怎么就行Apache Shiro权限绕过漏洞CVE-2020-11989的挖掘分析和复现

org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver#getChain

-

org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver#getPathWithinApplication

String contextPath = getContextPath(request);   【=”/;/test”】
String requestUri = getRequestUri(request);

#输出内容作为Shiro的权限验证输入值

if   (StringUtils.startsWithIgnoreCase(requestUri, contextPath)) {

// Normal case: URI contains   context path.

String path =   requestUri.substring(contextPath.length());

return (StringUtils.hasText(path)   ? path : "/");

} else {

// Special case: rather unusual.

return requestUri;

}

org.apache.shiro.web.util.WebUtils#getRequestUri

uri =   valueOrEmpty(request.getContextPath()) + "/" +                    valueOrEmpty(request.getServletPath()) +                    valueOrEmpty(request.getPathInfo());【=”/;/test//admin/page”】

return   normalize(decodeAndCleanUriString(request, uri));

org.apache.shiro.web.util.WebUtils#decodeAndCleanUriString

int semicolonIndex = uri.indexOf(';');

org.springframework.web.util.UrlPathHelper#getPathWithinServletMapping

String pathWithinApp =   getPathWithinApplication(request);

String servletPath =   getServletPath(request);

return servletPath;

org.springframework.web.util.UrlPathHelper#getPathWithinApplication

String contextPath =   getContextPath(request); 【=”/;/test”】

String requestUri =   getRequestUri(request);

return requestUri;

org.springframework.web.util.UrlPathHelper#getRequestUri

String uri = (String)   request.getAttribute(WebUtils.INCLUDE_REQUEST_URI_ATTRIBUTE); 【=”/;/test/admin/page”】

return decodeAndCleanUriString(request,   uri);

org.springframework.web.util.UrlPathHelper#decodeAndCleanUriString

uri = removeSemicolonContent(uri); 【="//test/admin/ page"】

uri = decodeRequestString(request, uri); 【=" / /test/ admin / page”】

uri = getSanitizedPath(uri); 【=" / /test/ admin/ page”】

return uri;

org.springframework.web.util.UrlPathHelper#getServletPath

String servletPath = (String)   request.getAttribute(WebUtils.INCLUDE_SERVLET_PATH_ATTRIBUTE); 【=”/admin/page”】

return servletPath; 【=”/admin/page”】

org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver#getChain

String requestURI =   getPathWithinApplication(request);

if (pathMatches(pathPattern, requestURI))   {……

return null;

org.apache.shiro.web.util.WebUtils#getPathWithinApplication

String contextPath =   getContextPath(request); 【=”/test”】

String requestUri =   getRequestUri(request);

org.apache.shiro.web.util.WebUtils#getRequestUri

uri =   valueOrEmpty(request.getContextPath()) + "/"   +valueOrEmpty(request.getServletPath()) +valueOrEmpty(request.getPathInfo());   【=" /test/ / admin/a%2fa "】

return   normalize(decodeAndCleanUriString(request, uri));

org.apache.shiro.web.util.WebUtils#decodeAndCleanUriString

uri = decodeRequestString(request, uri);

return (semicolonIndex != -1 ?   uri.substring(0, semicolonIndex) : uri);

org.apache.shiro.web.util.WebUtils#decodeRequestString

return URLDecoder.decode(source, enc);

java.net.URLDecoder#decode(java.lang.String,   java.lang.String)

#可解码“%2f”为“/”

while (i < numChars) {

c = s.charAt(i);

switch (c) {

case '+':

sb.append(' ');

i++;

needToChange = true;

break;

case '%':…………

return (needToChange? sb.toString() : s);   【=”/test//admin/a/a”】

org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver#pathMatches

return pathMatcher.matches(pattern,   path); 【pattern : " / admin/*"，source: " / admin/ a / a "】

org.apache.shiro.util.PatternMatcher#matches

return match(pattern, source);

org.apache.shiro.util.AntPathMatcher#doMatch

#判断得模板长度短于URI长度，说明URI和当前模板不属于同一类。

if (pathIdxStart > pathIdxEnd) {

// Path is exhausted, only match   if rest of pattern is * or **'s

……

} else if (pattIdxStart > pattIdxEnd)   {

// String not exhausted, but   pattern is. Failure.

return false;

javax.servlet.Servlet#service

-

javax.servlet.http.HttpServlet#doGet

-