{"id":60471,"date":"2026-01-15T17:17:15","date_gmt":"2026-01-15T09:17:15","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/60471.html"},"modified":"2026-01-15T17:17:15","modified_gmt":"2026-01-15T09:17:15","slug":"%e4%bc%81%e4%b8%9a%e5%be%ae%e4%bf%a1api%e6%8e%a5%e5%8f%a3%e5%af%b9%e6%8e%a5%e4%b8%adjava%e5%90%8e%e7%ab%af%e7%9a%84%e7%ac%ac%e4%b8%89%e6%96%b9%e4%be%9d%e8%b5%96%e5%ae%89%e5%85%a8%e6%bc%8f%e6%b4%9e","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/60471.html","title":{"rendered":"\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7"},"content":{"rendered":"

\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7<\/h2>\n

1. \u4f9d\u8d56\u6f0f\u6d1e\u98ce\u9669\u5728\u4f01\u5fae\u5bf9\u63a5\u4e2d\u7684\u7279\u6b8a\u6027<\/h3>\n

\u4f01\u4e1a\u5fae\u4fe1API\u5bf9\u63a5\u5e38\u4f9d\u8d56\u5982 okhttp\u3001fastjson\u3001spring-web\u3001commons-collections \u7b49\u7ec4\u4ef6\u5904\u7406 HTTP \u8bf7\u6c42\u3001JSON \u5e8f\u5217\u5316\u4e0e OAuth2 \u6d41\u7a0b\u3002\u4e00\u65e6\u8fd9\u4e9b\u5e93\u5b58\u5728 CVE \u6f0f\u6d1e（\u5982\u53cd\u5e8f\u5217\u5316\u3001SSRF\u3001\u8def\u5f84\u904d\u5386），\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u4f2a\u9020\u56de\u8c03\u8bf7\u6c42\u3001\u6076\u610f access_token \u6216 webhook payload \u5b9e\u65bd\u5165\u4fb5\u3002\u56e0\u6b64，\u5fc5\u987b\u5efa\u7acb\u81ea\u52a8\u5316\u626b\u63cf + \u53ef\u4fe1\u7248\u672c\u9501\u5b9a + \u5b89\u5168\u5c01\u88c5\u4e09\u4f4d\u4e00\u4f53\u9632\u62a4\u673a\u5236\u3002<\/p>\n

2. \u4f7f\u7528 OWASP Dependency-Check \u8fdb\u884c\u672c\u5730\u626b\u63cf<\/h3>\n

\u5728 Maven \u9879\u76ee\u4e2d\u96c6\u6210\u63d2\u4ef6，\u6784\u5efa\u65f6\u81ea\u52a8\u68c0\u6d4b\u5df2\u77e5\u6f0f\u6d1e：<\/p>\n

<<\/span>plugin<\/span>><\/span><\/span>
\n <<\/span>groupId<\/span>><\/span><\/span>org.owasp<\/<\/span>groupId<\/span>><\/span><\/span>
\n <<\/span>artifactId<\/span>><\/span><\/span>dependency-check-maven<\/<\/span>artifactId<\/span>><\/span><\/span>
\n <<\/span>version<\/span>><\/span><\/span>8.4.0<\/<\/span>version<\/span>><\/span><\/span>
\n <<\/span>configuration<\/span>><\/span><\/span>
\n <<\/span>failBuildOnCVSS<\/span>><\/span><\/span>7<\/<\/span>failBuildOnCVSS<\/span>><\/span><\/span>
\n <<\/span>suppressionFiles<\/span>><\/span><\/span>
\n <<\/span>suppressionFile<\/span>><\/span><\/span>dependency-check-suppressions.xml<\/<\/span>suppressionFile<\/span>><\/span><\/span>
\n <\/<\/span>suppressionFiles<\/span>><\/span><\/span>
\n <\/<\/span>configuration<\/span>><\/span><\/span>
\n <<\/span>executions<\/span>><\/span><\/span>
\n <<\/span>execution<\/span>><\/span><\/span>
\n <<\/span>goals<\/span>><\/span><\/span>
\n <<\/span>goal<\/span>><\/span><\/span>check<\/<\/span>goal<\/span>><\/span><\/span>
\n <\/<\/span>goals<\/span>><\/span><\/span>
\n <\/<\/span>execution<\/span>><\/span><\/span>
\n <\/<\/span>executions<\/span>><\/span><\/span>
\n<\/<\/span>plugin<\/span>><\/span><\/span><\/p>\n

