Spring WebFlux - CVE-2023-34034 Anlatım Konusu (Resimli)

/**
 * Prepare the given pattern for use in matching to full URL paths.
 * By default, prepend a leading slash if needed for non-empty patterns.
 * @param pattern the pattern to initialize
 * @return the updated pattern
 * @since 5.2.25
 */
public String initFullPathPattern(String pattern) {
    return (StringUtils.hasLength(pattern) && !pattern.startsWith("/") ? "/" + pattern : pattern);
}

class PathPatternParserServerWebExchangeMatcherTests {

    @Test
    void matchesWhenConfiguredWithNoTrailingSlashAndPathContainsSlashThenMatches() {
        PathPatternParserServerWebExchangeMatcher matcher = new PathPatternParserServerWebExchangeMatcher("user/**");
        MockServerHttpRequest request = MockServerHttpRequest.get("/user/test").build();
assertThat(matcher.matches(MockServerWebExchange.from(request)).block().isMatch()).isTrue();
    }
}

    .authorizeExchange()
    .pathMatchers("admin/**")
    .hasRole(Roles.ADMIN)
                
    .and()
    .authorizeExchange()
    .anyExchange()
    .permitAll();

http
    // disable CSRF
    .csrf().disable()

    // add AuthenticationWebFilter and set the handler
    .formLogin()
    .authenticationSuccessHandler(new WebFilterChainServerAuthenticationSuccessHandler())
    .authenticationFailureHandler(((webFilterExchange, exception) -> Mono.error(exception)))

                
    .and()
    .authorizeExchange()
    .pathMatchers("admin/**")
    .hasRole(Roles.ADMIN)
                
    .and()
    .authorizeExchange()
    .anyExchange()
    .permitAll();

return http.build();