Shiro权限绕过合集

org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver#getChain,

public FilterChain getChain(ServletRequest request, ServletResponse response, FilterChain originalChain) {FilterChainManager filterChainManager = getFilterChainManager();if (!filterChainManager.hasChains()) {return null;}

String requestURI = getPathWithinApplication(request);

// in spring web, the requestURI "/resource/menus" ---- "resource/menus/" bose can access the resource// but the pathPattern match "/resource/menus" can not match "resource/menus/"// user can use requestURI + "/" to simply bypassed chain filter, to bypassed shiro protectif(requestURI != null && !DEFAULT_PATH_SEPARATOR.equals(requestURI)&& requestURI.endsWith(DEFAULT_PATH_SEPARATOR)) {requestURI = requestURI.substring(0, requestURI.length() - 1);}



//the 'chain names' in this implementation are actually path patterns defined by the user.  We just use them//as the chain name for the FilterChainManager's requirementsfor (String pathPattern : filterChainManager.getChainNames()) {if (pathPattern != null && !DEFAULT_PATH_SEPARATOR.equals(pathPattern)&& pathPattern.endsWith(DEFAULT_PATH_SEPARATOR)) {pathPattern = pathPattern.substring(0, pathPattern.length() - 1);}

// If the path does match, then pass on to the subclass implementation for specific checks:if (pathMatches(pathPattern, requestURI)) {......return null;}

org.apache.shiro.web.util.WebUtils#getPathWithinApplication

public static String getPathWithinApplication(HttpServletRequest request) {String contextPath = getContextPath(request);String requestUri = getRequestUri(request);if (StringUtils.startsWithIgnoreCase(requestUri, contextPath)) {// Normal case: URI contains context path.String path = requestUri.substring(contextPath.length());return (StringUtils.hasText(path) ? path : "/");} else {// Special case: rather unusual.return requestUri;}}

public static String getContextPath(HttpServletRequest request) {String contextPath = (String) request.getAttribute(INCLUDE_CONTEXT_PATH_ATTRIBUTE);if (contextPath == null) {contextPath = request.getContextPath();}contextPath = normalize(decodeRequestString(request, contextPath));if ("/".equals(contextPath)) {// the normalize method will return a "/" and includes on Jetty, will also be a "/".contextPath = "";}return contextPath;}

public static String getRequestUri(HttpServletRequest request) {String uri = (String) request.getAttribute(INCLUDE_REQUEST_URI_ATTRIBUTE);if (uri == null) {uri = request.getRequestURI();}return normalize(decodeAndCleanUriString(request, uri));}

public static boolean startsWithIgnoreCase(String str, String prefix) {if (str == null || prefix == null) {return false;}if (str.startsWith(prefix)) {return true;}if (str.length() < prefix.length()) {return false;}String lcStr = str.substring(0, prefix.length()).toLowerCase();String lcPrefix = prefix.toLowerCase();return lcStr.equals(lcPrefix);}

public static boolean hasText(String str) {if (!hasLength(str)) {return false;}int strLen = str.length();for (int i = 0; i < strLen; i++) {if (!Character.isWhitespace(str.charAt(i))) {return true;}}return false;}

private static String normalize(String path, boolean replaceBackSlash) {

if (path == null)return null;

// Create a place for the normalized pathString normalized = path;

if (replaceBackSlash && normalized.indexOf('\') >= 0)normalized = normalized.replace('\', '/');

if (normalized.equals("/."))return "/";

// Add a leading "/" if necessaryif (!normalized.startsWith("/"))normalized = "/" + normalized;

// Resolve occurrences of "//" in the normalized pathwhile (true) {int index = normalized.indexOf("//");if (index < 0)break;normalized = normalized.substring(0, index) +normalized.substring(index + 1);}

// Resolve occurrences of "/./" in the normalized pathwhile (true) {int index = normalized.indexOf("/./");if (index < 0)break;normalized = normalized.substring(0, index) +normalized.substring(index + 2);}

// Resolve occurrences of "/../" in the normalized pathwhile (true) {int index = normalized.indexOf("/../");if (index < 0)break;if (index == 0)return (null);  // Trying to go outside our contextint index2 = normalized.lastIndexOf('/', index - 1);normalized = normalized.substring(0, index2) +normalized.substring(index + 3);}

// Return the normalized path that we have completedreturn (normalized);