\u6267\u884c\u547d\u4ee4：<\/p>\n

mvn dependency-check:check<\/p>\n

\u751f\u6210\u62a5\u544a\u4f4d\u4e8e target\/dependency-check-report.html，\u53ef\u5feb\u901f\u5b9a\u4f4d\u9ad8\u5371\u7ec4\u4ef6\u3002<\/p>\n

3. \u5f3a\u5236\u7edf\u4e00\u4f9d\u8d56\u7248\u672c（Maven BOM）<\/h3>\n

\u901a\u8fc7\u81ea\u5b9a\u4e49 BOM \u6587\u4ef6\u9501\u5b9a\u6240\u6709\u5b50\u6a21\u5757\u7684\u4f9d\u8d56\u7248\u672c，\u907f\u514d\u4f20\u9012\u4f9d\u8d56\u5f15\u5165\u65e7\u7248：<\/p>\n

\/\/ \u6587\u4ef6：wlkankan-cn-bom\/pom.xml<\/span>
\n<<\/span>dependencyManagement><\/span><\/span>
\n <<\/span>dependencies><\/span><\/span>
\n <<\/span>dependency><\/span><\/span>
\n <<\/span>groupId><\/span><\/span>com.<\/span>alibaba<<\/span>\/<\/span>groupId><\/span>
\n <<\/span>artifactId><\/span><\/span>fastjson<<\/span>\/<\/span>artifactId><\/span>
\n <<\/span>version><\/span><\/span>2.0<\/span>.43<\/span><<\/span>\/<\/span>version><\/span> <<\/span>!<\/span>—<\/span> \u4fee\u590d CVE–<\/span>2022<\/span>–<\/span>25845<\/span> —<\/span>><\/span>
\n <<\/span>\/<\/span>dependency><\/span>
\n <<\/span>dependency><\/span><\/span>
\n <<\/span>groupId><\/span><\/span>org.<\/span>apache.<\/span>commons<<\/span>\/<\/span>groupId><\/span>
\n <<\/span>artifactId><\/span><\/span>commons–<\/span>collections4<<\/span>\/<\/span>artifactId><\/span>
\n <<\/span>version><\/span><\/span>4.4<\/span><<\/span>\/<\/span>version><\/span> <<\/span>!<\/span>—<\/span> \u65e0 CommonsCollections<\/span> \u53cd\u5e8f\u5217\u5316\u94fe —<\/span>><\/span>
\n <<\/span>\/<\/span>dependency><\/span>
\n <<\/span>dependency><\/span><\/span>
\n <<\/span>groupId><\/span><\/span>com.<\/span>squareup.<\/span>okhttp3<<\/span>\/<\/span>groupId><\/span>
\n <<\/span>artifactId><\/span><\/span>okhttp<<\/span>\/<\/span>artifactId><\/span>
\n <<\/span>version><\/span><\/span>4.12<\/span>.0<\/span><<\/span>\/<\/span>version><\/span> <<\/span>!<\/span>—<\/span> \u4fee\u590d CVE–<\/span>2023<\/span>–<\/span>34906<\/span> —<\/span>><\/span>
\n <<\/span>\/<\/span>dependency><\/span>
\n <<\/span>\/<\/span>dependencies><\/span>
\n<<\/span>\/<\/span>dependencyManagement><\/span><\/p>\n

