源码分析异常错误The request was rejected because the URL contained a potentially malicious String “//“

最新推荐文章于 2024-06-04 21:27:13 发布
最新推荐文章于 2024-06-04 21:27:13 发布
阅读量315 收藏
点赞数
文章标签： java spring springboot
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/qq_35937303/article/details/131784920
版权

项目上线之后经常会在日志当中看到如下错误：

org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String "//"
	at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlocklistedUrls(StrictHttpFirewall.java:456)
	at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:429)
	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:196)
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:183)
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354)
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
	at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:96)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890)
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743)
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
	at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
	at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
	at java.lang.Thread.run(Thread.java:748)

这是什么原因呢，我们可以在spring的源码FilterChainProxy类中看到（FilterChainProxy的作用是管理一组过滤器，定义请求的安全验证和处理顺序，并提供基于拦截规则的安全功能。它是Spring
Security框架中实现安全过滤器链的核心组件。）

public class FilterChainProxy extends GenericFilterBean {

    private static final Log logger = LogFactory.getLog(FilterChainProxy.class);

    private static final String FILTER_APPLIED = FilterChainProxy.class.getName().concat(".APPLIED");

    private List<SecurityFilterChain> filterChains;

    private FilterChainValidator filterChainValidator = new NullFilterChainValidator();

    private HttpFirewall firewall = new StrictHttpFirewall();

    private RequestRejectedHandler requestRejectedHandler = new DefaultRequestRejectedHandler();

    public FilterChainProxy() {
    }

    public FilterChainProxy(SecurityFilterChain chain) {
        this(Arrays.asList(chain));
    }

    public FilterChainProxy(List<SecurityFilterChain> filterChains) {
        this.filterChains = filterChains;
    }

    @Override
    public void afterPropertiesSet() {
        this.filterChainValidator.validate(this);
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        boolean clearContext = request.getAttribute(FILTER_APPLIED) == null;
        if (!clearContext) {
            doFilterInternal(request, response, chain);
            return;
        }
        try {
            request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
            doFilterInternal(request, response, chain);
        } catch (RequestRejectedException ex) {
            this.requestRejectedHandler.handle((HttpServletRequest) request, (HttpServletResponse) response, ex);
        } finally {
            SecurityContextHolder.clearContext();
            request.removeAttribute(FILTER_APPLIED);
        }
    }

    private void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        //走到了这里，这里的firewall使用的是StrictHttpFirewall
        FirewalledRequest firewallRequest = this.firewall.getFirewalledRequest((HttpServletRequest) request);
        HttpServletResponse firewallResponse = this.firewall.getFirewalledResponse((HttpServletResponse) response);
        List<Filter> filters = getFilters(firewallRequest);
        if (filters == null || filters.size() == 0) {
            if (logger.isTraceEnabled()) {
                logger.trace(LogMessage.of(() -> "No security for " + requestLine(firewallRequest)));
            }
            firewallRequest.reset();
            chain.doFilter(firewallRequest, firewallResponse);
            return;
        }
        if (logger.isDebugEnabled()) {
            logger.debug(LogMessage.of(() -> "Securing " + requestLine(firewallRequest)));
        }
        VirtualFilterChain virtualFilterChain = new VirtualFilterChain(firewallRequest, chain, filters);
        virtualFilterChain.doFilter(firewallRequest, firewallResponse);
    }
}

代码执行到这里抛出了异常this.firewall.getFirewalledRequest((HttpServletRequest) request);
我们可以从上面代码看到firewall使用的是new StrictHttpFirewall()，让我们进入到StrictHttpFirewall的getFirewalledRequest看看：

public class StrictHttpFirewall implements HttpFirewall {
    @Override
	public FirewalledRequest getFirewalledRequest(HttpServletRequest request) throws RequestRejectedException {
		rejectForbiddenHttpMethod(request);
		rejectedBlocklistedUrls(request);
		rejectedUntrustedHosts(request);
		if (!isNormalized(request)) {
			throw new RequestRejectedException("The request was rejected because the URL was not normalized.");
		}
		String requestUri = request.getRequestURI();
		if (!containsOnlyPrintableAsciiCharacters(requestUri)) {
			throw new RequestRejectedException(
					"The requestURI was rejected because it can only contain printable ASCII characters.");
		}
		return new StrictFirewalledRequest(request);
	}

