Spring 5.0.3 RequestRejectedException：由于网址未规范化，因此请求被拒绝

88

不知道这是Spring 5.0.3的错误还是新功能可以修复我的问题。

升级后，出现此错误。有趣的是，此错误仅在我的本地计算机上。使用HTTPS协议的测试环境中的相同代码可以正常工作。

继续...

我收到此错误的原因是因为我用于加载结果JSP页面的URL是/location/thisPage.jsp。评估代码request.getRequestURI()会给我结果/WEB-INF/somelocation//location/thisPage.jsp。如果我将JSP页面的URL修复为此location/thisPage.jsp，则一切正常。

所以我的问题是，我应该/从JSP代码的路径中删除吗，因为这是今后的要求。或者Spring引入了一个错误，因为我的机器和测试环境之间的唯一区别是协议HTTP与HTTPS。

 org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL was not normalized.
    at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:123)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:194)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:186)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270)
spring-mvc  spring-security 
— java_dude
source
1
— Munish Chandel '18年
1
计划在5.1.0中解决该问题；当前5.0.0尚无此问题。
— java_dude18年

Answers:

67

Spring Security Documentation提到了阻塞请求的原因。

例如，它可能包含路径遍历序列（例如/../）或多个正斜杠（//），这也可能导致模式匹配失败。一些容器在执行servlet映射之前将它们标准化，但其他容器则没有。为了避免此类问题，FilterChainProxy使用HttpFirewall策略检查并包装请求。默认情况下，未规范的请求将自动被拒绝，并且出于匹配目的，将删除路径参数和重复的斜杠。

因此，有两种可能的解决方案-

  1. 删除双斜杠（首选方法）
  2. 通过使用以下代码来自定义StrictHttpFirewall，在Spring Security中允许//。

步骤1 创建允许URL斜线的自定义防火墙。

@Bean
public HttpFirewall allowUrlEncodedSlashHttpFirewall() {
    StrictHttpFirewall firewall = new StrictHttpFirewall();
    firewall.setAllowUrlEncodedSlash(true);    
    return firewall;
}

步骤2，然后在Websecurity中配置此bean

@Override
public void configure(WebSecurity web) throws Exception {
    //@formatter:off
    super.configure(web);
    web.httpFirewall(allowUrlEncodedSlashHttpFirewall());
....
}

步骤2是可选步骤，Spring Boot仅需要声明一个类型为bean的bean HttpFirewall

— 穆尼斯·钱德尔（Munish Chandel）
source
是的，已经引入了路径遍历安全性。多数民众赞成在一个新功能，这可能会导致问题。正如您所看到的那样，我不太确定它是否适用于HTTPS而不适用于HTTP。我宁愿等到这个错误得到解决jira.spring.io/browse/SPR-16419
— java_dude
这很可能是我们问题的一部分...但是...用户未输入//，所以我试图弄清楚第二个/是如何添加到第一位的...如果spring正在生成我们的jstl url不应添加该URL，或在添加后对其进行规范化。
— xenoterracide
4
至少对于Spring Security 5.1.1，这实际上并没有解决该解决方案。如果您需要带有两个斜杠（例如a / b // c）的URL，则必须使用DefaultHttpFirewall。无法在StrictHttpFirewall中配置或覆盖isNormalized方法。
— 杰森·温内贝克
有人可能会指出在Spring而不是Boot中如何做到这一点吗？
— schoon
28

setAllowUrlEncodedSlash(true)没有为我工作。当使用双斜杠时，仍然isNormalized返回内部方法false。

我换成StrictHttpFirewall与DefaultHttpFirewall由只具有下面的代码：

@Bean
public HttpFirewall defaultHttpFirewall() {
    return new DefaultHttpFirewall();
}

对我来说很好。
使用有任何风险DefaultHttpFirewall吗？

— 毛希特里
source
1
是。仅仅因为您无法为室友创建备用钥匙，并不意味着您应该将唯一的钥匙放在门垫下。不建议。不应更改安全性。
— java_dude18年
16
@java_dude很好，您根本不提供任何信息或理由，只是一个模糊的类比。
— kaqqao
另一个选择是子类化，StrictHttpFirewall以对URL的拒绝给予更多控制，如本答案所述。
— vallismortis
1
这对我<sec:http-firewall ref="defaultHttpFirewall"/>
— 有用，
1
使用此解决方案有什么含义？
— Felipe Desiderati
10

