|
|
|
|
@@ -9130,13 +9130,14 @@ The following table lists features provided by the `BeanFactory` and
|
|
|
|
|
| Yes
|
|
|
|
|
|===
|
|
|
|
|
|
|
|
|
|
To explicitly register a bean post-processor with a `BeanFactory` implementation, you
|
|
|
|
|
must write code like this:
|
|
|
|
|
To explicitly register a bean post-processor with a `BeanFactory` implementation,
|
|
|
|
|
you need to write code like this:
|
|
|
|
|
|
|
|
|
|
[source,java,indent=0]
|
|
|
|
|
[subs="verbatim,quotes"]
|
|
|
|
|
----
|
|
|
|
|
ConfigurableBeanFactory factory = new XmlBeanFactory(...);
|
|
|
|
|
DefaultListableBeanFactory factory = new DefaultListableBeanFactory();
|
|
|
|
|
// populate the factory with bean definitions
|
|
|
|
|
|
|
|
|
|
// now register any needed BeanPostProcessor instances
|
|
|
|
|
MyBeanPostProcessor postProcessor = new MyBeanPostProcessor();
|
|
|
|
|
@@ -9151,7 +9152,9 @@ implementation, you must write code like this:
|
|
|
|
|
[source,java,indent=0]
|
|
|
|
|
[subs="verbatim,quotes"]
|
|
|
|
|
----
|
|
|
|
|
XmlBeanFactory factory = new XmlBeanFactory(new FileSystemResource("beans.xml"));
|
|
|
|
|
DefaultListableBeanFactory factory = new DefaultListableBeanFactory();
|
|
|
|
|
XmlBeanDefinitionReader reader = new XmlBeanDefinitionReader(factory);
|
|
|
|
|
reader.loadBeanDefinitions(new FileSystemResource("beans.xml"));
|
|
|
|
|
|
|
|
|
|
// bring in some property values from a Properties file
|
|
|
|
|
PropertyPlaceholderConfigurer cfg = new PropertyPlaceholderConfigurer();
|
|
|
|
|
@@ -30677,7 +30680,7 @@ also <<mvc-config-content-negotiation>> for content negotiation configuration.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[[mvc-ann-requestmapping-rfd]]
|
|
|
|
|
==== Suffix Suffix Pattern Matching and RFD
|
|
|
|
|
==== Suffix Pattern Matching and RFD
|
|
|
|
|
|
|
|
|
|
Reflected file download (RFD) attack was first described in a
|
|
|
|
|
https://www.trustwave.com/Resources/SpiderLabs-Blog/Reflected-File-Download---A-New-Web-Attack-Vector/[paper by Trustwave]
|
|
|
|
|
@@ -30717,7 +30720,7 @@ Below are additional recommendations from the report:
|
|
|
|
|
For an example of how to do that with Spring see https://github.com/rwinch/spring-jackson-owasp[spring-jackson-owasp].
|
|
|
|
|
* Configure suffix pattern matching to be turned off or restricted to explicitly
|
|
|
|
|
registered suffixes only.
|
|
|
|
|
* Configure content negotiation with the properties “useJaf” and “ignoreUknownPathExtension”
|
|
|
|
|
* Configure content negotiation with the properties "useJaf" and "ignoreUnknownPathExtensions"
|
|
|
|
|
set to false which would result in a 406 response for URLs with unknown extensions.
|
|
|
|
|
Note however that this may not be an option if URLs are naturally expected to have
|
|
|
|
|
a dot towards the end.
|
|
|
|
|
@@ -47560,13 +47563,13 @@ default). Here you can see what methods are available for `Trigger` implementati
|
|
|
|
|
|
|
|
|
|
Spring provides two implementations of the `Trigger` interface. The most interesting one
|
|
|
|
|
is the `CronTrigger`. It enables the scheduling of tasks based on cron expressions. For
|
|
|
|
|
example the following task is being scheduled to run 15 minutes past each hour but only
|
|
|
|
|
example, the following task is being scheduled to run 15 minutes past each hour but only
|
|
|
|
|
during the 9-to-5 "business hours" on weekdays.
|
|
|
|
|
|
|
|
|
|
[source,java,indent=0]
|
|
|
|
|
[subs="verbatim"]
|
|
|
|
|
----
|
|
|
|
|
scheduler.schedule(task, new CronTrigger("* 15 9-17 * * MON-FRI"));
|
|
|
|
|
scheduler.schedule(task, new CronTrigger("0 15 9-17 * * MON-FRI"));
|
|
|
|
|
----
|
|
|
|
|
|
|
|
|
|
The other out-of-the-box implementation is a `PeriodicTrigger` that accepts a fixed
|
|
|
|
|
@@ -47578,7 +47581,7 @@ fixed-delay, those methods should be used directly whenever possible. The value
|
|
|
|
|
the `Trigger` abstraction. For example, it may be convenient to allow periodic triggers,
|
|
|
|
|
cron-based triggers, and even custom trigger implementations to be used interchangeably.
|
|
|
|
|
Such a component could take advantage of dependency injection so that such `Triggers`
|
|
|
|
|
could be configured externally.
|
|
|
|
|
could be configured externally and therefore easily modified or extended.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|