	private void rejectForbiddenHttpMethod(HttpServletRequest request) {
		if (this.allowedHttpMethods == ALLOW_ANY_HTTP_METHOD) {
			return;
		}
		if (!this.allowedHttpMethods.contains(request.getMethod())) {
			throw new RequestRejectedException(
					"The request was rejected because the HTTP method \"" + request.getMethod()
							+ "\" was not included within the list of allowed HTTP methods " + this.allowedHttpMethods);
		}
	}

	private void rejectedBlocklistedUrls(HttpServletRequest request) {
		for (String forbidden : this.encodedUrlBlocklist) {
		    //这个方法抛出了错误
			if (encodedUrlContains(request, forbidden)) {
				throw new RequestRejectedException(
						"The request was rejected because the URL contained a potentially malicious String \""
								+ forbidden + "\"");
			}
		}
		for (String forbidden : this.decodedUrlBlocklist) {
			if (decodedUrlContains(request, forbidden)) {
				throw new RequestRejectedException(
						"The request was rejected because the URL contained a potentially malicious String \""
								+ forbidden + "\"");
			}
		}
	}
    private static boolean encodedUrlContains(HttpServletRequest request, String value) {
        if (valueContains(request.getContextPath(), value)) {
            return true;
        }
        return valueContains(request.getRequestURI(), value);
    }
    private static boolean valueContains(String value, String contains) {
        return value != null && value.contains(contains);
    }
}

从以上代码我们找出来了原因，因为用户请求的路径中包含spring制定的违禁地址，所以抛出了RequestRejectedException异常

然而从FilterChainProxy中我们可以看到RequestRejectedException被requestRejectedHandler捕获了，而且处理器默认使用的是DefaultRequestRejectedHandler处理器，那DefaultRequestRejectedHandler是如何实现的呢？

public class DefaultRequestRejectedHandler implements RequestRejectedHandler {

	@Override
	public void handle(HttpServletRequest request, HttpServletResponse response,
			RequestRejectedException requestRejectedException) throws IOException, ServletException {
		throw requestRejectedException;
	}

}

从DefaultRequestRejectedHandler源码中我们可以看到，他是直接把异常给抛出去了,所以会导致出现很多的RequestRejectedException错误日志

那么如何解决呢？
从上面的源码分析，我们可以看到问题出在firewall的校验url方法，我们可以替换为spring的DefaultHttpFirewall类，但是我个人不建议这么做。

还有一种方法，requestRejectedHandler的默认处理器DefaultRequestRejectedHandler直接抛出了异常导致程序出现异常信息，对于Spring安全版本5.4和更高版本，我们可以简单地创建一个类型为RequestRejectedHandler的bean，该bean将被注入Spring安全过滤器链中：

import org.springframework.security.web.firewall.HttpStatusRequestRejectedHandler;
import org.springframework.security.web.firewall.RequestRejectedHandler;
 
@Bean
    public RequestRejectedHandler requestRejectedHandler() {
        // sends an error response with a configurable status code (default is 400 BAD_REQUEST)
        // we can pass a different value in the constructor
        return new HttpStatusRequestRejectedHandler();
    }

附下HttpStatusRequestRejectedHandler的源码：

public class HttpStatusRequestRejectedHandler implements RequestRejectedHandler {

	private static final Log logger = LogFactory.getLog(HttpStatusRequestRejectedHandler.class);

	private final int httpError;

	/**
	 * Constructs an instance which uses {@code 400} as response code.
	 */
	public HttpStatusRequestRejectedHandler() {
		this.httpError = HttpServletResponse.SC_BAD_REQUEST;
	}

