Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2026-03-01 00:24:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add Missing OnCommitedResponseWrapper Header Overrides

Browse Source 
Spring Security's `OnCommitedResponseWrapper` does not override the `setHeader`, `setIntHeader`, `addIntHeader`
methods. This means that if the `Content-Length` response header is specified using any of those methods then
the response body length is not tracked and can be committed before the response headers are written.

Spring Security should override the missing methods and track `Content-Length` as is already done for `addHeader`.

This issue is the underlying problem for spring-projects/spring-framework#36381

Closes gh-18797
This commit is contained in:
Robert Winch 2026-02-24 19:43:37 -06:00
parent bec25edeb0
commit 1dae9aa459
No known key found for this signature in database
2 changed files with 56 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
web/src/main/java/org/springframework/security/web/util/OnCommittedResponseWrapper.java
View File

@ -58,10 +58,38 @@ public abstract class OnCommittedResponseWrapper extends HttpServletResponseWrap
@Override
public void addHeader(String name, String value) {
checkContentLengthHeader(name, value);
super.addHeader(name, value);
}
@Override
public void addIntHeader(String name, int value) {
checkContentLengthHeader(name, value);
super.addIntHeader(name, value);
}
@Override
public void setHeader(String name, String value) {
checkContentLengthHeader(name, value);
super.setHeader(name, value);
}
@Override
public void setIntHeader(String name, int value) {
checkContentLengthHeader(name, value);
super.setIntHeader(name, value);
}
private void checkContentLengthHeader(String name, int value) {
if ("Content-Length".equalsIgnoreCase(name)) {
setContentLength(value);
}
}
private void checkContentLengthHeader(String name, String value) {
if ("Content-Length".equalsIgnoreCase(name)) {
setContentLength(Long.parseLong(value));
}
super.addHeader(name, value);
}
@Override

27
web/src/test/java/org/springframework/security/web/util/OnCommittedResponseWrapperTests.java
View File

@ -1006,6 +1006,33 @@ public class OnCommittedResponseWrapperTests {
assertThat(this.committed).isTrue();
}
@Test
public void addIntHeaderContentLengthPrintWriterWriteStringCommits() throws Exception {
givenGetWriterThenReturn();
int expected = 1234;
this.response.addIntHeader("Content-Length", String.valueOf(expected).length());
this.response.getWriter().write(expected);
assertThat(this.committed).isTrue();
}
@Test
public void setHeaderContentLengthPrintWriterWriteStringCommits() throws Exception {
givenGetWriterThenReturn();
int expected = 1234;
this.response.setHeader("Content-Length", String.valueOf(String.valueOf(expected).length()));
this.response.getWriter().write(expected);
assertThat(this.committed).isTrue();
}
@Test
public void setIntHeaderContentLengthPrintWriterWriteStringCommits() throws Exception {
givenGetWriterThenReturn();
int expected = 1234;
this.response.setIntHeader("Content-Length", String.valueOf(expected).length());
this.response.getWriter().write(expected);
assertThat(this.committed).isTrue();
}
@Test
public void bufferSizePrintWriterWriteCommits() throws Exception {
givenGetWriterThenReturn();