我在遇到同样的问题：

Spring Boot版本= 1.5.10
Spring Security版本= 4.2.4


该问题发生在端点上，其中ModelAndViewviewName是用前面的正斜杠定义的。例：

ModelAndView mav = new ModelAndView("/your-view-here");

如果我删除斜线，它就可以正常工作。例：

ModelAndView mav = new ModelAndView("your-view-here");

我还对RedirectView进行了一些测试，它似乎可以与前面的正斜杠一起使用。

— 托斯滕·奥亚佩列夫（Torsten Ojaperv）
source
2
那不是解决方案。如果这是Spring方面的错误，该怎么办。如果他们更改了它，那么您将不得不再次撤消所有更改。我宁愿等到5.1标记为可解决。
— java_dude18年
1
不，您不必还原更改，因为在较旧版本上定义viewName且不使用正斜杠即可正常工作。
— Torsten Ojaperv'3
那就是问题所在。如果一切正常，并且您没有进行任何更改，则Spring引入了一个错误。路径应始终以“ /”开头。查看任何春季文档。查看这些信息github.com/spring-projects/spring-security/issues/5007和github.com/spring-projects/spring-security/issues/5044
— java_dude
1
这也咬了我。更新所有ModelAndView而不使用前导“ /”解决了该问题
— Nathan Perrier
jira.spring.io/browse/SPR-16740我打开了一个错误，但删除前导/并不是我的解决办法，在大多数情况下，我们只是将视图名称作为字符串返回（从控制器返回） 。需要考虑重定向视图作为解决方案。
— xenoterracide
4

就我而言，已从spring-securiy-web 3.1.3升级到4.2.12，默认情况下defaultHttpFirewall已从更改DefaultHttpFirewall为StrictHttpFirewall。因此，只需在XML配置中定义它，如下所示：

<bean id="defaultHttpFirewall" class="org.springframework.security.web.firewall.DefaultHttpFirewall"/>
<sec:http-firewall ref="defaultHttpFirewall"/>

设置HTTPFirewall为DefaultHttpFirewall

— 冰心
source
1
请在您的代码中添加一些说明，以说明发生了什么以及为什么。这是个好习惯。否则，您的答案就有被删除的风险。它已被标记为低质量。
— herrbischoff
3

下面的解决方案是一个干净的解决方法，它不会损害安全性，因为我们使用的是严格的防火墙。

修复步骤如下：

步骤1：创建一个覆盖StrictHttpFirewall的类，如下所示。

package com.biz.brains.project.security.firewall;

import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Set;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.http.HttpMethod;
import org.springframework.security.web.firewall.DefaultHttpFirewall;
import org.springframework.security.web.firewall.FirewalledRequest;
import org.springframework.security.web.firewall.HttpFirewall;
import org.springframework.security.web.firewall.RequestRejectedException;

public class CustomStrictHttpFirewall implements HttpFirewall {
    private static final Set<String> ALLOW_ANY_HTTP_METHOD = Collections.unmodifiableSet(Collections.emptySet());

    private static final String ENCODED_PERCENT = "%25";

    private static final String PERCENT = "%";

    private static final List<String> FORBIDDEN_ENCODED_PERIOD = Collections.unmodifiableList(Arrays.asList("%2e", "%2E"));

    private static final List<String> FORBIDDEN_SEMICOLON = Collections.unmodifiableList(Arrays.asList(";", "%3b", "%3B"));

    private static final List<String> FORBIDDEN_FORWARDSLASH = Collections.unmodifiableList(Arrays.asList("%2f", "%2F"));

    private static final List<String> FORBIDDEN_BACKSLASH = Collections.unmodifiableList(Arrays.asList("\\", "%5c", "%5C"));

    private Set<String> encodedUrlBlacklist = new HashSet<String>();