\u4e1a\u52a1\u6a21\u5757\u5f15\u7528：<\/p>\n

<<\/span>dependencyManagement<\/span>><\/span><\/span>
\n <<\/span>dependencies<\/span>><\/span><\/span>
\n <<\/span>dependency<\/span>><\/span><\/span>
\n <<\/span>groupId<\/span>><\/span><\/span>wlkankan.cn<\/<\/span>groupId<\/span>><\/span><\/span>
\n <<\/span>artifactId<\/span>><\/span><\/span>wlkankan-cn-bom<\/<\/span>artifactId<\/span>><\/span><\/span>
\n <<\/span>version<\/span>><\/span><\/span>1.0.0<\/<\/span>version<\/span>><\/span><\/span>
\n <<\/span>type<\/span>><\/span><\/span>pom<\/<\/span>type<\/span>><\/span><\/span>
\n <<\/span>scope<\/span>><\/span><\/span>import<\/<\/span>scope<\/span>><\/span><\/span>
\n <\/<\/span>dependency<\/span>><\/span><\/span>
\n <\/<\/span>dependencies<\/span>><\/span><\/span>
\n<\/<\/span>dependencyManagement<\/span>><\/span><\/span><\/p>\n

\"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

4. \u5b89\u5168\u5c01\u88c5\u9ad8\u98ce\u9669\u7ec4\u4ef6<\/h3>\n

\u5bf9 fastjson \u7b49\u6613\u51fa\u95ee\u9898\u7684\u5e93\u8fdb\u884c\u5c01\u88c5，\u7981\u7528\u5371\u9669\u7279\u6027：<\/p>\n

package<\/span> wlkankan.<\/span>cn.<\/span>wechat.<\/span>util<\/span>;<\/span><\/p>\n

import<\/span> com.<\/span>alibaba.<\/span>fastjson2.<\/span><\/span>JSON;<\/span>
\nimport<\/span> com.<\/span>alibaba.<\/span>fastjson2.<\/span><\/span>JSONReader<\/span>;<\/span>
\nimport<\/span> com.<\/span>alibaba.<\/span>fastjson2.<\/span><\/span>JSONWriter<\/span>;<\/span><\/p>\n

public<\/span> class<\/span> SafeJsonUtils<\/span> {<\/span><\/p>\n

private<\/span> static<\/span> final<\/span> JSONReader.<\/span>Feature<\/span>[<\/span>]<\/span> SAFE_READ_FEATURES =<\/span> {<\/span>
\n JSONReader.<\/span>Feature.<\/span>DisableFieldSmartMatch<\/span>,<\/span>
\n JSONReader.<\/span>Feature.<\/span>IgnoreAutoType<\/span>
\n }<\/span>;<\/span><\/p>\n

private<\/span> static<\/span> final<\/span> JSONWriter.<\/span>Feature<\/span>[<\/span>]<\/span> SAFE_WRITE_FEATURES =<\/span> {<\/span>
\n JSONWriter.<\/span>Feature.<\/span>WriteClassName<\/span>,<\/span> \/\/ \u663e\u5f0f\u63a7\u5236，\u4e0d\u4f9d\u8d56\u81ea\u52a8\u7c7b\u578b<\/span>
\n }<\/span>;<\/span><\/p>\n

public<\/span> static<\/span> <<\/span>T<\/span>><\/span><\/span> T<\/span> parseObject<\/span>(<\/span>String<\/span> json,<\/span> Class<\/span><<\/span>T<\/span>><\/span><\/span> clazz)<\/span> {<\/span>
\n return<\/span> JSON.<\/span>parseObject<\/span>(<\/span>json,<\/span> clazz,<\/span> SAFE_READ_FEATURES)<\/span>;<\/span>
\n }<\/span><\/p>\n

public<\/span> static<\/span> String<\/span> toJSONString<\/span>(<\/span>Object<\/span> obj)<\/span> {<\/span>
\n return<\/span> JSON.<\/span>toJSONString<\/span>(<\/span>obj,<\/span> SAFE_WRITE_FEATURES)<\/span>;<\/span>
\n }<\/span>
\n}<\/span><\/p>\n

