为何请求未映射的/uploadify/uploadify.php会触发500而非404错误？

Hey there, let's break this down clearly—it's actually part of Spring Boot's normal request flow, even though the path doesn't exist. Here's what's happening:

• All incoming HTTP requests to your Spring Boot app pass through DispatcherServlet, which is a subclass of FrameworkServlet. When a POST request hits /uploadify/uploadify.php, the servlet first routes it to doPost() (matching the HTTP method used) before checking if there's a controller mapping for that path.
• Only after doPost() runs does the servlet realize no handler exists for that URL, triggering a 404 error that gets forwarded to your custom ErrorController.

The key takeaway here: this is almost certainly a malicious scan. Attackers spray common vulnerable paths like /uploadify/uploadify.php (a legacy PHP upload tool) across the web, looking for unpatched upload vulnerabilities that let them inject malware or take over systems. They don't care your app is Java-based—they're just checking every known weak spot.

Steps to Secure Your App #

• Block PHP requests entirely: Since your app is Spring Boot (Java-based), there’s no reason to handle .php paths. Use Spring Security to reject these requests outright. Here’s a quick snippet for your security config:

  @Bean
  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
      http.authorizeHttpRequests(auth -> auth
              .requestMatchers("/*.php", "/**/*.php").denyAll()
              // Add your other authorization rules here
      );
      return http.build();
  }
  

• Harden your ErrorController: Instead of returning a detailed error page for these scans, send a generic 404 or even a 403 Forbidden response to deter repeat attempts.
• Log and monitor malicious traffic: Enable access logging to track IP addresses, user agents, and request paths of these scans. Set up alerts for repeated hits from the same IP to block them proactively.
• Keep dependencies updated: Ensure all Spring Boot libraries, plugins, and third-party dependencies are patched to close any known vulnerabilities attackers might target.

内容的提问来源于stack exchange，提问作者GordyB