修复路由拦截鉴权可被绕过的问题 fix #515

Author: click33

sa-token-core/src/main/java/cn/dev33/satoken/application/ApplicationInfo.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.application;
+
+import cn.dev33.satoken.util.SaFoxUtil;
+
+/**
+ * 应用全局信息
+ *
+ * @author click33
+ * @since 1.31.0
+ */
+public class ApplicationInfo {
+
+    /**
+     * 应用前缀
+     */
+    public static String routePrefix;
+
+    /**
+     * 为指定 path 裁剪掉 routePrefix 前缀
+     * @param path 指定 path
+     * @return /
+     */
+    public static String cutPathPrefix(String path) {
+        if(! SaFoxUtil.isEmpty(routePrefix) && ! routePrefix.equals("/") && path.startsWith(routePrefix)){
+            path = path.substring(routePrefix.length());
+        }
+        return path;
+    }
+
+}

sa-token-core/src/main/java/cn/dev33/satoken/exception/RequestPathInvalidException.java

@@ -0,0 +1,46 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.exception;
+
+/**
+ * 一个异常：代表请求 path 无效或非法
+ * 
+ * @author click33
+ * @since 1.37.0
+ */
+public class RequestPathInvalidException extends SaTokenException {
+
+	/**
+	 * 序列化版本号
+	 */
+	private static final long serialVersionUID = 8243974276159004739L;
+
+	/** 具体无效的 path */
+	private final String path;
+
+	/**
+	 * @return 具体无效的 path
+	 */
+	public String getPath() {
+		return path;
+	}
+
+	public RequestPathInvalidException(String message, String path) {
+		super(message);
+		this.path = path;
+	}
+
+}

sa-token-core/src/main/java/cn/dev33/satoken/fun/strategy/SaCheckRequestPathFunction.java

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.fun.strategy;
+
+import cn.dev33.satoken.exception.RequestPathInvalidException;
+
+/**
+ * 函数式接口：校验请求 path 的算法
+ *
+ * <p>  如果属于无效请求 path，则抛出异常 RequestPathInvalidException  </p>
+ *
+ * @author click33
+ * @since 1.37.0
+ */
+@FunctionalInterface
+public interface SaCheckRequestPathFunction {
+
+    /**
+     * 执行函数
+     * @param path 请求 path
+     * @param extArg1 扩展参数1
+     * @param extArg2 扩展参数2
+     */
+    void run(String path, Object extArg1, Object extArg2);
+
+}

sa-token-core/src/main/java/cn/dev33/satoken/fun/strategy/SaRequestPathInvalidHandleFunction.java

@@ -0,0 +1,37 @@
+/*
+ * Copyright 2020-2099 sa-token.cc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package cn.dev33.satoken.fun.strategy;
+
+import cn.dev33.satoken.exception.RequestPathInvalidException;
+
+/**
+ * 函数式接口：当请求 path 校验不通过时处理方案的算法
+ *
+ * @author click33
+ * @since 1.37.0
+ */
+@FunctionalInterface
+public interface SaRequestPathInvalidHandleFunction {
+
+    /**
+     * 执行函数
+     * @param e 请求 path 无效的异常对象
+     * @param extArg1 扩展参数1
+     * @param extArg2 扩展参数2
+     */
+    void run(RequestPathInvalidException e, Object extArg1, Object extArg2);
+
+}

sa-token-core/src/main/java/cn/dev33/satoken/strategy/SaStrategy.java

@@ -18,6 +18,7 @@
 import cn.dev33.satoken.SaManager;
 import cn.dev33.satoken.annotation.*;
 import cn.dev33.satoken.basic.SaBasicUtil;
+import cn.dev33.satoken.exception.RequestPathInvalidException;
 import cn.dev33.satoken.exception.SaTokenException;
 import cn.dev33.satoken.fun.strategy.*;
 import cn.dev33.satoken.session.SaSession;
@@ -329,6 +330,49 @@ private SaStrategy() {
 		return new StpLogic(loginType);
 	};
 
