UrlEncodedSlash blocked by HttpFirewall (Grails 3.3.0.RC1; Spring-security-core 3.2.0.M1)

Viewed 726

I find this errors in my logs:

org.springframework.security.web.firewall.RequestRejectedException: The requestURI cannot contain encoded slash. Got /;lm=1488887514;m=js;asset=delayedElements%2Fsnippet;tf;ucm=353df4434086482d9d1d7b89758e156e/
        at org.springframework.security.web.firewall.DefaultHttpFirewall.getFirewalledRequest(DefaultHttpFirewall.java:56)
        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:193)
        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.grails.web.servlet.mvc.GrailsWebRequestFilter.doFilterInternal(GrailsWebRequestFilter.java:77)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
...

And I found this solution which probably works in Spring Boot. Spring security DefaultHttpFirewall - The requestURI cannot contain encoded slash

Can I, and how, apply this in Grails? Thanks a lot in advance!

EDIT 1:

This is how I implemented the suggestion by Sudhir:

Here I created the new class:

Here I created the new class:

This is how the implementation looks like:

package fnx.security;

import org.springframework.security.web.firewall.DefaultHttpFirewall;

public class CustomHttpFirewall extends DefaultHttpFirewall {
    CustomHttpFirewall() {
        boolean allowUrlEncodedSlash = true;
    }
}

And this is how it is included in application.yml:

 grails:
     plugin:
        springsecurity:
            httpFirewallBeanClass: 'fnx.security.CustomHttpFirewall'

Anything missing or wrong?

1 Answers
Related