    private Set<String> decodedUrlBlacklist = new HashSet<String>();

    private Set<String> allowedHttpMethods = createDefaultAllowedHttpMethods();

    public CustomStrictHttpFirewall() {
        urlBlacklistsAddAll(FORBIDDEN_SEMICOLON);
        urlBlacklistsAddAll(FORBIDDEN_FORWARDSLASH);
        urlBlacklistsAddAll(FORBIDDEN_BACKSLASH);

        this.encodedUrlBlacklist.add(ENCODED_PERCENT);
        this.encodedUrlBlacklist.addAll(FORBIDDEN_ENCODED_PERIOD);
        this.decodedUrlBlacklist.add(PERCENT);
    }

    public void setUnsafeAllowAnyHttpMethod(boolean unsafeAllowAnyHttpMethod) {
        this.allowedHttpMethods = unsafeAllowAnyHttpMethod ? ALLOW_ANY_HTTP_METHOD : createDefaultAllowedHttpMethods();
    }

    public void setAllowedHttpMethods(Collection<String> allowedHttpMethods) {
        if (allowedHttpMethods == null) {
            throw new IllegalArgumentException("allowedHttpMethods cannot be null");
        }
        if (allowedHttpMethods == ALLOW_ANY_HTTP_METHOD) {
            this.allowedHttpMethods = ALLOW_ANY_HTTP_METHOD;
        } else {
            this.allowedHttpMethods = new HashSet<>(allowedHttpMethods);
        }
    }

    public void setAllowSemicolon(boolean allowSemicolon) {
        if (allowSemicolon) {
            urlBlacklistsRemoveAll(FORBIDDEN_SEMICOLON);
        } else {
            urlBlacklistsAddAll(FORBIDDEN_SEMICOLON);
        }
    }

    public void setAllowUrlEncodedSlash(boolean allowUrlEncodedSlash) {
        if (allowUrlEncodedSlash) {
            urlBlacklistsRemoveAll(FORBIDDEN_FORWARDSLASH);
        } else {
            urlBlacklistsAddAll(FORBIDDEN_FORWARDSLASH);
        }
    }

    public void setAllowUrlEncodedPeriod(boolean allowUrlEncodedPeriod) {
        if (allowUrlEncodedPeriod) {
            this.encodedUrlBlacklist.removeAll(FORBIDDEN_ENCODED_PERIOD);
        } else {
            this.encodedUrlBlacklist.addAll(FORBIDDEN_ENCODED_PERIOD);
        }
    }

    public void setAllowBackSlash(boolean allowBackSlash) {
        if (allowBackSlash) {
            urlBlacklistsRemoveAll(FORBIDDEN_BACKSLASH);
        } else {
            urlBlacklistsAddAll(FORBIDDEN_BACKSLASH);
        }
    }

    public void setAllowUrlEncodedPercent(boolean allowUrlEncodedPercent) {
        if (allowUrlEncodedPercent) {
            this.encodedUrlBlacklist.remove(ENCODED_PERCENT);
            this.decodedUrlBlacklist.remove(PERCENT);
        } else {
            this.encodedUrlBlacklist.add(ENCODED_PERCENT);
            this.decodedUrlBlacklist.add(PERCENT);
        }
    }

    private void urlBlacklistsAddAll(Collection<String> values) {
        this.encodedUrlBlacklist.addAll(values);
        this.decodedUrlBlacklist.addAll(values);
    }

    private void urlBlacklistsRemoveAll(Collection<String> values) {
        this.encodedUrlBlacklist.removeAll(values);
        this.decodedUrlBlacklist.removeAll(values);
    }

    @Override
    public FirewalledRequest getFirewalledRequest(HttpServletRequest request) throws RequestRejectedException {
        rejectForbiddenHttpMethod(request);
        rejectedBlacklistedUrls(request);

        if (!isNormalized(request)) {
            request.setAttribute("isNormalized", new RequestRejectedException("The request was rejected because the URL was not normalized."));
        }