	/**
	 * Constructs an instance which uses a configurable http code as response.
	 * @param httpError http status code to use
	 */
	public HttpStatusRequestRejectedHandler(int httpError) {
		this.httpError = httpError;
	}

	@Override
	public void handle(HttpServletRequest request, HttpServletResponse response,
			RequestRejectedException requestRejectedException) throws IOException {
		logger.debug(LogMessage.format("Rejecting request due to: %s", requestRejectedException.getMessage()),
				requestRejectedException);
		response.sendError(this.httpError);
	}

}

如果您对我的问题分析感兴趣，不妨看看之前的文章

倚一缕清风
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
The request was rejected because the URL contained a potentially malicious String “；“问题的正确解决姿势
Ajekseg的博客
07-31 7864
先自我介绍一下，小编13年上师交大毕业，曾经在小公司待过，去过华为OPPO等大厂，18年进入阿里，直到现在。深知大多数初中级java工程师，想要升技能，往往是需要自己摸索成长或是报班学习，但对于培训机构动则近万元的学费，着实压力不小。因此我收集了一份《java开发全套学习资料》送给大家，初衷也很简单，就是希望帮助到想自学又不知道该从何学起的朋友，同时减轻大家的负担。，SpringSecurity会在Cookie中存一个信息，标记一为一个。是非常危险的举动，可能导致会话固定攻击，因此不建议上述的行为。...
idea上传代码到github时遇到的Push rejected: Push to origin/master was rejected
01-08
在使用IntelliJ IDEA（简称Idea）上传代码到GitHub时，可能会遇到“Push rejected: Push to origin/master was rejected”的错误。这个问题通常发生在你尝试将一个新的项目推送到一个已存在文件的GitHub仓库时。以下...
The request was rejected because the URL contained a potentially malicious String “//“ 报错
weixin_44635886的博客
08-04 1万+
请求将被拒绝,因为URL字符串包含一个潜在的恶意“/ /” The request was rejected because the URL contained a potentially malicious String “//“
解决 The request was rejected because the URL contained a potentially malicious String “；“
最新发布
jingchao1998的博客
06-04 140
在 Spring Security 项目中，默认使用 StrictHttpFirewall 对象，该对象对一些疑似恶意攻击的请求也进行了拒绝处理。假如该对象对我们的项目来说过于严格，那我们可以通过配置的方式定制哪些请求需要被拒绝，当然相应的，我们的应用程序也更容易受到攻击。URL地址中携带 jsessionid 包含 “;
jar包启动报错：The request was rejected because the URL contained a potentially malicious String “%25“
IT小辉同学
08-16 1035
晚安，玛卡巴卡——
The request was rejected because the URL contained a potentially malicious String “//“
好幸运
04-20 1528
解决方案 把多余的/去掉就好了。 但我疑惑的是为什么php就可以，java报错了，后来查到是Spring Security拦截了。 源代码在StrictHttpFirewall#setAllowUrlEncodedDoubleSlash。 这个类里面其他的方法应该也和特殊字符有关（如setAllowBackSlash、setAllowUrlEncodedPercent等）。 重新注入StrictHttpFirewall对象，就可以让它支持//的模式。
SpringSecurity:request was rejected because the URL contained a potentially malicious String “//“
Ricardo.M.Yu的博客
03-15 2151
spring security路径问题
the URL contained a potentially malicious String “//“
子豪的博客
02-21 874
这个问题是因为前端的请求url后面多加了一个斜杠,把后面的斜杠删了就行,
The joint density of the maximum and its location
04-30
Introduction It is of interest' to calculate the distribution of the ...can be obtained in a simple closed form from the joint distribution of the maximum, its location, and the endpoint which we give.
jQuery 源码分析笔记(3) Deferred机制
01-21
其中Resolved表示该操作成功完成了，而Rejected 则表示出现了错误，调用失败。Deferred对象的主要成员如下： done(callback): 注册一个callback函数，当状态为resolved时被调用。 * fail(callback): 注册一个...
ES7之Async/await的使用详解
10-17
使用Async/Await，我们的代码更接近同步风格，异常处理也更加清晰。`try...catch`块可以捕获到`await`表达式抛出的错误，这在处理可能出现错误的异步操作时非常有用。 总结一下，Async/Await是ES7引入的一个强大的...
