Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-28 14:52:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #244 from panchenko/SEC-3164

Browse Source 
SEC-3164 Optimization in DefaultRequiresCsrfMatcher
This commit is contained in:
Rob Winch 2015-12-02 14:10:04 -06:00
commit 3cc085bcdd
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
web/src/main/java/org/springframework/security/web/csrf/CsrfFilter.java
View File

@ -16,7 +16,8 @@
package org.springframework.security.web.csrf; package org.springframework.security.web.csrf;
import java.io.IOException; import java.io.IOException;
import java.util.regex.Pattern; import java.util.Arrays;
import java.util.HashSet;
import javax.servlet.FilterChain; import javax.servlet.FilterChain;
import javax.servlet.ServletException; import javax.servlet.ServletException;
@ -62,7 +63,7 @@ public final class CsrfFilter extends OncePerRequestFilter {
private final Log logger = LogFactory.getLog(getClass()); private final Log logger = LogFactory.getLog(getClass());
private final CsrfTokenRepository tokenRepository; private final CsrfTokenRepository tokenRepository;
private RequestMatcher requireCsrfProtectionMatcher = new DefaultRequiresCsrfMatcher(); private RequestMatcher requireCsrfProtectionMatcher = DEFAULT_CSRF_MATCHER;
private AccessDeniedHandler accessDeniedHandler = new AccessDeniedHandlerImpl(); private AccessDeniedHandler accessDeniedHandler = new AccessDeniedHandlerImpl();
public CsrfFilter(CsrfTokenRepository csrfTokenRepository) { public CsrfFilter(CsrfTokenRepository csrfTokenRepository) {
@ -235,7 +236,7 @@ public final class CsrfFilter extends OncePerRequestFilter {
} }
private static final class DefaultRequiresCsrfMatcher implements RequestMatcher { private static final class DefaultRequiresCsrfMatcher implements RequestMatcher {
private Pattern allowedMethods = Pattern.compile("^(GET|HEAD|TRACE|OPTIONS)$"); private final HashSet<String> allowedMethods = new HashSet<>(Arrays.asList("GET", "HEAD", "TRACE", "OPTIONS"));
/* /*
* (non-Javadoc) * (non-Javadoc)
@ -245,7 +246,7 @@ public final class CsrfFilter extends OncePerRequestFilter {
* servlet.http.HttpServletRequest) * servlet.http.HttpServletRequest)
*/ */
public boolean matches(HttpServletRequest request) { public boolean matches(HttpServletRequest request) {
return !allowedMethods.matcher(request.getMethod()).matches(); return !allowedMethods.contains(request.getMethod());
} }
} }
} }