Body - Code Search

src/main/webapp/WEB-INF/view/admin/dict/kuromoji/admin_dict_kuromoji.jsp

    <title><la:message key="labels.admin_brand_title"/> | <la:message
            key="labels.dict_kuromoji_configuration"/></title>
    <jsp:include page="/WEB-INF/view/common/admin/head.jsp"></jsp:include>
</head>
<body class="hold-transition sidebar-mini">
<div class="wrapper">
    <jsp:include page="/WEB-INF/view/common/admin/header.jsp"></jsp:include>
    <jsp:include page="/WEB-INF/view/common/admin/sidebar.jsp">

Created: Tue Mar 31 13:07:34 GMT 2026

- Last Modified: Mon Feb 23 08:03:44 GMT 2026

- 10.2K bytes

- Click Count (0)

github.com/tiangolo/fastapi

docs/zh/docs/advanced/strict-content-type.md

## CSRF 风险 { #csrf-risk }

此默认行为在一个非常特定的场景下，可防御一类跨站请求伪造（CSRF）攻击。

这类攻击利用了浏览器的一个事实：当请求满足以下条件时，浏览器允许脚本在不进行任何 CORS 预检的情况下直接发送请求：

- 没有 `Content-Type` 头（例如使用 `fetch()` 携带 `Blob` 作为 body）
- 且不发送任何认证凭据。

这种攻击主要在以下情况下相关：

- 应用在本地（如 `localhost`）或内网中运行
- 且应用没有任何认证，假定来自同一网络的请求都可信。

## 攻击示例 { #example-attack }

假设你构建了一个本地运行的 AI 代理。

它提供了一个 API，地址为

```

Created: Sun Apr 05 07:19:11 GMT 2026

- Last Modified: Fri Mar 20 14:29:48 GMT 2026

- 3K bytes

- Click Count (0)

github.com/minio/minio

cmd/object-handlers_test.go

			t.Fatalf("Case %d: Expected the response status to be `%d`, but instead found `%d`", i+1, testCase.expectedRespStatus, rec.Code)
		}
		// read the response body.
		actualContent, err := io.ReadAll(rec.Body)
		if err != nil {
			t.Fatalf("Test %d: %s: Failed reading response body: <ERROR> %v", i+1, instanceType, err)
		}

		if rec.Code == http.StatusOK || rec.Code == http.StatusPartialContent {

Created: Sun Apr 05 19:28:12 GMT 2026

- Last Modified: Sun Sep 28 20:59:21 GMT 2025

- 163.1K bytes

- Click Count (0)

github.com/square/okhttp

okhttp/src/commonJvmAndroid/kotlin/okhttp3/internal/http/ExchangeCodec.kt

  val carrier: Carrier

  /** Returns true if the response body and (possibly empty) trailers have been received. */
  val isResponseComplete: Boolean

  /** The socket that carries this exchange. */
  val socket: Socket

  /** Returns an output stream where the request body can be streamed. */
  @Throws(IOException::class)
  fun createRequestBody(
    request: Request,

Created: Fri Apr 03 11:42:14 GMT 2026

- Last Modified: Tue Jul 29 21:11:09 GMT 2025

- 3.3K bytes

- Click Count (0)

github.com/codelibs/fess

src/main/java/org/codelibs/fess/app/web/api/admin/dict/kuromoji/EditBody.java

 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.app.web.api.admin.dict.kuromoji;

import org.codelibs.fess.app.web.admin.dict.kuromoji.EditForm;

/**
 * Request body class for Kuromoji dictionary edit operations in the admin REST API.
 * This class extends EditForm to inherit the necessary form validation and binding capabilities
 * for Kuromoji dictionary management operations.
 */

Created: Tue Mar 31 13:07:34 GMT 2026

- Last Modified: Thu Jul 17 08:28:31 GMT 2025

- 1.1K bytes

- Click Count (0)

github.com/codelibs/fess

src/main/java/org/codelibs/fess/app/web/api/admin/dict/stopwords/EditBody.java

 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.app.web.api.admin.dict.stopwords;

import org.codelibs.fess.app.web.admin.dict.stopwords.EditForm;

/**
 * Request body class for stop words dictionary edit operations in the admin REST API.
 * This class extends EditForm to inherit the necessary form validation and binding capabilities
 * for stop words dictionary management operations.
 */

Created: Tue Mar 31 13:07:34 GMT 2026

- Last Modified: Thu Jul 17 08:28:31 GMT 2025

- 1.1K bytes

- Click Count (0)

github.com/codelibs/fess

src/test/java/org/codelibs/fess/it/admin/dict/DictCrudTestBase.java

    }

    @Override
    protected List<String> getIdList(final Map<String, Object> body) {
        String response = checkGetMethod(body, getListEndpointSuffix()).asString();
        List<Object> objList = JsonPath.from(response).getList(getJsonPath() + "." + getIdKey());
        List<String> ret = new ArrayList<>();

Created: Tue Mar 31 13:07:34 GMT 2026

- Last Modified: Sat Mar 15 06:53:53 GMT 2025

- 3.3K bytes

- Click Count (0)

github.com/tiangolo/fastapi

docs/en/docs/advanced/using-request-directly.md

It would also mean that if you get data from the `Request` object directly (for example, read the body) it won't be validated, converted or documented (with OpenAPI, for the automatic API user interface) by FastAPI.

Although any other parameter declared normally (for example, the body with a Pydantic model) would still be validated, converted, annotated, etc.

Created: Sun Apr 05 07:19:11 GMT 2026

- Last Modified: Thu Mar 05 18:13:19 GMT 2026

- 2.3K bytes

- Click Count (0)

github.com/tiangolo/fastapi

docs/zh-hant/docs/advanced/strict-content-type.md

預設情況下，FastAPI 會對 JSON 請求主體使用嚴格的 `Content-Type` 標頭檢查。也就是說，JSON 請求必須包含有效的 `Content-Type` 標頭（例如 `application/json`），請求主體（body）才能被解析為 JSON。

## CSRF 風險 { #csrf-risk }

這個預設行為在某個非常特定的情境下，能對一類跨站請求偽造（CSRF, Cross-Site Request Forgery）攻擊提供保護。

這類攻擊利用了瀏覽器在以下情況下允許腳本發送請求而不進行任何 CORS 預檢（preflight）檢查的事實：

- 沒有 `Content-Type` 標頭（例如以 `fetch()` 並使用 `Blob` 作為 body）
- 且沒有送出任何身分驗證憑證

這種攻擊主要與以下情境相關：

- 應用在本機（例如 `localhost`）或內部網路中執行

Created: Sun Apr 05 07:19:11 GMT 2026

- Last Modified: Fri Mar 20 14:33:04 GMT 2026

- 3.1K bytes

- Click Count (0)

github.com/codelibs/fess

src/main/java/org/codelibs/fess/app/web/api/admin/dict/ListBody.java

 */
package org.codelibs.fess.app.web.api.admin.dict;

import java.util.Date;

import org.codelibs.fess.app.web.admin.dict.ListForm;

/**
 * The request body for listing dictionaries.
 */
public class ListBody extends ListForm {
    /**
     * Default constructor.
     */
    public ListBody() {
        super();
    }

    /** The ID of the dictionary. */

Created: Tue Mar 31 13:07:34 GMT 2026

- Last Modified: Thu Jul 17 08:28:31 GMT 2025

- 1.2K bytes

- Click Count (0)

Search Options