项目服务间访问提示The request was rejected because the URL contained a potentially malicious String “//“
喜羊羊love红太狼
01-23 1115
1.开发过程最好是按照规范开发，可以避免诸如此类低级问题。比如项目中前缀是那么controller统一这样的话拼接到一起就不会有双横线问题了2.当然如果允许路径中存在双横线则可以在security中添加配置@Bean//此处可添加别的规则,目前只设置 允许双 //
The request was rejected because the URL contained a potentially malicious String ";"报错解决,
热门推荐
zhuyongru的专栏
09-11 2万+
去掉 URL 中讨厌的 jsessionid 在Java开发的网站中，经常会出现在URL中包含有jsessionid，用来记录session。 这是因为如果浏览器不支持cookie，JSP容器通过在URL中包含jsessionid来达到session的效果。 第一次访问的时候服务器不知道客户端有没有禁用cookie，所以会在超链接上加上jsessionid，在session过期以前第二次访问的...
The request was rejected because the URL contained a potentially malicious String “%2e“
脑神
01-11 4359
日志出现： [http-nio-80-exec-3] ERROR o.a.c.c.C.[.[localhost].[/].[dispatcherServlet] - Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception org.springframework.security.web.firewall.RequestRejectedException: The request w
URL 使用 jsessionid 异常处理
吕小小布的博客
06-30 958
异常：The request was rejected because the URL contained a potentially malicious String （中文：该请求被拒绝，因为该URL包含潜在的恶意字符串） URL默认会使用jsessionid，因为它不安全。可能导致会话固定攻击和泄漏敏感（会话ID）数据。 我们需要禁用掉URL携带jsessionid spring boot server.servlet.session.tracking-modes=cookie s..
web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentia
kevin_loving的博客
12-18 4372
spring security 自带url 校验失败 因为请求的url不合法，但是对接方又不能修改，只能平台适配 org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious......
org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because
Nostalgia____的博客
03-15 6542
org.springframework.security.web.firewall.RequestRejectedException
The request was rejected because the URL contained a potentially malicious String "//"
11-24
根据提供的引用内容，可以看出这是一个Spring Security的异常，它是由于URL中包含了潜在的恶意字符串而被拒绝的。其中"%3B"和"//"都是常见的恶意字符串，因为它们可以用于绕过URL过滤器，执行一些恶意操作，例如SQL注入、跨站脚本攻击等。 为了解决这个问题，可以采取以下措施： 1. 在Spring Security配置中启用URL编码过滤器，它可以自动将URL中的特殊字符进行编码，从而防止恶意字符串的出现。 2. 对于一些敏感的URL，可以采用白名单机制，只允许特定的URL通过过滤器，其他的URL都将被拒绝。 3. 对于一些需要包含特殊字符的URL，可以采用安全编码的方式，例如Base64编码，将特殊字符转换为安全的字符，从而避免恶意字符串的出现。 ```java // 启用URL编码过滤器 @Configuration @EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .anyRequest().authenticated() .and() .formLogin() .and() .httpBasic() .and() .csrf() .ignoringAntMatchers("/h2-console/**") // 忽略H2控制台的CSRF保护 .and() .headers() .frameOptions().sameOrigin() // 允许H2控制台的iframe加载 .and() .addFilterBefore(new RequestRejectedExceptionFilter(), ChannelProcessingFilter.class) // 添加URL编码过滤器 .sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.STATELESS); } } // URL编码过滤器 public class RequestRejectedExceptionFilter extends OncePerRequestFilter { @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { String requestUri = request.getRequestURI(); if (requestUri.contains("%3B") || requestUri.contains("//")) { throw new RequestRejectedException("The request was rejected because the URL contained a potentially malicious String"); } filterChain.doFilter(request, response); } } ```

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值