3

I find this errors in my logs: 

org.springframework.security.web.firewall.RequestRejectedException: The requestURI cannot contain encoded slash. Got /;lm=1488887514;m=js;asset=delayedElements%2Fsnippet;tf;ucm=353df4434086482d9d1d7b89758e156e/
        at org.springframework.security.web.firewall.DefaultHttpFirewall.getFirewalledRequest(DefaultHttpFirewall.java:56)
        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:193)
        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.grails.web.servlet.mvc.GrailsWebRequestFilter.doFilterInternal(GrailsWebRequestFilter.java:77)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
...

And I found this solution which probably works in Spring Boot. Spring security DefaultHttpFirewall - The requestURI cannot contain encoded slash

Can I, and how, apply this in Grails? Thanks a lot in advance!

EDIT 1:

This is how I implemented the suggestion by Sudhir:

Here I created the new class:

Here I created the new class:

This is how the implementation looks like:

package fnx.security;

import org.springframework.security.web.firewall.DefaultHttpFirewall;

public class CustomHttpFirewall extends DefaultHttpFirewall {
    CustomHttpFirewall() {
        boolean allowUrlEncodedSlash = true;
    }
}

And this is how it is included in application.yml:

 grails:
     plugin:
        springsecurity:
            httpFirewallBeanClass: 'fnx.security.CustomHttpFirewall'

Anything missing or wrong?

Kloker
  • 499
  • 4
  • 14
  • Did u try debugging it in debugger to make sure ur custom firewall is used and allowUrlEncodedSlash is true ? – Sudhir N Jul 20 '17 at 14:13
  • I tried, but I don't know where to set the breakpoint and where to see if the CustomHttpFirewall is used. – Kloker Jul 21 '17 at 06:47
  • If I set a breakpoint in CustomHttpFirewall class, it at least doesn't stop there. – Kloker Jul 21 '17 at 06:57
  • That mean your custom class is not being used. put break point in SpringSecurityCoreGrailsPlugin's doWithSpring -- https://github.com/grails-plugins/grails-spring-security-core/blob/master/src/main/groovy/grails/plugin/springsecurity/SpringSecurityCoreGrailsPlugin.groovy#L919 – Sudhir N Jul 21 '17 at 09:08
  • I was finally able to make the class called. The breakpoint now triggers every time I deploy the war file (or run the project) during the spring security configuration. However, the error log still shows the same errors... – Kloker Jul 25 '17 at 12:42
  • Oh, i am out of suggestions now, i have to try to reproduce the issue locally and thn investigate the fix – Sudhir N Jul 25 '17 at 13:41
  • wait, @kloker dont do boolean allowUrlEncodedSlash = true; but just = allowUrlEncodedSlash = true; remove the boolean, you dont want to define a local variable, u want to set the variable value which is defined in parent class.. see my example doesnt have the local variable declared – Sudhir N Jul 25 '17 at 13:42
  • I had it first without the "boolean" but the project then fails to compile... – Kloker Jul 25 '17 at 14:24
  • What error do u get ? -- it should compile just fine.. – Sudhir N Jul 25 '17 at 14:42

1 Answers1

3

By default spring security core plugin uses DefaultHttpFirewall you can create a subclass by extending DefaultHttpFirewall and set the property allowUrlEncodedSlash to true from constructor.

 CustomHttpFirewall extends DefaultHttpFirewall {
   CustomHttpFirewall() {
     allowUrlEncodedSlash = true
   }
}

And then configure spring security to use your custom firewall class as below.

grails.plugin.springsecurity.httpFirewallBeanClass = "full name of your class"

Note tested, but this should work.

Sudhir N
  • 4,008
  • 1
  • 22
  • 32
  • Sounds reasonable and I was able to implement it. I will award the bounty as soon as I was able to prove the solution in the productive environment, as the error only occurs there. Thanks a lot in advance! – Kloker Jul 19 '17 at 10:00
  • Hi Sudhir, I edited the question with a description of how I implemented your suggestion. Is there something missing? – Kloker Jul 20 '17 at 13:38
  • Hi Sundhir, though I was not able to test your last comment in productive environment, I awarded you the bounty. If I can validate that the solution works, I will also accept the answer later. Anyway, thanks a lot in advance! – Kloker Jul 26 '17 at 06:57
  • No worries, comment if you still cant get it to work – Sudhir N Jul 26 '17 at 07:58