438
社区成员
791,241
社区内容
发帖
与我相关
我的任务
分享Path with "WEB-INF" or "META-INF": [WEB-INF/add.html]
weixin_38050602 2018-12-21 03:34:11
用Spring boot 的WEB-INF 目录彻底不能访问了?我转发到WEB-INF直接提示：Path with "WEB-INF" or "META-INF": [WEB-INF/add.html]；引用的包是Spring-webmvc-5.1.3.RELEASE.jar
这个是ResourceHttpRequestHandler 的源码... WEB-INF今后直接不让放东西了？
这个是ResourceHttpRequestHandler 的源码... WEB-INF今后直接不让放东西了？
...全文
请发表友善的回复…
发表回复
weixin_38089340 2019-03-03
- 打赏
- 举报
jsp之所以不会被拦截，原因可能是因为.jsp的路径是被jsp解析器拦截了，jsp解析器应该是servlet级别的...所以不会进入到spring中去吧。。。所以.jsp才不受影响(还没去追过源码，但应该是这样子的:)
weixin_38074560 2019-01-31
- 打赏
- 举报
引用来自“仪山湖”的评论
今天也遇到这个问题，看了下源码，是spring-webmvc中对resource路径解析做了限制
boolean
org.
springframework.
web.
servlet.
resource.
ResourceHttpRequestHandler.isInvalidPath(
Stringpath)
Identifies invalid resource paths. By default rejects:
Paths that contain "WEB-INF" or "META-INF"
Paths that contain "../" after a call to org.springframework.util.StringUtils.cleanPath.
Paths that represent a valid URL or would represent one after the leading slash is removed.
Note: this method assumes that leading, duplicate '/' or control characters (e.g. white space) have been trimmed so that the path starts predictably with a single '/' or does not have one.
Parameters:
path the path to validate
Returns:
true if the path is invalid, false otherwise
Since:
3.0.6
path = processPath(path);
if (!StringUtils.hasText(path) || isInvalidPath(path)) {
return null;
} 我也追到这里了~~不过想想，非要执着着丢进WEB-INF里一个.html也是醉了，换jsp格式就好了
if (!StringUtils.hasText(path) || isInvalidPath(path)) {
return null;
} 我也追到这里了~~不过想想，非要执着着丢进WEB-INF里一个.html也是醉了，换jsp格式就好了
weixin_38061494 2019-01-30
- 打赏
- 举报
今天也遇到这个问题，看了下源码，是spring-webmvc中对resource路径解析做了限制
boolean
org.
springframework.
web.
servlet.
resource.
ResourceHttpRequestHandler.isInvalidPath(
Stringpath)
Identifies invalid resource paths. By default rejects:
Paths that contain "WEB-INF" or "META-INF"
Paths that contain "../" after a call to org.springframework.util.StringUtils.cleanPath.
Paths that represent a valid URL or would represent one after the leading slash is removed.
Note: this method assumes that leading, duplicate '/' or control characters (e.g. white space) have been trimmed so that the path starts predictably with a single '/' or does not have one.
Parameters:
path the path to validate
Returns:
true if the path is invalid, false otherwise
Since:
3.0.6
path = processPath(path);
if (!StringUtils.hasText(path) || isInvalidPath(path)) {
return null;
}
if (!StringUtils.hasText(path) || isInvalidPath(path)) {
return null;
}
app:mergeDebugJavaResource 2 files found with path ‘META-INF/NOTICE.md‘ from in META-INF/spring.schemas，META-INF/spring.handlers，META-INF/spring.factories使用 Android编译异常` Cause: duplicate entry: META-INF/MANIFEST.MF` WEB-INF/lib & build path 的jar包问题 解决Unable to read TLD "META-INF/c.tld" from JAR file