使用Spring MVC + Spring Security中的參數重定向

Question

我正在使用Spring MVC + Spring Security 3.1開發一個應用程序，我的應用程序通過一個包含作爲字符串的XML文件的參數的特定URL進行調用。

我在測試環境中開發，所以我建立了一個測試控制器和我做的：

String parameter = "<Usuario>\n\t<ID>primaria</ID>\n</Usuario>"; 
return "redirect:/autenticacion/primaria?parametro=" + parameter; 

而且我得到以下異常：

org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.IllegalArgumentException: Invalid characters (CR/LF) in redirect location 
    org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:894) 
    org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:778) 
    javax.servlet.http.HttpServlet.service(HttpServlet.java:617) 
    javax.servlet.http.HttpServlet.service(HttpServlet.java:717) 
    org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter.doFilter(AbstractPreAuthenticatedProcessingFilter.java:88) 
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:311) 
    org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:116) 
    org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83) 
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) 
    org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113) 
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) 
    org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:101) 
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) 
    org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113) 
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) 
    org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54) 
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) 
    org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45) 
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) 
    org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105) 
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) 
    org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87) 
    org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) 
    org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:173) 
    org.springframework.security.config.debug.DebugFilter.doFilterInternal(DebugFilter.java:45) 
    org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76) 
    org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) 
    org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259) 
    org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88) 
    org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76) 

我能做些什麼來simmulate它？

編輯：我改變了實際的參數內容。問題是我無法刪除\ t和\ r字符，因爲該參數是由外部應用程序生成的，所以我必須「接受」包含\ r和\ t的參數......我該怎麼做？

Answer 1

好了，到最後我找到了一個解決辦法...

我已經建立了一個過濾器捕獲「衝突」的調用，並用'\ 0'字符替換'\ r'字符，它的工作原理！春季安全不會抱怨:)

@Override 
    public void doFilter(ServletRequest request, ServletResponse response, 
      FilterChain chain) throws IOException, ServletException { 
     HttpServletRequest httpRequest = (HttpServletRequest) request; 

     String incomingUrl = httpRequest.getRequestURI(); 
     // Se comprueba si la url original tiene caracter de retorno de carro 
     if (incomingUrl.indexOf('\r') >= 0) { 
      //Sustituye todos los caracteres retorno de carro por caracter vacío. 
      String newUrl = incomingUrl.replaceAll("\r", ""); 
      //Asigna una nueva url a la petición. 
      RequestDispatcher requestDispatcher = request 
        .getRequestDispatcher(newUrl); 
      requestDispatcher.forward(request, response); 
     } 
     //Sique adelante la cadena de filtros. 
     chain.doFilter(request, response); 
    } 

Answer 2

它看起來只是一個編碼問題，所以你可以自己手動完成。但春天將增加模型屬性到重定向URI默認情況下，所以你很可能只是做到這一點

@RequestMapping(...) 
public String handle(Model model, ...) { 
    ... 
    String parameter = "<Usuario>\n\t<ID>primaria</ID>\n</Usuario>"; 
    model.addAttribute("parametro", parameter); 
    return "redirect:/autenticacion/primaria"; 
}