+	/**
+	 * 请求 path 不允许出现的字符
+	 */
+	public static String[] INVALID_CHARACTER = {
+			"//", "\\",
+			"%2e", "%2E",	// .
+			"%2f", "%2F",	// /
+			"%5c", "%5C",	// \
+			"%25"	// 空格
+	};
+
+	/**
+	 * 校验请求 path 的算法
+	 */
+	public SaCheckRequestPathFunction checkRequestPath = (requestPath, extArg1, extArg2) -> {
+
+		// 不允许为null
+		if(requestPath == null) {
+			throw new RequestPathInvalidException("非法请求：null", null);
+		}
+		// 不允许包含非法字符
+		for (String item : INVALID_CHARACTER) {
+			if (requestPath.contains(item)) {
+				throw new RequestPathInvalidException("非法请求：" + requestPath, requestPath);
+			}
+		}
+		// 不允许出现跨目录
+		if(requestPath.contains("/.") || requestPath.contains("\\.")) {
+			throw new RequestPathInvalidException("非法请求：" + requestPath, requestPath);
+		}
+	};
+
+
+	/**
+	 * 当请求 path 校验不通过时处理方案的算法，自定义示例：
+	 * <pre>
+	 * 		SaStrategy.instance.requestPathInvalidHandle = (e, extArg1, extArg2) -> {
+	 * 			// 自定义处理逻辑 ...
+	 *      };
+	 * </pre>
+	 */
+	public SaRequestPathInvalidHandleFunction requestPathInvalidHandle = null;
+
 
 	// ----------------------- 重写策略 set连缀风格
 

sa-token-core/src/main/java/cn/dev33/satoken/util/SaTokenConsts.java

@@ -186,6 +186,28 @@ private SaTokenConsts() {
 	 */
 	public static final int ASSEMBLY_ORDER = -100;
 
+	/**
+	 * 请求 path 校验过滤器的注册顺序
+	 */
+	public static final int PATH_CHECK_FILTER_ORDER = -1000;
+
+	/**
+	 * Content-Type  key
+	 */
+	public static final String CONTENT_TYPE_KEY = "Content-Type";
+
+	/**
+	 * Content-Type  text/plain; charset=utf-8
+	 */
+	public static final String CONTENT_TYPE_TEXT_PLAIN = "text/plain; charset=utf-8";
+
+	/**
+	 * Content-Type  application/json;charset=UTF-8
+	 */
+	public static final String CONTENT_TYPE_APPLICATION_JSON = "application/json;charset=UTF-8";
+
+
+
 
 	// =================== 废弃 ===================  
 

sa-token-demo/sa-token-demo-springboot3-redis/src/main/java/com/pj/test/TestController.java

@@ -1,10 +1,11 @@
 package com.pj.test;
 
+import cn.dev33.satoken.context.SaHolder;
+import cn.dev33.satoken.spring.SpringMVCUtil;
+import cn.dev33.satoken.util.SaResult;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
-import cn.dev33.satoken.util.SaResult;
-
 /**
  * 测试专用Controller 
  * @author click33
@@ -27,4 +28,13 @@ public SaResult test2() {
 		return SaResult.ok();
 	}
 
+	// 测试   浏览器访问： http://localhost:8081/test/getRequestPath
+	@RequestMapping("getRequestPath")
+	public SaResult getRequestPath() {
+		System.out.println("-------------- 测试请求 path 获取");
+		System.out.println("request.getRequestURI() " + SpringMVCUtil.getRequest().getRequestURI());
+		System.out.println("saRequest.getRequestPath() " + SaHolder.getRequest().getRequestPath());
+		return SaResult.ok();
+	}
+
 }

sa-token-demo/sa-token-demo-springboot3-redis/src/main/resources/application.yml

@@ -19,7 +19,7 @@ sa-token:
     # 是否输出操作日志 
     is-log: true
 
-spring: 
+spring:
     data: 
         # redis配置 
         redis:

sa-token-demo/sa-token-demo-test/pom.xml

@@ -11,6 +11,7 @@
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
 		<version>2.5.14</version>
+		<!--<version>2.3.0.RELEASE</version>-->
 		<!-- <version>1.5.9.RELEASE</version> -->
 		<relativePath/>
 	</parent>

sa-token-demo/sa-token-demo-test/src/main/java/com/pj/current/NotFoundHandle.java

@@ -23,5 +23,5 @@ public Object error(HttpServletRequest request, HttpServletResponse response) th
 		response.setStatus(200);
         return SaResult.get(404, "not found", null);
     }
-	
+
 }