java中SpringMVC中@PathVariable注解的XSS注入问题

@Controller
@RequestMapping("/some")
public class SomeController{
 
  @RequestMapping(value = "/{somepath}")
  public String func(@PathVariable("somepath")String somepath){
    doSomething(path);
    return "";
   }

}

/* org.springframework.web.servlet.handler.AbstractHandlerMapping 类 */
public abstract class AbstractHandlerMapping extends WebApplicationObjectSupport implements HandlerMapping, Ordered {
   private int order = Integer.MAX_VALUE;  // default: same as non-Ordered
   private Object defaultHandler;
   private UrlPathHelper urlPathHelper = new UrlPathHelper();
   private PathMatcher pathMatcher = new AntPathMatcher();

/* 省略代码... */

  其中UrlPathHelper 类中包含decodePathVariables和decodeMatrixVariables两个方法即为抽取path参数，所以自定义一个UrlPathHelper来完成参数过滤功能。然后所有AbstractHandlerMapping均使用自定义UrlPathHelper即可。但是需要注意的是SpringMVC默认产生了两个HandlerMapping->RequestMappingHandlerMapping和BeanNameUrlHandlerMapping，其是在WebMvcConfigurationSupport这个类中产生的，所有必须设置这两个HandlerMapping的urlPathHelper，没有直接的调用接口，那么监听Spring的bean实例化即可，创建类如下：

/* 解决@PathVariable注解造成的xss攻击问题,注意:此类必需由WebApplicationContext初始化 */
public class XssHandlerMappingPostProcessor implements BeanPostProcessor{

  @Override
  public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException{
    return bean;
  }

  @Override
  public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException{
    if(bean instanceof AbstractHandlerMapping){
      AbstractHandlerMapping ahm = (AbstractHandlerMapping) bean;
      ahm.setUrlPathHelper(new XssUrlPathHelper());
    }

    return bean;
  }

  static class XssUrlPathHelper extends UrlPathHelper{

    @Override
    public Map decodePathVariables(HttpServletRequest request, Map vars){
      Map result = super.decodePathVariables(request, vars);
      if(!CollectionUtils.isEmpty(result)){
        for(String key : result.keySet()){
          result.put(key, cleanXSS(result.get(key)));
        }
      }

      return result;
    }

    @Override
    public MultiValueMap decodeMatrixVariables(HttpServletRequest request,
        MultiValueMap vars){
      MultiValueMap mvm = super.decodeMatrixVariables(request, vars);
      if(!CollectionUtils.isEmpty(mvm)){
        for(String key : mvm.keySet()){
          List value = mvm.get(key);
          for(int i = 0; i < value.size(); i++){
            value.set(i, cleanXSS(value.get(i)));
          }
        }
      }

      return mvm;
    }

    private String cleanXSS(String value){
      return HtmlUtils.htmlEscape(value);
    }

  }

}