c0de8ug / javaee-tutorial Goto Github PK
View Code? Open in Web Editor NEWMaven + Mysql + Shiro + SpringMVC + Spring
javaee-tutorial's People
Contributors
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
Stargazers
Watchers
Forkers
muscledrinkbeer jetero libin072532 crystals10 tralikt iyuanzz beijixinghehe smith5379 zhaoxlliuf qqwrwwv aassdd113355 ningye112 shaojay xiongyilun jessezzyy benjaminqs eatonlin keatsandworld zchi2018 darren4ten codingzhouk forallbright newcodor neverland068 fgg159357 wangxianchao2021 oookko fanfusuzi linclonchen aizyz czhyf jjdxzm yfan97 liujie-alanwalker xgray1998 ulysses1881826 cnwh3t choubeyond xialingfei siyulv bienhcunshan ganxinming czk715 jeffreyingd soyeonqwq pittdeng rikoui syunti lambertcsy lixiangjie01 losenames robatter zerojiang blacksheepaa aaronwanng smallonesama weitag wenyang0908 lpynewb1e zjyiersan zhuyunpeng1 wangbing518 hhy5277 tr941012 kevinyzy yuvarajr-dev xiaolong0813 shilogo newdeshang ldjiang yangthirteen 2012289350 endinghappy leungjiang lty1994 xiaoyuting2010 z405281317 uncleyu1997 kei299 git1e uaning zhangyongfeng13 ataraxiazz wendyfyr guoooozy liuss8080 mohuancaizi naa5 summerunfair runzhicao lizhonggang1984 chrislalala hzxslzb kind1ess sue4396 kjj208 dengshuibing zdaxiong nnp-web jzou01javaee-tutorial's Issues
Dependency org.apache.shiro:shiro-web, leading to CVE problem
Hi, In javaee-tutorial，there is a dependency org.apache.shiro:shiro-web:1.2.4 that calls the risk method.
The scope of this CVE affected version is [,1.5.3)
After further analysis, in this project, the main Api called is <org.apache.shiro.web.util.WebUtils: java.lang.String getPathWithinApplication(javax.servlet.http.HttpServletRequest)>
Risk method repair link : GitHub
CVE Bug Invocation Path--
Path Length : 3
<org.apache.shiro.web.util.WebUtils: java.lang.String getPathWithinApplication(javax.servlet.http.HttpServletRequest)>
at <com.giit.www.filter.FormLoginFilter: boolean isLoginRequest(javax.servlet.http.HttpServletRequest)> (com.giit.www.filter.FormLoginFilter.java:[60]) in /detect/unzip/javaee-tutorial-master/target/classes
at <com.giit.www.filter.FormLoginFilter: boolean onPreHandle(javax.servlet.ServletRequest,javax.servlet.ServletResponse,java.lang.Object)> (com.giit.www.filter.FormLoginFilter.java:[26]) in /detect/unzip/javaee-tutorial-master/target/classes
Dependency tree--
[INFO] core:com.giit.www.orderbook:war:1.0-SNAPSHOT
[INFO] +- org.hamcrest:hamcrest-core:jar:1.3:compile
[INFO] +- org.apache.shiro:shiro-core:jar:1.4.2:compile
[INFO] | +- org.apache.shiro:shiro-lang:jar:1.4.2:compile
[INFO] | +- org.apache.shiro:shiro-cache:jar:1.4.2:compile
[INFO] | +- org.apache.shiro:shiro-crypto-hash:jar:1.4.2:compile
[INFO] | | \- org.apache.shiro:shiro-crypto-core:jar:1.4.2:compile
[INFO] | +- org.apache.shiro:shiro-crypto-cipher:jar:1.4.2:compile
[INFO] | +- org.apache.shiro:shiro-config-core:jar:1.4.2:compile
[INFO] | +- org.apache.shiro:shiro-config-ogdl:jar:1.4.2:compile