        String requestUri = request.getRequestURI();
        if (!containsOnlyPrintableAsciiCharacters(requestUri)) {
            request.setAttribute("isNormalized",  new RequestRejectedException("The requestURI was rejected because it can only contain printable ASCII characters."));
        }
        return new FirewalledRequest(request) {
            @Override
            public void reset() {
            }
        };
    }

    private void rejectForbiddenHttpMethod(HttpServletRequest request) {
        if (this.allowedHttpMethods == ALLOW_ANY_HTTP_METHOD) {
            return;
        }
        if (!this.allowedHttpMethods.contains(request.getMethod())) {
            request.setAttribute("isNormalized",  new RequestRejectedException("The request was rejected because the HTTP method \"" +
                    request.getMethod() +
                    "\" was not included within the whitelist " +
                    this.allowedHttpMethods));
        }
    }

    private void rejectedBlacklistedUrls(HttpServletRequest request) {
        for (String forbidden : this.encodedUrlBlacklist) {
            if (encodedUrlContains(request, forbidden)) {
                request.setAttribute("isNormalized",  new RequestRejectedException("The request was rejected because the URL contained a potentially malicious String \"" + forbidden + "\""));
            }
        }
        for (String forbidden : this.decodedUrlBlacklist) {
            if (decodedUrlContains(request, forbidden)) {
                request.setAttribute("isNormalized",  new RequestRejectedException("The request was rejected because the URL contained a potentially malicious String \"" + forbidden + "\""));
            }
        }
    }

    @Override
    public HttpServletResponse getFirewalledResponse(HttpServletResponse response) {
        return new FirewalledResponse(response);
    }

    private static Set<String> createDefaultAllowedHttpMethods() {
        Set<String> result = new HashSet<>();
        result.add(HttpMethod.DELETE.name());
        result.add(HttpMethod.GET.name());
        result.add(HttpMethod.HEAD.name());
        result.add(HttpMethod.OPTIONS.name());
        result.add(HttpMethod.PATCH.name());
        result.add(HttpMethod.POST.name());
        result.add(HttpMethod.PUT.name());
        return result;
    }

    private static boolean isNormalized(HttpServletRequest request) {
        if (!isNormalized(request.getRequestURI())) {
            return false;
        }
        if (!isNormalized(request.getContextPath())) {
            return false;
        }
        if (!isNormalized(request.getServletPath())) {
            return false;
        }
        if (!isNormalized(request.getPathInfo())) {
            return false;
        }
        return true;
    }

    private static boolean encodedUrlContains(HttpServletRequest request, String value) {
        if (valueContains(request.getContextPath(), value)) {
            return true;
        }
        return valueContains(request.getRequestURI(), value);
    }

    private static boolean decodedUrlContains(HttpServletRequest request, String value) {
        if (valueContains(request.getServletPath(), value)) {
            return true;
        }
        if (valueContains(request.getPathInfo(), value)) {
            return true;
        }
        return false;
    }

    private static boolean containsOnlyPrintableAsciiCharacters(String uri) {
        int length = uri.length();
        for (int i = 0; i < length; i++) {
            char c = uri.charAt(i);
            if (c < '\u0020' || c > '\u007e') {
                return false;
            }
        }

        return true;
    }

    private static boolean valueContains(String value, String contains) {
        return value != null && value.contains(contains);
    }

    private static boolean isNormalized(String path) {
        if (path == null) {
            return true;
        }

        if (path.indexOf("//") > -1) {
            return false;
        }

        for (int j = path.length(); j > 0;) {
            int i = path.lastIndexOf('/', j - 1);
            int gap = j - i;

            if (gap == 2 && path.charAt(i + 1) == '.') {
                // ".", "/./" or "/."
                return false;
            } else if (gap == 3 && path.charAt(i + 1) == '.' && path.charAt(i + 2) == '.') {
                return false;
            }

            j = i;
        }

        return true;
    }

}

步骤2：创建FirewalledResponse类

package com.biz.brains.project.security.firewall;

import java.io.IOException;
import java.util.regex.Pattern;

