Java / Spring-保护参数（Pathvariable）

Question

Is there a common way to secure a pathvariable?

@RequestMapping("/image/{id}")
public String getArticleImageUrl(@PathVariable String id) {

....

I mean remove unusual content eg javascript or other security issue related things to prevent "hacking" or abusive use?

Answer 1

What is secure depends on what you want to use the input for. Bottom line: You should take the same care with these kinds of parameters as any other parameter you would accept from the outside into the system, eg:

• Take appropriate action to prevent SQL injection (ie PreparedStatements)
• Take care when rendering stuff on your web site that was received as user input (ie make sure to HTML encode stuff - most frameworks would take care of this for you).
• etc.

"Washing" the input from unwanted characters is possible but, as always: tricky and depending on what the data will be used for.

Answer 2

Nvm. I used a regex to check if this String is alphanumeric. ( ^[\\\\pL\\\\pN]+$ ) Should be enough.