Getting 500 response in Spring 5 when url contains semicolon

Question

I have recently upgraded to Spring from Spring 3. Earlier i was able to post and get resources when the url values contained a semicolon. But after upgrade i am getting 500 error. Below is my get request

/rest/logindomains/grouptorolemapping/13/Atl;BasGroup

Does anyone know how to resolve this issue?

Can you add the exception stack message to your question? – flyingfox Jul 23 '18 at 11:03 — flyingfox, Jul 23 '18 at 11:03

Chandan Ghosh · Answer 1 · 2018-07-25T06:03:47.587

Solved the issue by adding the below xml to security-config.xml. This will allow semicolon and percentage character in the url.

<bean id="myHttpFirewall" class="org.springframework.security.web.firewall.StrictHttpFirewall">
    <property name="allowSemicolon" value="true"/>
    <property name="allowUrlEncodedPercent" value="true"/>
</bean>
<security:http-firewall ref="myHttpFirewall"/>

Java Solution:

@Component
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter
{
private static final DebugLog LOG = new DebugLog("WebSecurityConfig", WebSecurityConfig.class);

@Bean
public HttpFirewall allowUrlEncodedSlashHttpFirewall() {
    StrictHttpFirewall firewall = new StrictHttpFirewall();
    firewall.setAllowUrlEncodedPercent(true);;
    firewall.setAllowSemicolon(true);
    return firewall;
}

@Override
public void configure(WebSecurity web) throws Exception {
  super.configure(web);
  // @formatter:off
  web.httpFirewall(allowUrlEncodedSlashHttpFirewall());
}

score 2 · Answer 2 · answered Jul 23 '18 at 11:52

2

Spring 5 contains StrictHttpFirewall which is enabled by default. In order to allow using a semicolon in URL, it is required to use setAllowSemicolon(boolean) method.

answered Jul 23 '18 at 11:52

pb_tech

63
6

score 2 · Accepted Answer · answered Jul 23 '18 at 12:45

2

For enabling semicolon in url u must tune UrlPathHelper. For example:

@Configuration
public class WebConfig implements WebMvcConfigurer {
    @Override
    public void configurePathMatch(PathMatchConfigurer configurer) {
        UrlPathHelper urlPathHelper = new UrlPathHelper();
        urlPathHelper.setRemoveSemicolonContent(false);

        configurer.setUrlPathHelper(urlPathHelper);
    }
}

answered Jul 23 '18 at 12:45

Alexander Polozov

413
3
10

I have similar problem with % character, i am getting 500 response. https://APPLIANCE_IP/rest/certificates/https/remote/fe80:0:0:0:250:56ff:fe9a:617a%eth0 . – Chandan Ghosh Jul 24 '18 at 05:59

Getting 500 response in Spring 5 when url contains semicolon

3 Answers3

Linked