启动了不安全的HTTP方法（漏洞、springmvc）

启动了不安全的HTTP方法，如PUT、DELETE方法等。

解放方案1：

为每个方法进行限制，只有一个HTTP方法，如：

@RequestMapping(path = "/remove", method = RequestMethod.POST)

或者

@PostMapping("/remove")

解决方案2：

全局屏蔽PUT、DELETE方法，用Filter过滤

1. Filter类代码

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Arrays;
import java.util.HashSet;
import java.util.LinkedHashSet;
import java.util.Set;

/**
 * 全局禁用不安全HTTP方法过滤器
 * 仅允许：GET、POST、HEAD
 */
public class HttpMethodSecurityFilter implements Filter {

    /**
     * 允许的HTTP方法
     */
    private static final Set<String> ALLOWED_METHODS =
            new LinkedHashSet<>(Arrays.asList("GET", "POST", "HEAD"));

    /**
     * 拦截的不安全HTTP方法
     */
    private static final Set<String> BLOCKED_METHODS =
            new HashSet<>(Arrays.asList("PUT", "DELETE", "PATCH", "OPTIONS", "TRACE"));

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        System.out.println("=== HttpMethodSecurityFilter 初始化成功 ===");
        System.out.println("=== 允许的方法: " + ALLOWED_METHODS);
        System.out.println("=== 拦截的方法: " + BLOCKED_METHODS);
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {

        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;

        String method = httpRequest.getMethod();
        String uri = httpRequest.getRequestURI();

        // 打印日志，方便查看是否生效
        System.out.println("=== HttpMethodSecurityFilter 拦截请求: " + method + " " + uri);

        // 拦截不安全方法
        if (BLOCKED_METHODS.contains(method)) {
            System.out.println("=== 拦截不安全方法: " + method);
            httpResponse.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
            httpResponse.setContentType("application/json;charset=UTF-8");
            httpResponse.getWriter().write(
                    String.format(
                            "{\"code\":405,\"timestamp\":\"%s\",\"msg\":\"HTTP方法 [%s] 不允许，仅支持 %s\"}",
                            DateUtils.getDateTime(),
                            method,
                            ALLOWED_METHODS
                    )
            );
            return;
        }

        // 放行安全方法
        chain.doFilter(request, response);
    }

    @Override
    public void destroy() {
        System.out.println("=== HttpMethodSecurityFilter 销毁 ===");
    }
}

2. web.xml配置

<!-- 全局禁用不安全HTTP方法过滤器 -->
<filter>
    <filter-name>httpMethodSecurityFilter</filter-name>
    <filter-class>com.enuo.dp.common.filter.HttpMethodSecurityFilter</filter-class>
</filter>

<filter-mapping>
    <filter-name>httpMethodSecurityFilter</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>

3. 验证

启动Tomcat，观察控制台

启动时应该看到：

=== HttpMethodSecurityFilter 初始化成功 ===
=== 允许的方法: [GET, POST, HEAD]
=== 拦截的方法: [PATCH, DELETE, PUT, TRACE, OPTIONS]

转载自 CSDN-专业IT技术社区

原文链接：https://blog.csdn.net/qq_42277412/article/details/164715373