springboot 1.x 2.x tomcat支持特殊字符，URL中有{}[]等报400

朱雀 2021-11-22 10:54 266阅读 0赞

# springboot 1.x 2.x tomcat支持特殊字符 #

### 文章目录 ###

*  springboot 1.x 2.x tomcat支持特殊字符
 *   *  现象
     *  解决方案
     *   *  sprintboot 1.x(1.5.21测试有效)
         *  springboot 2.x(2.1.3测试有效)
     *  总结
     *  后续

## 现象 ##

正常访问一个get请求，页面返回400：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0NMX1lE_size_16_color_FFFFFF_t_70]  
后台日志报错：

2018-08-09 21:39:28.915  INFO 6750 --- [nio-8080-exec-1] o.apache.coyote.http11.Http11Processor   : Error parsing HTTP request header
     Note: further occurrences of HTTP header parsing errors will be logged at DEBUG level.
    
    java.lang.IllegalArgumentException: Invalid character found in the request target. The valid characters are defined in RFC 7230 and RFC 3986
        at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:479) ~[tomcat-embed-core-8.5.32.jar:8.5.32]
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:684) ~[tomcat-embed-core-8.5.32.jar:8.5.32]
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.32.jar:8.5.32]
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:800) [tomcat-embed-core-8.5.32.jar:8.5.32]
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1471) [tomcat-embed-core-8.5.32.jar:8.5.32]
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.32.jar:8.5.32]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_111]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_111]
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.32.jar:8.5.32]
        at java.lang.Thread.run(Thread.java:745) [na:1.8.0_111]

稍微百度一下就可以知道这是URL中有特殊字符，新版本的Tomcat严格按照`RFC 3986`规范进行访问解析，而 `RFC 3986`规范规定Url中只允许包含英文字母（a-zA-Z）、数字（0-9）、-\_.~4个特殊字符以及所有保留字符(RFC3986/7320中指定了以下字符为保留字符：`! * ’ ( ) ; : @ & = + $ , / ? # [ ])` 。

[RFC7230][]

> 3.2.6. Field Value Components  
> Most HTTP header field values are defined using common syntax  
> components (token, quoted-string, and comment) separated by  
> whitespace or specific delimiting characters. Delimiters are chosen  
> from the set of US-ASCII visual characters not allowed in a token  
> (DQUOTE and “(),/:;<=>?@\[\]\{\}”).

所以这个问题特别容易出现在升级spring boot版本的时候，spring boot内嵌的tomcat也会升级，老版的tomcat运行正常，新版的tomcat就会出错。而深究特殊字符来源，一般是get请求中包含json字符串、搜索特殊字符关键字等。

## 解决方案 ##

如果是在开发新业务过程中出现这个问题，可以选择新的方案，避免在GET请求中使用`! * ’ ( ) ; : @ & = + $ , / ? # [ ])`等字符，毕竟符合规范是最好的出路。

如果是升级，可以使用下面的方式来解决：

### sprintboot 1.x(1.5.21测试有效) ###

import org.springframework.boot.context.embedded.ConfigurableEmbeddedServletContainer;
    import org.springframework.boot.context.embedded.EmbeddedServletContainerCustomizer;
    import org.springframework.boot.context.embedded.tomcat.TomcatConnectorCustomizer;
    import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    
    /** * Create by IntelliJ IDEA * * @author chenlei * @dateTime 2019/5/23 18:09 * @description TomcatConfig */
    @Configuration
    public class TomcatConfig { 
    
        @Bean
        public EmbeddedServletContainerCustomizer containerCustomizer() { 
            return new MyCustomizer();
        }
    
        private static class MyCustomizer implements EmbeddedServletContainerCustomizer { 
    
            @Override
            public void customize(ConfigurableEmbeddedServletContainer factory) { 
                if (factory instanceof TomcatEmbeddedServletContainerFactory) { 
                    customizeTomcat((TomcatEmbeddedServletContainerFactory) factory);
                }
            }
    
            void customizeTomcat(TomcatEmbeddedServletContainerFactory factory) { 
                factory.addConnectorCustomizers((TomcatConnectorCustomizer) connector -> { 
                    connector.setAttribute("relaxedPathChars", "<>[\\]^`{|}");
                    connector.setAttribute("relaxedQueryChars", "<>[\\]^`{|}");
                });
            }
    
        }
    }

### springboot 2.x(2.1.3测试有效) ###

import org.springframework.boot.web.embedded.tomcat.TomcatConnectorCustomizer;
    import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
    import org.springframework.boot.web.servlet.server.ServletWebServerFactory;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    
    /** * Create by IntelliJ IDEA * * @author chenlei * @dateTime 2019/5/23 18:09 * @description TomcatConfig */
    @Configuration
    public class TomcatConfig { 
    
        @Bean
        public ServletWebServerFactory webServerFactory() { 
            TomcatServletWebServerFactory fa = new TomcatServletWebServerFactory();
            fa.addConnectorCustomizers((TomcatConnectorCustomizer) connector -> connector.setProperty("relaxedQueryChars", "[]{}"));
            return fa;
        }
    
    }

## 总结 ##

这次问题出现的原因是升级springboot导致的，因为之前使用的较低版本的springboot(1.5.10.RELEASE)，升级到1.5.21.RELEASE后出现了该问题。因为之前在springboot 2.x上遇到过这个问题，因此知道问题所在，但springboot 1.x和2.x的解决方案有一点差异，这里记录一下。

## 后续 ##

后面再做了一次Tomcat升级，从9.0.21升级到9.0.31，突然又出现这个问题，问题原因是一样的，tomcat对非法字符的控制更加严格了，严格遵循最新的`RFC7230`，我们除了把所有的非法字符全部加到`relaxedQueryChars`以外，还添加了另一项配置`rejectIllegalHeader`：

@Configuration
    public class TomcatConfig { 
    
        @Bean
        public ServletWebServerFactory webServerFactory() { 
            TomcatServletWebServerFactory fa = new TomcatServletWebServerFactory();
            fa.addConnectorCustomizers(connector -> { 
                connector.setProperty("relaxedQueryChars", "(),/:;<=>?@[\\]{}");
                connector.setProperty("rejectIllegalHeader", "false");
            });
            return fa;
        }
    }

关于这个配置的解释参考：[tomcat-9.0-doc][]

> rejectIllegalHeader
> 
> If an HTTP request is received that contains an illegal header name or value (e.g. the header name is not a token) this setting determines if the request will be rejected with a 400 response (true) or if the illegal header be ignored (false). The default value is true which will cause the request to be rejected.

这样配置后（1.x的配置类似），大部分URI和Header都可以兼容，但是正如文档里所说的，`rejectIllegalHeader`会导致非法的header忽略，即header信息将不会被服务器接收。

所以一旦Header里面有非法字符，对应的Header项将被忽略，服务器不会报400，但会跳过这个header项，比如升级过程中我们发现有API在header里传输中文，导致服务启报错，加了`rejectIllegalHeader=false`后，不报400，但程序找不到对应的Header，最后不得不删除这些不规范的header。

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0NMX1lE_size_16_color_FFFFFF_t_70]: /images/20211122/fa42b3bbc7e7406f9bd373052a092732.png
[RFC7230]: https://datatracker.ietf.org/doc/rfc7230/?include_text=1
[tomcat-9.0-doc]: https://tomcat.apache.org/tomcat-9.0-doc/config/http.html