Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[bug] request.getRequestURL() 存在绕过的问题 #46

Closed
yupd opened this issue Oct 25, 2023 · 4 comments
Closed

[bug] request.getRequestURL() 存在绕过的问题 #46

yupd opened this issue Oct 25, 2023 · 4 comments
Labels
bug Something isn't working

Comments

@yupd
Copy link

yupd commented Oct 25, 2023

例如：对 url /demo/test.do 设置黑名单，可以通过 /demo/;xx/test.do 绕过。
@xl1605368195 xl1605368195 added the bug Something isn't working label Oct 26, 2023
@jvm-rasp
Copy link
Owner

当前计划增加url特殊字符串检测功能，禁止在url中出现;等字符

@yupd
Copy link
Author

yupd commented Oct 30, 2023

当前计划增加url特殊字符串检测功能，禁止在url中出现;等字符

使用 request.getServletPath() 是最终的请求的地址，用这个方法取代 request.getRequestURL() 是不是好点？

@jvm-rasp
Copy link
Owner

好的，我看下。为了兼容性，增加一个真实url字段。
检测url中特殊字符串功能已经增加

@jvm-rasp
Copy link
Owner

243e5a7

@yupd yupd closed this as completed Jul 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@yupd @xl1605368195 @jvm-rasp