fix：Fix Market Invitation Anomaly and URL Authentication Vulnerability#802
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces tenant validation when accepting team invitations in NotifySendServiceImpl to prevent data being written to the wrong tenant after switching accounts. It also enhances path traversal protection in AuthenticationFilter by decoding, normalizing, and validating request paths, while removing static resource path bypasses. The review feedback suggests validating special characters like semicolons and backslashes before path normalization to prevent bypasses, and recommends using the non-deprecated URLDecoder.decode overload with StandardCharsets.UTF_8.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| // 归一化路径，解析掉 . 与 .. 等穿越序列 | ||
| // 例如 /api/rpa-auth/login/../dept/current 会被归一化为 /api/rpa-auth/dept/current | ||
| String path = org.springframework.util.StringUtils.cleanPath(decodedPath); | ||
|
|
||
| // 归一化后仍残留 ..（如越过根路径）或包含反斜杠、分号等可疑字符，视为非法路径，一律不放行 | ||
| if (path.contains("../") || path.contains("..\\") || path.contains(";")) { | ||
| return false; | ||
| } |
There was a problem hiding this comment.
在进行路径归一化（cleanPath）之前，应该先校验分号（;）和反斜杠（\\）等特殊字符。因为如果这些字符存在于会被 cleanPath 解析并移除的路径片段中（例如 /api/rpa-auth/private;/../login），归一化后的路径将不再包含这些字符，从而可能绕过安全检查。在归一化前进行校验可以确保更高的安全性。
// 在归一化前校验分号和反斜杠，避免其在 cleanPath 过程中被清除或绕过
if (decodedPath.contains(";") || decodedPath.contains("\\")) {
return false;
}
// 归一化路径，解析掉 . 与 .. 等穿越序列
// 例如 /api/rpa-auth/login/../dept/current 会被归一化为 /api/rpa-auth/dept/current
String path = org.springframework.util.StringUtils.cleanPath(decodedPath);
// 归一化后仍残留 ..（如越过根路径），视为非法路径，一律不放行
if (path.contains("../") || path.contains("..\\")) {
return false;
}| // URL 解码，处理 %2e%2e、%2f 等编码穿越 | ||
| String decodedPath; | ||
| try { | ||
| decodedPath = java.net.URLDecoder.decode(rawPath, "UTF-8"); |
There was a problem hiding this comment.
建议使用 java.net.URLDecoder.decode(rawPath, java.nio.charset.StandardCharsets.UTF_8) 代替已弃用的 URLDecoder.decode(String, String) 方法。这样可以避免使用已弃用的 API，并且不需要处理 UnsupportedEncodingException 异常。
| decodedPath = java.net.URLDecoder.decode(rawPath, "UTF-8"); | |
| decodedPath = java.net.URLDecoder.decode(rawPath, java.nio.charset.StandardCharsets.UTF_8); |
2 participants
📝 Pull Request 描述 | Description
🎯 变更类型 | Change Type
🔗 相关 Issue | Related Issues
📋 变更内容 | Changes Made
主要变更 | Main Changes
技术细节 | Technical Details
🧪 测试 | Testing
测试环境 | Test Environment
测试步骤 | Test Steps
测试结果 | Test Results
📸 截图/录屏 | Screenshots/Recordings
变更前 | Before
变更后 | After
破坏性变更详情 | Breaking Changes Details
✅ 检查清单 | Checklist
代码质量 | Code Quality
测试 | Testing
文档 | Documentation
其他 | Others
📌 额外说明 | Additional Notes
🙏 致谢 | Acknowledgements
📖 提示 | Tips:
/cc @maintainers