import { jsPDF } from "jspdf";

const doc = new jsPDF();

doc.addImage("../secret.txt", "JPEG", 0, 0, 10, 10);
doc.save("test.pdf"); 

this.isToLogin(req, res)
private boolean isToLogin(HttpServletRequest req, HttpServletResponse res) {  
 
    String pageId = req.getParameter("pageId");  
 
    return pageId != null && (pageId.equals("login") || pageId.equals("passwordmng"));  
 
}

 public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {  

    PortalLogger.debug((String)LfwResBundle.getInstance().getStrByID("ds", "AbstractLfwLoginFilter-000000"));  

    HttpServletRequest req = (HttpServletRequest)request;  

    HttpServletResponse res = (HttpServletResponse)response;  

    WebContext webCtx = LfwRuntimeEnvironment.getWebContext();  

    String currentUrl = req.getRequestURI();  

    String loginURL = this.getLoginJspName();  

    if (webCtx != null) {  

        LfwRuntimeEnvironment.getWebContext().setResponse(res);  

    }  

在上述逻辑下，攻击者可通过在请求参数中加入配置文件中定义的免鉴权路径关键字，使请求 URL 命中免鉴权规则，从而导致鉴权绕过。