@Valid @RequestBody 无法验证输入错误的传入 Json

Question

我想验证传入的 RequestBody。我的控制器 API 是，

\n\n

@RequestMapping(value = {\n        POSRequest.REQUEST_SEPARATOR + Request.UPDATE_URL,\n        method = RequestMethod.PUT,\n        produces = MediaType.APPLICATION_JSON_VALUE)\n@ApiOperation(value = "Update .\xe2\x80\x9d,\n        response = SuccessResponseDTO.class, ,\n        produces = "application/json", httpMethod = "PUT")\n@ApiResponses(value = {\n        @ApiResponse(code = 200, message = "OK",response = SuccessResponseDTO.class),\n        @ApiResponse(code = 401, message = "Unauthorized",response =ErrorResponseDTO.class),\n        @ApiResponse(code = 403, message = "Forbidden",response = ErrorResponseDTO.class),\n        @ApiResponse(code = 404, message = "Not Found",response = ErrorResponseDTO.class)\n})\npublic @ResponseBody\nSuccessResponseDTO update(HttpServletRequest request,\n                             @ApiParam(required = true, type = "String", value = " ") @RequestParam(value = \xe2\x80\x9cid\xe2\x80\x9d, required = true) String id,\n                             @ApiParam(required = true, type = "String", value = "  ") @RequestParam(value = "documentNumber", required = true) String documentNumber,\n                             @ApiParam(required = true, type = "String", value = " ") @RequestParam(value = \xe2\x80\x9cSid\xe2\x80\x9d, required = true) String sid,\n                             @ApiParam(required = true, type = "UpdateDTO", value = "Update payload json ")  @Valid @RequestBody UpdateDTO pdatePayload) throws IOException {\n    authorizeRequest(request, anId);\n    UpdateDTO posDTO = UpdatePayload;\n    UpdateAction<UpdateDTO> action = new UpdateAction(Constants.ACTION_UPDATE, DTO, principal);\n    action.addAdditionalParams(Constants.KEY_INPUT_DOC_NUMBER, documentNumber);\n    action.addAdditionalParams(Constants.KEY_INPUT_SUPPLIER_AN_ID, sid);\n    Gson gson = new Gson();\n    action.addAdditionalParams(Constants.CONTENT, gson.toJson(DTO));\n    return updateService.update(action);\n}\n

\n\n

我正在使用注释@Valid，@RequestBody期望它能够验证输入 JSON。用户发送非映射属性的无效输入 JSON 正在传递，API只是忽略非映射字段而不会出现任何错误。

\n\n

例如， UpdateDTO包含setter和getter用于字段字符串名称、字符串状态。

\n\n

用户请求包含无效字段，

\n\n

{\n"name":"my update",\n"invalid_field":"abc"\n}\n

\n\n

转换为UpdateDTO和非映射字段将被忽略。我预计它会因输入无效而出错。

\n\n

你能给我推荐一下吗？我怎样才能让它发挥作用？如果您需要任何意见，请告诉我

\n\n

我已经包含了以下 Maven 依赖项，

\n\n

<dependencies>\n    <dependency>\n        <groupId>org.springframework</groupId>\n        <artifactId>spring-context</artifactId>\n    </dependency>\n    <dependency>\n        <groupId>org.springframework</groupId>\n        <artifactId>spring-web</artifactId>\n    </dependency>\n    <dependency>\n        <groupId>org.springframework.boot</groupId>\n        <artifactId>spring-boot-starter-web</artifactId>\n    </dependency>\n    <dependency>\n        <groupId>org.springframework</groupId>\n        <artifactId>spring-beans</artifactId>\n    </dependency>\n    <dependency>\n        <groupId>org.springframework.security</groupId>\n        <artifactId>spring-security-core</artifactId>\n    </dependency>\n    <dependency>\n        <groupId>io.springfox</groupId>\n        <artifactId>springfox-swagger2</artifactId>\n        <version>2.8.0</version>\n    </dependency>\n    <dependency>\n        <groupId>io.springfox</groupId>\n        <artifactId>springfox-swagger-ui</artifactId>\n        <version>2.8.0</version>\n    </dependency>\n</dependencies>\n

\n

Answer 1

您误解了 的用法@Valid。该@Valid注释用于根据JSR 380 规范@NotNull验证带有、@Size等约束的 bean 。例如，如果您想对类的字段进行验证，使其永远不为空，则可以在该字段上使用，然后在控制器方法中的对象上使用。这将确保每当在未传递字段的情况下发出请求时，验证都会失败并相应地抛出异常。@MinnameUpdateDTOname@NotNullname@ValidUpdateDTOname

对于您希望在发送未知字段作为请求的一部分时引发异常的用例，由于您使用的是 spring-boot，它使用 Jackson 进行序列化/反序列化，因此您只需要提供一个配置来启用反序列化失败遇到未知的属性。这可以通过以下属性启用它来完成：

spring.jackson.deserialization.FAIL_ON_UNKNOWN_PROPERTIES=true

或者定义 a@Bean如下：

@Bean
public ObjectMapper objectMapper() {
    return Jackson2ObjectMapperBuilder
            .json()
            .featuresToEnable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
            .build();
}