Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-01 09:42:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Polish StrictHttpFirewall Javadoc

Browse Source 
Also cleanup DefaultHttpFirewall Javadoc

Issue: gh-5008
This commit is contained in:
Rob Winch 2018-02-15 17:12:55 -06:00
parent 52b5423b75
commit 0fc67f765a
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
web/src/main/java/org/springframework/security/web/firewall/DefaultHttpFirewall.java
View File

@ -19,6 +19,11 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpServletResponse;
/** /**
* <p>
* User's should consider using {@link StrictHttpFirewall} because rather than trying to
* sanitize a malicious URL it rejects the malicious URL providing better security
* guarantees.
* <p>
* Default implementation which wraps requests in order to provide consistent * Default implementation which wraps requests in order to provide consistent
* values of the {@code servletPath} and {@code pathInfo}, which do not contain * values of the {@code servletPath} and {@code pathInfo}, which do not contain
* path parameters (as defined in * path parameters (as defined in
@ -37,10 +42,9 @@ import javax.servlet.http.HttpServletResponse;
* containers normalize the paths before performing the servlet-mapping, but * containers normalize the paths before performing the servlet-mapping, but
* again this is not guaranteed by the servlet spec. * again this is not guaranteed by the servlet spec.
* *
* @deprecated Use {@link StrictHttpFirewall} instead
* @author Luke Taylor * @author Luke Taylor
* @see StrictHttpFirewall
*/ */
@Deprecated
public class DefaultHttpFirewall implements HttpFirewall { public class DefaultHttpFirewall implements HttpFirewall {
private boolean allowUrlEncodedSlash; private boolean allowUrlEncodedSlash;

5
web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java
View File

@ -95,8 +95,9 @@ public class StrictHttpFirewall implements HttpFirewall {
/** /**
* <p> * <p>
* Determines if semicolon is allowed in the URL (i.e. matrix variables). The default * Determines if semicolon is allowed in the URL (i.e. matrix variables). The default
* is to disable this behavior because it is a common way of attempting to bypass URL * is to disable this behavior because it is a common way of attempting to perform
* based security. * <a href="https://www.owasp.org/index.php/Reflected_File_Download">Reflected File Download Attacks</a>.
* It is also the source of many exploits which bypass URL based security.
* </p> * </p>
* <p>For example, the following CVEs are a subset of the issues related * <p>For example, the following CVEs are a subset of the issues related
* to ambiguities in the Servlet Specification on how to treat semicolons that * to ambiguities in the Servlet Specification on how to treat semicolons that