\u7981\u6b62\u76f4\u63a5\u4f7f\u7528 JSON.parse() \u6216\u5f00\u542f SupportAutoType\u3002<\/p>\n

5. \u9694\u79bb\u5916\u90e8\u8f93\u5165\u7684\u53cd\u5e8f\u5217\u5316\u64cd\u4f5c<\/h3>\n

\u4f01\u4e1a\u5fae\u4fe1\u56de\u8c03\u6d88\u606f\u9700\u89e3\u6790 XML\/JSON，\u5fc5\u987b\u4f7f\u7528\u767d\u540d\u5355\u673a\u5236：<\/p>\n

@Service<\/span>
\npublic<\/span> class<\/span> WeComCallbackHandler<\/span> {<\/span><\/p>\n

public<\/span> void<\/span> handleCallback<\/span>(<\/span>HttpServletRequest<\/span> request)<\/span> throws<\/span> Exception<\/span> {<\/span>
\n String<\/span> body =<\/span> StreamUtils<\/span>.<\/span>copyToString<\/span>(<\/span>request.<\/span>getInputStream<\/span>(<\/span>)<\/span>,<\/span> StandardCharsets<\/span>.<\/span>UTF_8)<\/span>;<\/span><\/p>\n

\/\/ \u4ec5\u5141\u8bb8\u89e3\u6790\u9884\u5b9a\u4e49\u7ed3\u6784<\/span>
\n WeComEvent<\/span> event =<\/span> SafeJsonUtils<\/span>.<\/span>parseObject<\/span>(<\/span>body,<\/span> WeComEvent<\/span>.<\/span>class<\/span>)<\/span>;<\/span><\/p>\n

\/\/ \u6821\u9a8c msg_signature<\/span>
\n if<\/span> (<\/span>!<\/span>verifySignature<\/span>(<\/span>event.<\/span>getMsgSignature<\/span>(<\/span>)<\/span>,<\/span> event.<\/span>getTimestamp<\/span>(<\/span>)<\/span>,<\/span> event.<\/span>getNonce<\/span>(<\/span>)<\/span>,<\/span> body)<\/span>)<\/span> {<\/span>
\n throw<\/span> new<\/span> SecurityException<\/span>(<\/span>"\u7b7e\u540d\u9a8c\u8bc1\u5931\u8d25"<\/span>)<\/span>;<\/span>
\n }<\/span><\/p>\n

processEvent<\/span>(<\/span>event)<\/span>;<\/span>
\n }<\/span><\/p>\n

\/\/ \u767d\u540d\u5355\u4e8b\u4ef6\u7c7b，\u65e0 getter\/setter \u6ee5\u7528<\/span>
\n public<\/span> static<\/span> class<\/span> WeComEvent<\/span> {<\/span>
\n private<\/span> String<\/span> msgSignature;<\/span>
\n private<\/span> String<\/span> timestamp;<\/span>
\n private<\/span> String<\/span> nonce;<\/span>
\n private<\/span> String<\/span> encrypt;<\/span> \/\/ \u4ec5\u6b64\u5b57\u6bb5，\u4e0d\u89e3\u5bc6\u524d\u4e0d\u89e3\u6790\u5185\u5bb9<\/span><\/p>\n

\/\/ standard getters<\/span>
\n }<\/span>
\n}<\/span><\/p>\n

\u89e3\u5bc6\u540e\u7684\u660e\u6587\u4e5f\u9700\u518d\u6b21\u7528 SafeJsonUtils \u89e3\u6790，\u4e14\u76ee\u6807\u7c7b\u4e0d\u5f97\u7ee7\u627f Serializable \u6216\u5305\u542b readObject\u3002<\/p>\n

