官方给出的描述是Spring框架中报告了一个与静态资源处理相关的目录遍历漏洞。某些URL在使用前未正确加密，使得攻击者能够获取文件系统上的任何文件，这些文件也可用于运行SpringWeb应用程序的进程。

受影响的版本:
Spring Framework 3.0.4 to 3.2.11
Spring Framework 4.0.0 to 4.0.7
Spring Framework 4.1.0 to 4.1.1
其他不受支持的版本也可能受到影响

影响：
攻击者可以访问存储在静态资源位置之外的文件。

解决方案：
受影响的Spring版本的用户应升级到最新版本：
Users of 3.2.x should upgrade to 3.2.12 or later
Users of 4.0.x should upgrade to 4.0.8 or later
Users of 4.1.x should upgrade to 4.1.2 or later

问题：
我的spring版本升级到5.0.2之后，在低版本的扫描工具中并没有扫出问题，问题解决，但是用高版本的扫描工具依然存在这个问题，这个时候需要将spring版本再升级到最新版本，这里我使用的5.2.5：

<properties>

<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

<springversion>5.2.5.RELEASE</springversion>

</properties>

<dependencies>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-aop</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-aspects</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-beans</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-context</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-context-support</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-core</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-expression</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-jdbc</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-jms</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-orm</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-oxm</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-tx</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-web</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-webmvc</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-test</artifactId>

<version>${springversion}</version>

<type>jar</type>

<scope>compile</scope>

</dependency>

<dependencies>

这个时候你的spring配置文件中配置了AnnotationMethodHandlerAdapter就会报错，因为新版本已经不再支持AnnotationMethodHandlerAdapter：

<bean class="org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter">

<property name="messageConverters">

<list>

<ref bean="jsonHttpMessageConverter"/>

</list>

</property>

</bean>

这个时候需要改成以下这样：

<bean class="org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter">

<property name="messageConverters">

<list>

<ref bean="jsonHttpMessageConverter"/>

</list>

</property>

</bean>

问题解决，还有一种，如果你引入了Jackson，版本太低也会报错，我使用的2.1.0：

[WARN ][2020-04-24 17:08:00] org.springframework.web.context.support.XmlWebApplicationContext Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter': Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter]: Constructor threw exception; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.ObjectMapper.registerModules(Ljava/lang/Iterable;)Lcom/fasterxml/jackson/databind/ObjectMapper;

[ERROR][2020-04-24 17:08:00] org.springframework.web.servlet.DispatcherServlet Context initialization failed

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter': Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter]: Constructor threw exception; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.ObjectMapper.registerModules(Ljava/lang/Iterable;)Lcom/fasterxml/jackson/databind/ObjectMapper;

at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1320)

at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1214)

at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:557)

at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:517)

at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:323)

at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)

at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:321)

at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)

at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:882)

at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:878)

at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:550)

at org.springframework.web.servlet.FrameworkServlet.configureAndRefreshWebApplicationContext(FrameworkServlet.java:702)

at org.springframework.web.servlet.FrameworkServlet.createWebApplicationContext(FrameworkServlet.java:668)

at org.springframework.web.servlet.FrameworkServlet.createWebApplicationContext(FrameworkServlet.java:716)

at org.springframework.web.servlet.FrameworkServlet.initWebApplicationContext(FrameworkServlet.java:591)

at org.springframework.web.servlet.FrameworkServlet.initServletBean(FrameworkServlet.java:530)

at org.springframework.web.servlet.HttpServletBean.init(HttpServletBean.java:170)

at javax.servlet.GenericServlet.init(GenericServlet.java:158)

at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1241)

at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1154)

at org.apache.catalina.core.StandardWrapper.allocate(StandardWrapper.java:827)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:135)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)

at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:503)

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:136)

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)

at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:610)

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:526)

at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1078)

at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:655)

at org.apache.coyote.http11.Http11AprProtocol$Http11ConnectionHandler.process(Http11AprProtocol.java:277)

at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2381)

at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2370)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)

at java.lang.Thread.run(Thread.java:745)

Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter]: Constructor threw exception; nested exception is java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.ObjectMapper.registerModules(Ljava/lang/Iterable;)Lcom/fasterxml/jackson/databind/ObjectMapper;

at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:217)

at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:87)

at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1312)

... 37 more

Caused by: java.lang.NoSuchMethodError: com.fasterxml.jackson.databind.ObjectMapper.registerModules(Ljava/lang/Iterable;)Lcom/fasterxml/jackson/databind/ObjectMapper;

at org.springframework.http.converter.json.Jackson2ObjectMapperBuilder.configure(Jackson2ObjectMapperBuilder.java:684)

at org.springframework.http.converter.json.Jackson2ObjectMapperBuilder.build(Jackson2ObjectMapperBuilder.java:652)

at org.springframework.http.converter.json.MappingJackson2HttpMessageConverter.<init>(MappingJackson2HttpMessageConverter.java:59)

at org.springframework.http.converter.support.AllEncompassingFormHttpMessageConverter.<init>(AllEncompassingFormHttpMessageConverter.java:76)

at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.<init>(RequestMappingHandlerAdapter.java:205)

at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)

at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)

at java.lang.reflect.Constructor.newInstance(Constructor.java:423)

at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:204)

... 39 more

我是把Jackson升级到2.9.9,运行成功:

<dependency>

<groupId>com.fasterxml.jackson.core</groupId>

<artifactId>jackson-core</artifactId>

<version>2.9.9</version>

</dependency>

<dependency>

<groupId>com.fasterxml.jackson.core</groupId>

<artifactId>jackson-databind</artifactId>

<version>2.9.9</version>

</dependency>

<dependency>

<groupId>com.fasterxml.jackson.core</groupId>

<artifactId>jackson-annotations</artifactId>

<version>2.9.9</version>

</dependency>

希望有所帮助。

最新文章

  1. Oracle执行计划详解
  2. LInux 查看环境变量
  3. jquery模拟LCD 时钟
  4. MongoDB安装与启动
  5. Git版本控制工具（三）----远程仓库GitHub的使用
  6. jQuery Mobile_页面事件
  7. 【转】一个windows线程池实现
  8. 【Bean】 这才是bean，一直没仔细看
  9. Android设置定时执行执行一次任务
  10. js 对于回车时间的监听，提交表单
  11. julia 安装
  12. java-14习题
  13. 如何备份和恢复你的TFS服务器（一）
  14. 不偏移的天地图地图服务-ArcGIS版
  15. kafka的log存储解析——topic的分区partition分段segment以及索引等(转发)
  16. 区块链公链分片技术(sharding)方案，配思维导图
  17. oj练习
  18. python实现排序算法三：插入排序
  19. nginx官方文档 之 http负载均衡 学习笔记
  20. 常用的C#编译命令

热门文章

  1. java数据库 DBHelper
  2. B 雷诺与奴隶主
  3. C/C++知识总结 五 复合数据类型 壹（数组、字符串与string、结构）
  4. 1025 PAT Ranking (25 分)
  5. 在scratch中怎样编写抓蝴蝶游戏
  6. go 名词备注
  7. Tomcat5启动流程与配置详解
  8. hexo部署在码云中 无样式问题
  9. GeoGebra重复手段实现
  10. string 中的getline