https://brycealanhayes.com/tags/source-code-analysis/Recent content in Source-Code-Analysis on Bryce Alan Hayes — Security ResearchHugoen-usSat, 01 Aug 2026 00:00:00 +0000https://brycealanhayes.com/research/spring-auth-bypass/Sat, 01 Aug 2026 00:00:00 +0000https://brycealanhayes.com/research/spring-auth-bypass/从 DispatcherServlet 的路由匹配源码出发，讲清楚为什么在 Spring 框架下用 getRequestURI/getRequestURL 做鉴权、或用黑名单校验路径，容易被绕过。