spring mvc 参数绑定漏洞_JAVA

您所在的位置：程序员俱乐部 > 编程开发 > JAVA > spring mvc 参数绑定漏洞

2011/1/7 8:29:43 yfm049 http://yfm049.javaeye.com 我要评论(0)

摘要：spring参数绑定漏洞packagecom.aehr.action;importorg.springframework.stereotype.Controller;importorg.springframework.web.bind.annotation.RequestMapping;importorg.springframework.web.servlet.ModelAndView;importcom.aehr.pojo.binfo;importcom.aehr.pojo.sinfo
标签：MVC Spring 漏洞

spring 参数绑定漏洞

package com.aehr.action;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.servlet.ModelAndView;
import com.aehr.pojo.binfo;
import com.aehr.pojo.sinfo;
@Controller
public class ClinicController {
?@RequestMapping("/vets")
??? public ModelAndView welcomeHandler(binfo binfo,sinfo sinfo,ModelAndView mv) {
??mv.addObject("aa", "adfasdf");
??System.out.println(binfo.getId());
??System.out.println(sinfo.getId());
??System.out.println(mv);
??mv.setViewName("index.jsp");
??return mv;
??? }
}
package com.aehr.pojo;
public class binfo {
?private int id;
?public int getId() {
??return id;
?}
?public void setId(int id) {
??this.id = id;
?}
?
}

package com.aehr.pojo;
public class sinfo {
?private int id;
?public int getId() {
??return id;
?}
?public void setId(int id) {
??this.id = id;
?}
}
当用url------http://localhost:8080/smvc/vets.action?id=123123访问的时候id赋值给binfo和sinfo