Path with "WEB-INF" or "META-INF": [WEB-INF/add.html]

[weixin_38050602]

用Spring boot 的WEB-INF 目录彻底不能访问了?我转发到WEB-INF直接提示：Path with "WEB-INF" or "META-INF": [WEB-INF/add.html]；引用的包是Spring-webmvc-5.1.3.RELEASE.jar 



这个是ResourceHttpRequestHandler 的源码... WEB-INF今后直接不让放东西了？

[weixin_38061494]

今天也遇到这个问题，看了下源码，是spring-webmvc中对resource路径解析做了限制 boolean  org. springframework. web. servlet. resource. ResourceHttpRequestHandler.isInvalidPath( Stringpath)   Identifies invalid resource paths. By default rejects: Paths that contain "WEB-INF" or "META-INF" Paths that contain "../" after a call to org.springframework.util.StringUtils.cleanPath. Paths that represent a valid URL or would represent one after the leading slash is removed. Note: this method assumes that leading, duplicate '/' or control characters (e.g. white space) have been trimmed so that the path starts predictably with a single '/' or does not have one. Parameters: path the path to validate Returns: true if the path is invalid, false otherwise Since: 3.0.6 path = processPath(path);
if (!StringUtils.hasText(path) || isInvalidPath(path)) {
return null;
}  

[weixin_38074560]

引用来自“仪山湖”的评论 今天也遇到这个问题，看了下源码，是spring-webmvc中对resource路径解析做了限制 boolean  org. springframework. web. servlet. resource. ResourceHttpRequestHandler.isInvalidPath( Stringpath)   Identifies invalid resource paths. By default rejects: Paths that contain "WEB-INF" or "META-INF" Paths that contain "../" after a call to org.springframework.util.StringUtils.cleanPath. Paths that represent a valid URL or would represent one after the leading slash is removed. Note: this method assumes that leading, duplicate '/' or control characters (e.g. white space) have been trimmed so that the path starts predictably with a single '/' or does not have one. Parameters: path the path to validate Returns: true if the path is invalid, false otherwise Since: 3.0.6 path = processPath(path);
if (!StringUtils.hasText(path) || isInvalidPath(path)) {
return null;
}   我也追到这里了~~不过想想，非要执着着丢进WEB-INF里一个.html也是醉了，换jsp格式就好了

[weixin_38089340]

jsp之所以不会被拦截，原因可能是因为.jsp的路径是被jsp解析器拦截了，jsp解析器应该是servlet级别的...所以不会进入到spring中去吧。。。所以.jsp才不受影响(还没去追过源码，但应该是这样子的:)