> attack vector

- 权限绕过: getRequestURI() + getServletPath()
- 权限绕过: RequestDispatcher methods
- 条件竞争