Spring boot exact comma next to the path variable

Question

I have an spring boot app with 2.1.0.RELEASE version.

I have a path variable in my url like @GetMapping("/{type}/car") and I call my app with:

http://localhost:8080/BMW;AAAAAAAAAAAAA/car

But i get only BMW string. Spring skip exact comma and "AAAAAAAAAAAAA".

I apply a filter and I have a same expereince with it. I wanna get path variable like "BMW;AAAAAAAAAAAAA", but I dont get it.

The reason why I want to filter this kind of call out, because it is a security hole.

I don't think you can use a semicolon like this: https://stackoverflow.com/questions/1178024/can-a-url-contain-a-semicolon-and-still-be-valid — Software Engineer, Mar 31 '20 at 13:49

prakashb · Answer 1 · 2020-03-31T14:35:25.300

1

Try encoding first, the value will be this BMW%3BAAAAAAAAAAAAA, you can use UriUtils for encoding and decoding.

edited Mar 31 '20 at 14:35

answered Mar 31 '20 at 14:24

prakashb

160
1
8

Bexter lab · Accepted Answer · 2020-04-02T14:32:07.827

I find a possible solution:

@Configuration
public class SolutionConfig extends WebMvcConfigurationSupport {

@Override
protected PathMatchConfigurer getPathMatchConfigurer() {
    PathMatchConfigurer pathMatchConfigurer = super.getPathMatchConfigurer();
    UrlPathHelper urlPathHelper = new UrlPathHelper();
    urlPathHelper.setRemoveSemicolonContent(false);
    pathMatchConfigurer.setUrlPathHelper(urlPathHelper);
    return pathMatchConfigurer;
    }
}

Source code link: https://github.com/spring-projects/spring-framework/blob/master/spring-web/src/main/java/org/springframework/web/util/UrlPathHelper.java

Key method name is "removeSemicolonContent".

Spring boot exact comma next to the path variable

2 Answers2