feat(ctx): SanitizeFilter 剥 context-path，业务路径空间与 ctx 解耦（ctx 为空零行为变化）

2026-09-23 16:50:34 +08:00
parent 2389d2fa9a
commit a19ded48ef
2 changed files with 67 additions and 4 deletions
@@ -9,8 +9,9 @@ import org.springframework.mock.web.MockHttpServletResponse;
 import static org.assertj.core.api.Assertions.assertThat;

 /**
- * SanitizeFilter 五用例（T1.1 TDD）：路径穿越（明文/编码）、双斜杠、控制字符均裸 400；
- * 正常路径放行且两个 attribute 契约已设。
+ * SanitizeFilter 九用例（T1.1 TDD）：路径穿越（明文/编码）、双斜杠、控制字符均裸 400；
+ * 正常路径放行且两个 attribute 契约已设。ctx 非空时先剥 context-path 再判定，
+ * 前缀相似不误剥，ctx 为空零行为变化。
 */
 class SanitizeFilterTest {

@@ -58,4 +59,51 @@ class SanitizeFilterTest {
        assertThat(req.getAttribute(SanitizeFilter.ATTR_STRIPPED_PATH))
                .as("stripped.path = 剥 target 首段").isEqualTo("/oapi/x");
    }
+
+    @Test
+    void ctx非空_剥除后存业务URI() throws Exception {
+        MockHttpServletRequest req = new MockHttpServletRequest("GET", "/open-gateway/notice/oapi/x");
+        req.setContextPath("/open-gateway");
+        MockHttpServletResponse res = new MockHttpServletResponse();
+        MockFilterChain chain = new MockFilterChain();
+        new SanitizeFilter().doFilter(req, res, chain);
+        assertThat(res.getStatus()).as("ctx 内正常路径放行").isEqualTo(200);
+        assertThat(req.getAttribute(SanitizeFilter.ATTR_SANITIZED_URI))
+                .as("sanitized.uri = 业务 URI（已去 ctx）").isEqualTo("/notice/oapi/x");
+        assertThat(req.getAttribute(SanitizeFilter.ATTR_STRIPPED_PATH))
+                .as("stripped.path 基于业务 URI 剥 target").isEqualTo("/oapi/x");
+    }
+
+    @Test
+    void ctx非空_前缀相似不误剥() throws Exception {
+        MockHttpServletRequest req = new MockHttpServletRequest("GET", "/open-gateway-other/oapi/x");
+        req.setContextPath("/open-gateway");
+        MockHttpServletResponse res = new MockHttpServletResponse();
+        MockFilterChain chain = new MockFilterChain();
+        new SanitizeFilter().doFilter(req, res, chain);
+        assertThat(req.getAttribute(SanitizeFilter.ATTR_SANITIZED_URI))
+                .as("前缀相似不剥，交由 target 判定 404").isEqualTo("/open-gateway-other/oapi/x");
+    }
+
+    @Test
+    void ctx非空_剥后双斜杠仍拒() throws Exception {
+        MockHttpServletRequest req = new MockHttpServletRequest("GET", "/open-gateway//x");
+        req.setContextPath("/open-gateway");
+        MockHttpServletResponse res = new MockHttpServletResponse();
+        MockFilterChain chain = new MockFilterChain();
+        new SanitizeFilter().doFilter(req, res, chain);
+        assertThat(res.getStatus()).as("剥 ctx 后 // 仍裸 400").isEqualTo(400);
+    }
+
+    @Test
+    void stripContextPath_边界() {
+        assertThat(SanitizeFilter.stripContextPath("/userbase/oapi/x", "")).isEqualTo("/userbase/oapi/x");
+        assertThat(SanitizeFilter.stripContextPath("/userbase/oapi/x", null)).isEqualTo("/userbase/oapi/x");
+        assertThat(SanitizeFilter.stripContextPath(null, "/open-gateway")).isNull();
+        assertThat(SanitizeFilter.stripContextPath("/open-gateway", "/open-gateway"))
+                .as("裸 ctx 不剥（无尾斜杠），原样走 404 语义").isEqualTo("/open-gateway");
+        assertThat(SanitizeFilter.stripContextPath("/open-gateway/x", "/open-gateway")).isEqualTo("/x");
+        assertThat(SanitizeFilter.stripContextPath("/open-gateway-other/x", "/open-gateway"))
+                .isEqualTo("/open-gateway-other/x");
+    }
 }