6. \u81ea\u52a8\u5316\u4f9d\u8d56\u66f4\u65b0\u4e0e\u901a\u77e5<\/h3>\n

\u96c6\u6210 GitHub Dependabot \u6216 GitLab Auto Remediation，\u81ea\u52a8\u521b\u5efa PR \u5347\u7ea7\u6709\u6f0f\u6d1e\u7684\u4f9d\u8d56：<\/p>\n

.github\/dependabot.yml \u793a\u4f8b：<\/p>\n

version<\/span>:<\/span> 2<\/span>
\nupdates<\/span>:<\/span>
\n –<\/span> package-ecosystem<\/span>:<\/span> "maven"<\/span>
\n directory<\/span>:<\/span> "\/"<\/span>
\n schedule<\/span>:<\/span>
\n interval<\/span>:<\/span> "daily"<\/span>
\n open-pull-requests-limit<\/span>:<\/span> 10<\/span>
\n ignore<\/span>:<\/span>
\n –<\/span> dependency-name<\/span>:<\/span> "org.springframework.*"<\/span>
\n # \u624b\u52a8\u5347\u7ea7 Spring \u907f\u514d\u517c\u5bb9\u95ee\u9898<\/span><\/p>\n

\u540c\u65f6，\u5728 CI \u6d41\u7a0b\u4e2d\u52a0\u5165 Trivy \u6216 Snyk \u626b\u63cf\u5bb9\u5668\u955c\u50cf：<\/p>\n

trivy fs –security-checks vuln –severity HIGH,CRITICAL .\/target<\/p>\n

7. \u8fd0\u884c\u65f6\u9632\u62a4：\u7981\u6b62\u52a8\u6001\u4ee3\u7801\u6267\u884c<\/h3>\n

\u901a\u8fc7 JVM \u53c2\u6570\u7981\u7528\u5371\u9669\u529f\u80fd：<\/p>\n

-Dcom.sun.jndi.ldap.object.trustURLCodebase=<\/span>false
\n-Dcom.sun.jndi.rmi.object.trustURLCodebase=<\/span>false
\n–add-opens=<\/span>java.base\/java.lang=<\/span>ALL-UNNAMED<\/p>\n

\u5e76\u5728 SecurityManager（\u6216 Java 17+ \u7684 SecurityManager \u66ff\u4ee3\u65b9\u6848）\u4e2d\u9650\u5236\u6587\u4ef6\/\u7f51\u7edc\u8bbf\u95ee\u8303\u56f4\u3002<\/p>\n

