时间戳

首页 > 解决方案 > 如何在 saml 中解决 firewall.RequestRejectedException

spring-security - 如何在 saml 中解决 firewall.RequestRejectedException

问题描述

将安全版本升级到 4.2.4 后， 

 对于包含分号的 url，我们得到了以下异常

 前任： 

https://url/name=somevalue;value=somevalue

 org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String ";"

        at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:140) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

        at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:120) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:193) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:185) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

        at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) ~[spring-security-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]

所以，我们对 httpfirewall 的自定义实现做了一些配置

      @Bean

      public HttpFirewall allowUrlEncodedSlashHttpFirewall()

      {

        StrictHttpFirewall firewall = new StrictHttpFirewall();

        firewall.setAllowUrlEncodedSlash(true);

        firewall.setAllowSemicolon(true);

        return firewall;

      } 

和 

   @Override

    public void configure(WebSecurity web) throws Exception

     {

       super.configure(web);

       web.httpFirewall(this.httpFirewall);

      }

配置后，我们面临同样的问题。

然后我调试了内置类StrictHttpFirewall.getFirewalledRequest(HttpServletRequest request) 

有时我们会收到嵌套请求，例如：

firewalledRequest[ firewallwedRequest [ …  (request).

我检查了dofilter()方法filterchainProxy

它没有清除SecurityContextHolder，因此FilterChainProxy实际上在链中发生了两次。

标签： spring-securityfirewallspring-saml

解决方案

推荐阅读