{"record":{"id":"10bdecdd9fdd4d1a","repo":"dromara/Sa-Token","slug":"requestpath-10bdec","errorCode":null,"errorMessage":"非法请求：{requestPath}","messagePattern":"非法请求：\\{requestPath\\}","errorType":"exception","errorClass":"RequestPathInvalidException","httpStatus":null,"severity":"error","filePath":"sa-token-core/src/main/java/cn/dev33/satoken/strategy/hooks/SaFirewallCheckHookForPathDangerCharacter.java","lineNumber":77,"sourceCode":"     * @param character 危险字符列表\n     */\n    public void resetConfig(String... character) {\n        this.dangerCharacter = Arrays.asList(character);\n    }\n\n    /**\n     * 执行的方法\n     *\n     * @param req 请求对象\n     * @param res 响应对象\n     * @param extArg 预留扩展参数\n     */\n    @Override\n    public void execute(SaRequest req, SaResponse res, Object extArg) {\n        String requestPath = req.getRequestPath();\n        for (String item : dangerCharacter) {\n            if (requestPath.contains(item)) {\n                throw new RequestPathInvalidException(\"非法请求：\" + requestPath, requestPath);\n            }\n        }\n    }\n\n}\n","sourceCodeStart":59,"sourceCodeEnd":83,"githubUrl":"https://github.com/dromara/Sa-Token/blob/ac2c7f6e94a78573cf0bcb932dd8b04e68fad189/sa-token-core/src/main/java/cn/dev33/satoken/strategy/hooks/SaFirewallCheckHookForPathDangerCharacter.java#L59-L83","documentation":"The PathDangerCharacter firewall hook checks whether the raw request path contains any substring from the configured dangerCharacter list (defaults include characters like < > \\\" ' and SQL/XSS-ish fragments depending on version). A containment match throws RequestPathInvalidException. This blocks script/SQL fragments from reaching controllers via the URL.","triggerScenarios":"Paths containing any configured danger string, e.g. /search/<script>, /q/it's, /find/a=b -- or any path where a path-variable naturally contains a quote or angle bracket.","commonSituations":"REST APIs that put free-text search terms in the path segment (e.g. /search/{keyword}) and users type quotes or <; documentation URLs containing angle brackets; attack probes with <script> or ' OR 1=1.","solutions":["Move free-text input from the path into a query parameter or POST body (query values and bodies are not checked by this hook)","URL-encode user input before building the path, or trim/reject dangerous characters client-side","Customize the list via sa-token.firewall.danger-character if a character is required by your scheme"],"exampleFix":"// before: free text in path segment\n@GetMapping(\"/search/{keyword}\")  // /search/it's -> blocked\n\n// after: free text as query param\n@GetMapping(\"/search\")  // /search?keyword=it's -> passes","handlingStrategy":"validation","validationCode":"String path = SaHolder.getRequest().getRequestPath();\nfor (String d : SaManager.getConfig().getFirewall().getDangerCharacter()) {\n    if (path.contains(d)) { /* reject 400 / move input to query param */ }\n}","typeGuard":null,"tryCatchPattern":"try {\n    chain.doFilter(req, res);\n} catch (RequestPathInvalidException e) {\n    res.setStatus(400);\n}","preventionTips":["Never put free-text user input in path segments; use query or body","URL-encode and whitelist characters for path variables you do control","Review danger-character defaults after upgrading sa-token"],"tags":["sa-token","firewall","security","xss","request-path"],"backgroundTag":null,"analyzedSha":"ac2c7f6e94a78573cf0bcb932dd8b04e68fad189","analyzedAt":"2026-08-14T14:36:10.271Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}