[INFO] | | \- commons-beanutils:commons-beanutils:jar:1.9.3:compile
[INFO] | | \- commons-collections:commons-collections:jar:3.2.2:compile
[INFO] | \- org.apache.shiro:shiro-event:jar:1.4.2:compile
[INFO] +- org.apache.shiro:shiro-web:jar:1.2.4:compile
[INFO] +- org.apache.shiro:shiro-quartz:jar:1.2.4:compile
[INFO] | \- org.opensymphony.quartz:quartz:jar:1.6.1:compile
[INFO] +- org.apache.shiro:shiro-spring:jar:1.2.4:compile
[INFO] +- org.apache.shiro:shiro-aspectj:jar:1.2.4:compile
[INFO] +- mysql:mysql-connector-java:jar:5.1.38:compile
[INFO] +- org.aspectj:aspectjrt:jar:1.8.8:compile
[INFO] +- org.aspectj:aspectjweaver:jar:1.8.8:compile
[INFO] | \- org.springframework:spring-core:jar:4.2.4.RELEASE:compile
[INFO] +- org.springframework:spring-context-support:jar:4.2.4.RELEASE:compile
[INFO] | +- org.springframework:spring-beans:jar:4.2.4.RELEASE:compile
[INFO] | \- org.springframework:spring-context:jar:4.2.4.RELEASE:compile
[INFO] | \- org.springframework:spring-aop:jar:4.2.4.RELEASE:compile
[INFO] | \- aopalliance:aopalliance:jar:1.0:compile
[INFO] +- org.springframework:spring-jdbc:jar:4.2.4.RELEASE:compile
[INFO] +- org.springframework:spring-tx:jar:4.2.4.RELEASE:compile
[INFO] +- org.springframework:spring-webmvc:jar:4.2.4.RELEASE:compile
[INFO] | +- org.springframework:spring-expression:jar:4.2.4.RELEASE:compile
[INFO] | \- org.springframework:spring-web:jar:4.2.4.RELEASE:compile
[INFO] +- javax.servlet:javax.servlet-api:jar:3.0.1:provided
[INFO] +- javax.servlet.jsp:jsp-api:jar:2.2:compile
[INFO] +- javax.servlet:jstl:jar:1.2:compile
[INFO] +- org.mybatis:mybatis-spring:jar:1.2.4:compile
[INFO] +- org.mybatis:mybatis:jar:3.3.1:compile
[INFO] +- cglib:cglib:jar:3.2.0:compile
[INFO] | +- org.ow2.asm:asm:jar:5.0.3:compile
[INFO] | \- org.apache.ant:ant:jar:1.9.4:compile
[INFO] | \- org.apache.ant:ant-launcher:jar:1.9.4:compile
[INFO] +- commons-logging:commons-logging:jar:1.2:compile
[INFO] +- org.slf4j:slf4j-api:jar:1.7.14:compile
[INFO] +- log4j:log4j:jar:1.2.17:compile
[INFO] +- org.apache.logging.log4j:log4j-core:jar:2.3:compile
[INFO] | \- org.apache.logging.log4j:log4j-api:jar:2.3:compile
[INFO] +- org.slf4j:slf4j-log4j12:jar:1.7.14:compile
[INFO] +- ognl:ognl:jar:3.1.2:compile
[INFO] | \- javassist:javassist:jar:3.11.0.GA:compile
[INFO] +- org.javassist:javassist:jar:3.20.0-GA:compile
[INFO] +- org.apache.commons:commons-pool2:jar:2.3:compile
[INFO] +- org.apache.commons:commons-dbcp2:jar:2.1:compile
[INFO] +- com.google.code.gson:gson:jar:2.6:compile
[INFO] \- commons-fileupload:commons-fileupload:jar:1.3.3:compile
[INFO] \- commons-io:commons-io:jar:2.2:compile
Suggested solutions:
Update dependency version
Thank you very much.
登录之后是空白界面？
shiro你是怎么认证的？
关于get中文乱码问题
可否在readme.md里面添加一个关于GET方法中文乱码的说明。如：遇到get方式请求包含中文导致乱码的问题，请在Tomcat的server.xml中做如下修改：
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443"
URIEncoding="UTF-8" />
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.