemplateVariables); } else { return null ; } } } |
当然， 或许我们可以设置自定义的PathMatcher ，从而到达目的。 默认的 是AntPathMatcher 。
以上为个人经验，希望能给大家一个参考，也希望大家多多支持。
原文链接：https://blog.csdn.net/ruipheng/article/details/65438703
查看更多关于spring mvc url匹配禁用后缀访问操作的详细内容...