Spring4Shell: Security Analysis of the latest Java RCE '0-day' vulnerabilities in Spring | LunaTrace

Getting Spring to load BinderControllerAdvice may require manual steps to have it load. We'll update this guide with more details about how to do that soon. import org.springframework.core.Ordered; import org.springframework.core.annotation.Order; import org.springframework.web.bind.WebDataBinder; import org.springframework.web.bind.annotation.ControllerAdvice; import org.springframework.web.bind.

[turanukimaru]

クエリパラメータにクラスのフルパスが入ってると不味いから取り敢えずバインド前にフィルタしろ、という話か。Advice書くの久しぶりだな…