@RequestMapping("/admin/{value}")
    public String CVE_2022_40664_bypass(@PathVariable String value, HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        System.out.println("=========== /admin" +((HttpServletRequest)request).getRequestURI()+ "/ ===========");
        //        request.getRequestDispatcher("/admin/auth").forward(request, response);
        //        return "forward:"+((HttpServletRequest)request).getRequestURI();
        response.sendRedirect("/admin/auth");
        return ("Redirect:/admin/auth");
    }

request.getRequestDispatcher("/admin/auth").forward(request, response);

@Bean
public MyShiroFilterFactoryBean filterRegBean(SecurityManager securityManager) throws Exception{
        // CVE-2022-40664
        // fixed conf
        ShiroFilterConfiguration conf=new ShiroFilterConfiguration();
        conf.setFilterOncePerRequest(false);

        ShiroFilterFactoryBean shiroFilterFactoryBean=new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        shiroFilterFactoryBean.setShiroFilterConfiguration(conf);
        AbstractShiroFilter filter=shiroFilterFactoryBean.getObject();

        MyShiroFilterFactoryBean reg=new MyShiroFilterFactoryBean();
        reg.setFilter(filter);
        reg.addUrlPattern("/*");
        reg.setName("shiroFilter");
        reg.setSecurityManager(securityManager);
        reg.setDispatcherTypes(EnumSet.allOf(DispatcherType.class));
        //fixed conf end.
        return reg;
        }