漏洞条件:
请求json参数不是接收参数的javabean及其父类中的任意属性。
解决方案:
增加反序列化配置方案
package com.example.demo.config;
import com.fasterxml.jackson.databind.DeserializationFeature;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.boot.autoconfigure.http.HttpMessageConverters;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
@Configuration
public class JacksonConverters {
@Bean
public HttpMessageConverters JacksonHttpMessageConverters() {
MappingJackson2HttpMessageConverter mappingJackson2HttpMessageConverter
= new MappingJackson2HttpMessageConverter();
ObjectMapper objectMapper = new ObjectMapper();
//省略其他配置开始
//反序列化的时候如果多了其他属性,抛出异常
objectMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, true);
mappingJackson2HttpMessageConverter.setObjectMapper(objectMapper);
//省略其他配置结束
return new HttpMessageConverters(mappingJackson2HttpMessageConverter);
}
}
执行结果:拦截成功