Java ControllerAdvice @InitBinder setDisallowedFields 不起作用

已经用spring boot版本2.5.3构建了一个JAVA项目.

由于"Spring4shell"(CVE-2022-22965)的安全风险，我们必须采取缓解措施.

无法升级Spring启动版本，因为其他几个依赖项与最新的Spring启动版本不兼容.

根据指南，建议采取两种变通方法.

1. 通过@ControllerAdvice方法在WebDataBinder上设置不允许的字段

@ControllerAdvice
@Order(Ordered.LOWEST_PRECEDENCE)
public class BinderControllerAdvice {

    @InitBinder
    public void setAllowedFields(WebDataBinder dataBinder) {
         String[] denylist = new String[]{"class.*", "Class.*", "*.class.*", "*.Class.*"};
         dataBinder.setDisallowedFields(denylist);
    }

}

2. 扩展RequestMappingHandlerAdapter以更新WebDataBinder:

@Bean
    public WebMvcRegistrations mvcRegistrations() {
        return new WebMvcRegistrations() {
            @Override
            public RequestMappingHandlerAdapter getRequestMappingHandlerAdapter() {
                return new ExtendedRequestMappingHandlerAdapter();
            }
        };
    }


    private static class ExtendedRequestMappingHandlerAdapter extends RequestMappingHandlerAdapter {

        @Override
        protected InitBinderDataBinderFactory createDataBinderFactory(List<InvocableHandlerMethod> methods) {

            return new ServletRequestDataBinderFactory(methods, getWebBindingInitializer()) {

                @Override
                protected ServletRequestDataBinder createBinderInstance(
                        Object target, String name, NativeWebRequest request) throws Exception {
                    
                    ServletRequestDataBinder binder = super.createBinderInstance(target, name, request);
                    String[] fields = binder.getDisallowedFields();
                    List<String> fieldList = new ArrayList<>(fields != null ? Arrays.asList(fields) : Collections.emptyList());
                    fieldList.addAll(Arrays.asList("class.*", "Class.*", "*.class.*", "*.Class.*"));
                    binder.setDisallowedFields(fieldList.toArray(new String[] {}));
                    return binder;
                }
            };
        }
    }

这两种方法都已try 过，但都无法拒绝以下请求.

主机:端口/路径？班单元类加载器.URL%5B0%5D=0

我们的方法遗漏了什么？