Skip to content

UT005023: Exception handling request to /instances/%5Bobject%20Object%5D/actuator/metrics #1517

New issue
New issue
Closed
Closed
UT005023: Exception handling request to /instances/%5Bobject%20Object%5D/actuator/metrics#1517
Labels
bugnacoswaiting-for-triage
@magicsgxie

Description

@magicsgxie
magicsgxie
opened on Sep 21, 2020

UT005023: Exception handling request to /instances/%5Bobject%20Object%5D/actuator/metrics

org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String "%"
at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:374)
at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:336)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:194)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:103)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:93)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:103)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:269)
at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:78)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:133)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:130)
at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:249)
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchToPath(ServletInitialHandler.java:186)
at io.undertow.servlet.spec.AsyncContextImpl$2$1.handleRequest(AsyncContextImpl.java:201)
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:370)
at io.undertow.servlet.spec.AsyncContextImpl$2.run(AsyncContextImpl.java:195)
at io.undertow.servlet.spec.AsyncContextImpl$6.run(AsyncContextImpl.java:472)
at io.undertow.servlet.spec.AsyncContextImpl$TaskDispatchRunnable.run(AsyncContextImpl.java:591)
at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:2019)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1558)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1423)
at java.base/java.lang.Thread.run(Thread.java:830)

Activity

magicsgxie
added
bug
waiting-for-triage
on Sep 21, 2020
magicsgxie

magicsgxie commented on Sep 21, 2020

@magicsgxie
magicsgxie
on Sep 21, 2020
Author

@configuration
public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
private final String adminContextPath;

public WebSecurityConfigurer(AdminServerProperties adminServerProperties) {
	this.adminContextPath = adminServerProperties.getContextPath();
}

@Override
@SneakyThrows
protected void configure(HttpSecurity http) {
	// @formatter:off
	SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
	successHandler.setTargetUrlParameter("redirectTo");
	successHandler.setDefaultTargetUrl(adminContextPath + "/");

	http
		.headers().frameOptions().disable()
		.and().authorizeRequests()
		.antMatchers(adminContextPath + "/assets/**"
			, adminContextPath + "/login"
			, adminContextPath + "/actuator/**"
			, adminContextPath + "/redis/info"
		).permitAll()
		.anyRequest().authenticated()
		.and()
		.formLogin().loginPage(adminContextPath + "/login")
		.successHandler(successHandler).and()
		.logout().logoutUrl(adminContextPath + "/logout")
		.and()
		.httpBasic().and()
		.csrf()
		.disable();
	// @formatter:on
}

// @bean
// public HttpFirewall allowUrlEncodedSlashHttpFirewall() {
// StrictHttpFirewall firewall = new StrictHttpFirewall();
// //此处可添加别的规则,目前只设置 允许双 %
// firewall.setAllowUrlEncodedPercent(true);
// return firewall;
// }
}

@EnableAdminServer
@SpringCloudApplication
public class CatMonitorApplication {

public static void main(String[] args) {
	SpringApplication.run(CatMonitorApplication.class, args);
}

}

no any other code

magicsgxie

magicsgxie commented on Sep 21, 2020

@magicsgxie
magicsgxie
on Sep 21, 2020
Author

register center is nacos

magicsgxie

magicsgxie commented on Sep 21, 2020

@magicsgxie
magicsgxie
on Sep 21, 2020
Author


image

magicsgxie

magicsgxie commented on Sep 21, 2020

@magicsgxie
magicsgxie
on Sep 21, 2020
Author


image

magicsgxie

magicsgxie commented on Sep 21, 2020

@magicsgxie
magicsgxie
on Sep 21, 2020 · edited by magicsgxie
Author

Why? Can you help me ? the spring boot admin version is 2.3.0

joshiste

joshiste commented on Sep 21, 2020

@joshiste
joshiste
on Sep 21, 2020
Collaborator

we depend on the default jackson configuration. It looks like that you are have some custom configuration (the ApplicationId is serialized incorrect)

joshiste
closed this as completedon Sep 21, 2020
magicsgxie

magicsgxie commented on Sep 23, 2020

@magicsgxie
magicsgxie
on Sep 23, 2020
Author

@joshiste how can we configuration ?can you help me ? thanks

daokuang

daokuang commented on Dec 3, 2020

@daokuang
daokuang
on Dec 3, 2020

I have the same problem. Have you solved it.

weiwill

weiwill commented on Jan 2, 2021

@weiwill
weiwill
on Jan 2, 2021

Add the following code to your custom Jackson configuration

mapper.addMixIn(InstanceId::class.java, InstanceIdMixin::class.java)
mapper.registerModule(AdminServerModule(arrayOf(".*password$")))
Hccake

Hccake commented on Mar 9, 2021

@Hccake
Hccake
on Mar 9, 2021 · edited by Hccake

Add the following code to your custom Jackson configuration

mapper.addMixIn(InstanceId::class.java, InstanceIdMixin::class.java)
mapper.registerModule(AdminServerModule(arrayOf(".*password$")))

Thanks. That helped me

objectMapper.addMixIn(InstanceId.class, InstanceIdMixin.class);
objectMapper.registerModule(new AdminServerModule(new String[]{".*password$"}));

The first few minutes the service started up were normal, and then it reported an error：

UT005023: Exception handling request to /instances/xxxx/actuator/metrics/process.cpu.usage

SteKoe
added
nacos
on Apr 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugnacoswaiting-for-triage

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

      Development

      No branches or pull requests

        Participants

        @SteKoe@weiwill@daokuang@joshiste@magicsgxie

        Issue actions
          UT005023: Exception handling request to /instances/%5Bobject%20Object%5D/actuator/metrics · Issue #1517 · codecentric/spring-boot-admin