}

private static String decodeAndCleanUriString(HttpServletRequest request, String uri) {uri = decodeRequestString(request, uri);int semicolonIndex = uri.indexOf(';');return (semicolonIndex != -1 ? uri.substring(0, semicolonIndex) : uri);}

org.springframework.web.util.UrlPathHelper#removeSemicolonContentInternal

private String removeSemicolonContentInternal(String requestUri) {for(int semicolonIndex = requestUri.indexOf(59); semicolonIndex != -1; semicolonIndex = requestUri.indexOf(59, semicolonIndex)) {int slashIndex = requestUri.indexOf(47, semicolonIndex);String start = requestUri.substring(0, semicolonIndex);requestUri = slashIndex != -1 ? start + requestUri.substring(slashIndex) : start;}

return requestUri;}

org.apache.shiro.util.AntPathMatcher#doMatch

protected boolean doMatch(String pattern, String path, boolean fullMatch) {if (path.startsWith(this.pathSeparator) != pattern.startsWith(this.pathSeparator)) {return false;}

String[] pattDirs = StringUtils.tokenizeToStringArray(pattern, this.pathSeparator);String[] pathDirs = StringUtils.tokenizeToStringArray(path, this.pathSeparator);

int pattIdxStart = 0;int pattIdxEnd = pattDirs.length - 1;int pathIdxStart = 0;int pathIdxEnd = pathDirs.length - 1;

// Match all elements up to the first **while (pattIdxStart <= pattIdxEnd && pathIdxStart <= pathIdxEnd) {String patDir = pattDirs[pattIdxStart];if ("**".equals(patDir)) {break;}if (!matchStrings(patDir, pathDirs[pathIdxStart])) {return false;}pattIdxStart++;pathIdxStart++;}

if (pathIdxStart > pathIdxEnd) {// Path is exhausted, only match if rest of pattern is * or **'sif (pattIdxStart > pattIdxEnd) {return (pattern.endsWith(this.pathSeparator) ?path.endsWith(this.pathSeparator) : !path.endsWith(this.pathSeparator));}if (!fullMatch) {return true;}if (pattIdxStart == pattIdxEnd && pattDirs[pattIdxStart].equals("*") &&path.endsWith(this.pathSeparator)) {return true;}for (int i = pattIdxStart; i <= pattIdxEnd; i++) {if (!pattDirs[i].equals("**")) {return false;}}return true;} else if (pattIdxStart > pattIdxEnd) {// String not exhausted, but pattern is. Failure.return false;} else if (!fullMatch && "**".equals(pattDirs[pattIdxStart])) {// Path start definitely matches due to "**" part in pattern.return true;}

// up to last '**'while (pattIdxStart <= pattIdxEnd && pathIdxStart <= pathIdxEnd) {String patDir = pattDirs[pattIdxEnd];if (patDir.equals("**")) {break;}if (!matchStrings(patDir, pathDirs[pathIdxEnd])) {return false;}pattIdxEnd--;pathIdxEnd--;}if (pathIdxStart > pathIdxEnd) {// String is exhaustedfor (int i = pattIdxStart; i <= pattIdxEnd; i++) {if (!pattDirs[i].equals("**")) {return false;}}return true;}

while (pattIdxStart != pattIdxEnd && pathIdxStart <= pathIdxEnd) {int patIdxTmp = -1;for (int i = pattIdxStart + 1; i <= pattIdxEnd; i++) {if (pattDirs[i].equals("**")) {patIdxTmp = i;break;}}if (patIdxTmp == pattIdxStart + 1) {// '**/**' situation, so skip onepattIdxStart++;continue;}// Find the pattern between padIdxStart & padIdxTmp in str between// strIdxStart & strIdxEndint patLength = (patIdxTmp - pattIdxStart - 1);int strLength = (pathIdxEnd - pathIdxStart + 1);int foundIdx = -1;

strLoop:for (int i = 0; i <= strLength - patLength; i++) {for (int j = 0; j < patLength; j++) {String subPat = (String) pattDirs[pattIdxStart + j + 1];String subStr = (String) pathDirs[pathIdxStart + i + j];if (!matchStrings(subPat, subStr)) {continue strLoop;}}foundIdx = pathIdxStart + i;break;}

if (foundIdx == -1) {return false;}

pattIdxStart = patIdxTmp;pathIdxStart = foundIdx + patLength;}

for (int i = pattIdxStart; i <= pattIdxEnd; i++) {if (!pattDirs[i].equals("**")) {return false;}}

return true;}

org.apache.shiro.util.StringUtils#tokenizeToStringArray