\u901a\u8fc7\u6784\u5efa\u671f\u626b\u63cf\u3001\u7248\u672c\u9501\u5b9a\u3001\u5b89\u5168\u5c01\u88c5\u3001\u8f93\u5165\u9694\u79bb\u3001\u81ea\u52a8\u66f4\u65b0\u4e0e\u8fd0\u884c\u65f6\u52a0\u56fa，\u53ef\u5728\u4f01\u4e1a\u5fae\u4fe1 API \u5bf9\u63a5\u7cfb\u7edf\u4e2d\u7cfb\u7edf\u6027\u963b\u65ad\u7b2c\u4e09\u65b9\u4f9d\u8d56\u6f0f\u6d1e\u5229\u7528\u8def\u5f84，\u4fdd\u969c\u670d\u52a1\u5b89\u5168\u7a33\u5b9a\u8fd0\u884c\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7
\n1. \u4f9d\u8d56\u6f0f\u6d1e\u98ce\u9669\u5728\u4f01\u5fae\u5bf9\u63a5\u4e2d\u7684\u7279\u6b8a\u6027
\n\u4f01\u4e1a\u5fae\u4fe1API\u5bf9\u63a5\u5e38\u4f9d\u8d56\u5982 okhttp\u3001fastjson\u3001spring-web\u3001commons-collections \u7b49\u7ec4\u4ef6\u5904\u7406 HTTP \u8bf7\u6c42\u3001JSON \u5e8f\u5217\u5316\u4e0e OAuth2 \u6d41\u7a0b\u3002\u4e00\u65e6\u8fd9\u4e9b\u5e93\u5b58\u5728 CVE \u6f0f\u6d1e（\u5982\u53cd\u5e8f\u5217\u5316\u3001SSRF\u3001\u8def\u5f84\u904d\u5386），\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u4f2a\u9020\u56de\u8c03\u8bf7\u6c42\u3001\u6076\u610f access_token \u6216 webho<\/p>\n","protected":false},"author":2,"featured_media":60470,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[99,1747,190],"topic":[],"class_list":["post-60471","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-java","tag-1747","tag-190"],"yoast_head":"\n\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/60471.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7 1. \u4f9d\u8d56\u6f0f\u6d1e\u98ce\u9669\u5728\u4f01\u5fae\u5bf9\u63a5\u4e2d\u7684\u7279\u6b8a\u6027 \u4f01\u4e1a\u5fae\u4fe1API\u5bf9\u63a5\u5e38\u4f9d\u8d56\u5982 okhttp\u3001fastjson\u3001spring-web\u3001commons-collections \u7b49\u7ec4\u4ef6\u5904\u7406 HTTP \u8bf7\u6c42\u3001JSON \u5e8f\u5217\u5316\u4e0e OAuth2 \u6d41\u7a0b\u3002\u4e00\u65e6\u8fd9\u4e9b\u5e93\u5b58\u5728 CVE \u6f0f\u6d1e（\u5982\u53cd\u5e8f\u5217\u5316\u3001SSRF\u3001\u8def\u5f84\u904d\u5386），\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u4f2a\u9020\u56de\u8c03\u8bf7\u6c42\u3001\u6076\u610f access_token \u6216 webho\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/60471.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-15T09:17:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/01\/20260115091710-6968b096ddaa3.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/60471.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/60471.html\",\"name\":\"\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-01-15T09:17:15+00:00\",\"dateModified\":\"2026-01-15T09:17:15+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/60471.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/60471.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/60471.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/60471.html","og_locale":"zh_CN","og_type":"article","og_title":"\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7 1. \u4f9d\u8d56\u6f0f\u6d1e\u98ce\u9669\u5728\u4f01\u5fae\u5bf9\u63a5\u4e2d\u7684\u7279\u6b8a\u6027 \u4f01\u4e1a\u5fae\u4fe1API\u5bf9\u63a5\u5e38\u4f9d\u8d56\u5982 okhttp\u3001fastjson\u3001spring-web\u3001commons-collections \u7b49\u7ec4\u4ef6\u5904\u7406 HTTP \u8bf7\u6c42\u3001JSON \u5e8f\u5217\u5316\u4e0e OAuth2 \u6d41\u7a0b\u3002\u4e00\u65e6\u8fd9\u4e9b\u5e93\u5b58\u5728 CVE \u6f0f\u6d1e（\u5982\u53cd\u5e8f\u5217\u5316\u3001SSRF\u3001\u8def\u5f84\u904d\u5386），\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u4f2a\u9020\u56de\u8c03\u8bf7\u6c42\u3001\u6076\u610f access_token \u6216 webho","og_url":"https:\/\/www.wsisp.com\/helps\/60471.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-01-15T09:17:15+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/01\/20260115091710-6968b096ddaa3.png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"3 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/60471.html","url":"https:\/\/www.wsisp.com\/helps\/60471.html","name":"\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-01-15T09:17:15+00:00","dateModified":"2026-01-15T09:17:15+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/60471.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/60471.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/60471.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u4f01\u4e1a\u5fae\u4fe1API\u63a5\u53e3\u5bf9\u63a5\u4e2dJava\u540e\u7aef\u7684\u7b2c\u4e09\u65b9\u4f9d\u8d56\u5b89\u5168\u6f0f\u6d1e\u6392\u67e5\u4e0e\u4fee\u590d\u6280\u5de7"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/60471","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=60471"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/60471\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/60470"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=60471"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=60471"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=60471"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=60471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}