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServletResponseWrapper;

class FirewalledResponse extends HttpServletResponseWrapper {
    private static final Pattern CR_OR_LF = Pattern.compile("\\r|\\n");
    private static final String LOCATION_HEADER = "Location";
    private static final String SET_COOKIE_HEADER = "Set-Cookie";

    public FirewalledResponse(HttpServletResponse response) {
        super(response);
    }

    @Override
    public void sendRedirect(String location) throws IOException {
        // TODO: implement pluggable validation, instead of simple blacklisting.
        // SEC-1790. Prevent redirects containing CRLF
        validateCrlf(LOCATION_HEADER, location);
        super.sendRedirect(location);
    }

    @Override
    public void setHeader(String name, String value) {
        validateCrlf(name, value);
        super.setHeader(name, value);
    }

    @Override
    public void addHeader(String name, String value) {
        validateCrlf(name, value);
        super.addHeader(name, value);
    }

    @Override
    public void addCookie(Cookie cookie) {
        if (cookie != null) {
            validateCrlf(SET_COOKIE_HEADER, cookie.getName());
            validateCrlf(SET_COOKIE_HEADER, cookie.getValue());
            validateCrlf(SET_COOKIE_HEADER, cookie.getPath());
            validateCrlf(SET_COOKIE_HEADER, cookie.getDomain());
            validateCrlf(SET_COOKIE_HEADER, cookie.getComment());
        }
        super.addCookie(cookie);
    }

    void validateCrlf(String name, String value) {
        if (hasCrlf(name) || hasCrlf(value)) {
            throw new IllegalArgumentException(
                    "Invalid characters (CR/LF) in header " + name);
        }
    }

    private boolean hasCrlf(String value) {
        return value != null && CR_OR_LF.matcher(value).find();
    }
}

步骤3：创建自定义过滤器以抑制RejectedException

package com.biz.brains.project.security.filter;

import java.io.IOException;
import java.util.Objects;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.http.HttpHeaders;
import org.springframework.security.web.firewall.RequestRejectedException;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.GenericFilterBean;

import lombok.extern.slf4j.Slf4j;

@Component
@Slf4j
@Order(Ordered.HIGHEST_PRECEDENCE)
public class RequestRejectedExceptionFilter extends GenericFilterBean {

        @Override
        public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
            try {
                RequestRejectedException requestRejectedException=(RequestRejectedException) servletRequest.getAttribute("isNormalized");
                if(Objects.nonNull(requestRejectedException)) {
                    throw requestRejectedException;
                }else {
                    filterChain.doFilter(servletRequest, servletResponse);
                }
            } catch (RequestRejectedException requestRejectedException) {
                HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest;
                HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse;
                log
                    .error(
                            "request_rejected: remote={}, user_agent={}, request_url={}",
                            httpServletRequest.getRemoteHost(),  
                            httpServletRequest.getHeader(HttpHeaders.USER_AGENT),
                            httpServletRequest.getRequestURL(), 
                            requestRejectedException
                    );

                httpServletResponse.sendError(HttpServletResponse.SC_NOT_FOUND);
            }
        }
}

步骤4：在安全配置中将自定义过滤器添加到spring过滤器链

@Override
protected void configure(HttpSecurity http) throws Exception {
     http.addFilterBefore(new RequestRejectedExceptionFilter(),
             ChannelProcessingFilter.class);
}

现在，使用以上修复程序，我们可以处理RequestRejectedException错误404页面。

— 文卡特拉曼·穆图克里希南（Venkatraman Muthukrishnan）
source
谢谢。这是我暂时用来允许我们升级Java微服务直到前端应用程序全部升级之前的方法。我不需要第3步和第4步就可以成功地将'//'视为标准化。我只是注释掉了在isNormalized中检查双斜杠的条件，然后将其配置为使用CustomStrictHttpFirewall类。
— gtaborga
通过config有没有更简单的解决方法？但是，如果没有关闭防火墙..
— Prathamesh dhanawade
0

就我而言，问题是由未使用Postman登录引起的，因此我在另一个选项卡中打开了一个连接，该连接具有从Chrome会话标题中获取的会话cookie。

— 亚历克斯·D
source
By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.