Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-07-13 13:53:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix NPE in UrlUtils with null url

Browse Source 
Fixes gh-4233
This commit is contained in:
Rob Winch 2017-03-02 00:46:01 -06:00
parent 49719480a8
commit 017e9834bd
2 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
web/src/main/java/org/springframework/security/web/util/UrlUtils.java
View File

@ -129,7 +129,7 @@ public final class UrlUtils {
* Returns true if the supplied URL starts with a "/" or is absolute. * Returns true if the supplied URL starts with a "/" or is absolute.
*/ */
public static boolean isValidRedirectUrl(String url) { public static boolean isValidRedirectUrl(String url) {
return url != null && url.startsWith("/") || isAbsoluteUrl(url); return url != null && (url.startsWith("/") || isAbsoluteUrl(url));
} }
/** /**
@ -137,6 +137,9 @@ public final class UrlUtils {
* defined in RFC 1738. * defined in RFC 1738.
*/ */
public static boolean isAbsoluteUrl(String url) { public static boolean isAbsoluteUrl(String url) {
if(url == null) {
return false;
}
final Pattern ABSOLUTE_URL = Pattern.compile("\\A[a-z0-9.+-]+://.*", final Pattern ABSOLUTE_URL = Pattern.compile("\\A[a-z0-9.+-]+://.*",
Pattern.CASE_INSENSITIVE); Pattern.CASE_INSENSITIVE);

20
web/src/test/java/org/springframework/security/web/util/UrlUtilsTests.java
View File

@ -35,4 +35,24 @@ public class UrlUtilsTests {
assertThat(UrlUtils.isAbsoluteUrl("zz+zz.zz-zz://something/")).isTrue(); assertThat(UrlUtils.isAbsoluteUrl("zz+zz.zz-zz://something/")).isTrue();
} }
@Test
public void isAbsoluteUrlWhenNullThenFalse() {
assertThat(UrlUtils.isAbsoluteUrl(null)).isFalse();
}
@Test
public void isAbsoluteUrlWhenEmptyThenFalse() {
assertThat(UrlUtils.isAbsoluteUrl("")).isFalse();
}
@Test
public void isValidRedirectUrlWhenNullThenFalse() {
assertThat(UrlUtils.isValidRedirectUrl(null)).isFalse();
}
@Test
public void isValidRedirectUrlWhenEmptyThenFalse() {
assertThat(UrlUtils.isValidRedirectUrl("")).isFalse();
}
} }