[SHIRO-682] fix the potential threat when use "uri = uri + '/' " to bypassed shiro protect

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Resolved
• Affects Version/s: 1.3.2
• Fix Version/s: 1.5.0
• Component/s: Web
• Labels: security
• Assignee: Francois Papon
• Reporter: tomsun28
• Created: 25/Mar/19 16:49
• Updated: 07/Feb/20 16:00
• Resolved: 20/Nov/19 14:02

Description

hi, the potential threat found when use shiro filter.
in spring web, the requestURI : /resource/menus and resource/menus/ both can access the resource,
but the pathPattern match /resource/menus can not match resource/menus/
user can use requestURI + "/" to simply bypassed chain filter, to bypassed shiro protect

[PR #127|https://github.com/apache/shiro/pull/127]

Issue Links

• is related to: KNOX-2221 Upgrade shiro to 1.5.3
• links to: GitHub Pull Request #127
• links to: GitHub Pull Request #181