Spring官宣承认网传大漏洞，并提供解决方案

@ControllerAdvice     
@Order(Ordered.LOWEST_PRECEDENCE)     
public class BinderControllerAdvice {     
     
    @InitBinder     
    public void setAllowedFields(WebDataBinder dataBinder) {     
         String[] denylist = new String[]{"class.*", "Class.*", "*.class.*", "*.Class.*"};     
         dataBinder.setDisallowedFields(denylist);     
    }     
     
}     

@SpringBootApplication     
public class MyApp {     
     
public static void main(String[] args) {     
SpringApplication.run(CarApp.class, args);     
}     
     
     
@Bean     
public WebMvcRegistrations mvcRegistrations() {     
return new WebMvcRegistrations() {     
@Override     
public RequestMappingHandlerAdapter getRequestMappingHandlerAdapter() {     
return new ExtendedRequestMappingHandlerAdapter();     
}     
};     
}     
     
     
private static class ExtendedRequestMappingHandlerAdapter extends RequestMappingHandlerAdapter {     
     
@Override     
protected InitBinderDataBinderFactory createDataBinderFactory(List<InvocableHandlerMethod> methods) {     
     
return new ServletRequestDataBinderFactory(methods, getWebBindingInitializer()) {     
     
@Override     
protected ServletRequestDataBinder createBinderInstance(     
Object target, String name, NativeWebRequest request) throws Exception {     
     
ServletRequestDataBinder binder = super.createBinderInstance(target, name, request);     
String[] fields = binder.getDisallowedFields();     
List<String> fieldList = new ArrayList<>(fields != null ? Arrays.asList(fields) : Collections.emptyList());     
fieldList.addAll(Arrays.asList("class.*", "Class.*", "*.class.*", "*.Class.*"));     
binder.setDisallowedFields(fieldList.toArray(new String[] {}));     
return binder;     
}     
};     
}     
}     
}