@ -4506,7 +4506,7 @@ escaping. Modeled after the JSTL c:url tag with backwards compatibility in mind.
@@ -4506,7 +4506,7 @@ escaping. Modeled after the JSTL c:url tag with backwards compatibility in mind.
@ -9130,13 +9130,14 @@ The following table lists features provided by the `BeanFactory` and
@@ -9130,13 +9130,14 @@ The following table lists features provided by the `BeanFactory` and
| Yes
|===
To explicitly register a bean post-processor with a `BeanFactory` implementation, you
must write code like this:
To explicitly register a bean post-processor with a `BeanFactory` implementation,
you need to write code like this:
[source,java,indent=0]
[subs="verbatim,quotes"]
----
ConfigurableBeanFactory factory = new XmlBeanFactory(...);
DefaultListableBeanFactory factory = new DefaultListableBeanFactory();
// populate the factory with bean definitions
// now register any needed BeanPostProcessor instances
MyBeanPostProcessor postProcessor = new MyBeanPostProcessor();
@ -9151,7 +9152,9 @@ implementation, you must write code like this:
@@ -9151,7 +9152,9 @@ implementation, you must write code like this:
[source,java,indent=0]
[subs="verbatim,quotes"]
----
XmlBeanFactory factory = new XmlBeanFactory(new FileSystemResource("beans.xml"));
DefaultListableBeanFactory factory = new DefaultListableBeanFactory();
XmlBeanDefinitionReader reader = new XmlBeanDefinitionReader(factory);
// bring in some property values from a Properties file
PropertyPlaceholderConfigurer cfg = new PropertyPlaceholderConfigurer();
@ -30677,7 +30680,7 @@ also <<mvc-config-content-negotiation>> for content negotiation configuration.
@@ -30677,7 +30680,7 @@ also <<mvc-config-content-negotiation>> for content negotiation configuration.
[[mvc-ann-requestmapping-rfd]]
==== Suffix Suffix Pattern Matching and RFD
==== Suffix Pattern Matching and RFD
Reflected file download (RFD) attack was first described in a
https://www.trustwave.com/Resources/SpiderLabs-Blog/Reflected-File-Download---A-New-Web-Attack-Vector/[paper by Trustwave]
@ -30717,7 +30720,7 @@ Below are additional recommendations from the report:
@@ -30717,7 +30720,7 @@ Below are additional recommendations from the report:
For an example of how to do that with Spring see https://github.com/rwinch/spring-jackson-owasp[spring-jackson-owasp].
* Configure suffix pattern matching to be turned off or restricted to explicitly
registered suffixes only.
* Configure content negotiation with the properties “useJaf” and “ignoreUknownPathExtension”
* Configure content negotiation with the properties "useJaf" and "ignoreUnknownPathExtensions"
set to false which would result in a 406 response for URLs with unknown extensions.
Note however that this may not be an option if URLs are naturally expected to have
a dot towards the end.
@ -47560,13 +47563,13 @@ default). Here you can see what methods are available for `Trigger` implementati
@@ -47560,13 +47563,13 @@ default). Here you can see what methods are available for `Trigger` implementati
Spring provides two implementations of the `Trigger` interface. The most interesting one
is the `CronTrigger`. It enables the scheduling of tasks based on cron expressions. For
example the following task is being scheduled to run 15 minutes past each hour but only
example, the following task is being scheduled to run 15 minutes past each hour but only
during the 9-to-5 "business hours" on weekdays.
[source,java,indent=0]
[subs="verbatim"]
----
scheduler.schedule(task, new CronTrigger("* 15 9-17 * * MON-FRI"));
scheduler.schedule(task, new CronTrigger("0 15 9-17 * * MON-FRI"));
----
The other out-of-the-box implementation is a `PeriodicTrigger` that accepts a fixed
@ -47578,7 +47581,7 @@ fixed-delay, those methods should be used directly whenever possible. The value
@@ -47578,7 +47581,7 @@ fixed-delay, those methods should be used directly whenever possible. The value
the `Trigger` abstraction. For example, it may be convenient to allow periodic triggers,
cron-based triggers, and even custom trigger implementations to be used interchangeably.
Such a component could take advantage of dependency injection so that such `Triggers`
could be configured externally.
could be configured externally and therefore easily modified or extended.