CODEWITHSUNDEEP
javaspring-bootsecurity
Bexter lab
Bexter lab

Reputation: 29

Spring boot exact comma next to the path variable

I have an spring boot app with 2.1.0.RELEASE version.

I have a path variable in my url like @GetMapping("/{type}/car") and I call my app with:

http://localhost:8080/BMW;AAAAAAAAAAAAA/car

But i get only BMW string. Spring skip exact comma and "AAAAAAAAAAAAA".

I apply a filter and I have a same expereince with it. I wanna get path variable like "BMW;AAAAAAAAAAAAA", but I dont get it.

The reason why I want to filter this kind of call out, because it is a security hole.

Upvotes: 0

Views: 658

Answers (2)

Bexter lab
Bexter lab

Reputation: 29

I find a possible solution:

@Configuration
public class SolutionConfig extends WebMvcConfigurationSupport {

@Override
protected PathMatchConfigurer getPathMatchConfigurer() {
    PathMatchConfigurer pathMatchConfigurer = super.getPathMatchConfigurer();
    UrlPathHelper urlPathHelper = new UrlPathHelper();
    urlPathHelper.setRemoveSemicolonContent(false);
    pathMatchConfigurer.setUrlPathHelper(urlPathHelper);
    return pathMatchConfigurer;
    }
}

Source code link: https://github.com/spring-projects/spring-framework/blob/master/spring-web/src/main/java/org/springframework/web/util/UrlPathHelper.java

Key method name is "removeSemicolonContent".

Upvotes: 1

prakashb
prakashb

Reputation: 170

Try encoding first, the value will be this BMW%3BAAAAAAAAAAAAA, you can use UriUtils for encoding and decoding.

Upvotes: 1

Related Questions