Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Replace Existing Continue Parameter 

Closes gh-13438
This commit is contained in:
Josh Cummings 2023-07-10 16:12:05 -06:00
parent 8895a66a2b
commit 40d61743b9
No known key found for this signature in database
GPG Key ID: A306A51F43B8E5A5
2 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
web/src/main/java/org/springframework/security/web/savedrequest/DefaultSavedRequest.java
View File

@ -38,6 +38,7 @@ import org.springframework.security.web.PortResolver;
import org.springframework.security.web.util.UrlUtils;
import org.springframework.util.Assert;
import org.springframework.util.ObjectUtils;
import org.springframework.web.util.UriComponentsBuilder;
/**
* Represents central information from a {@code HttpServletRequest}.
@ -372,10 +373,8 @@ public class DefaultSavedRequest implements SavedRequest {
if (queryString == null || queryString.length() == 0) {
return matchingRequestParameterName;
}
if (queryString.endsWith("&")) {
return queryString + matchingRequestParameterName;
}
return queryString + "&" + matchingRequestParameterName;
return UriComponentsBuilder.newInstance().query(queryString).replaceQueryParam(matchingRequestParameterName)
.queryParam(matchingRequestParameterName).build().getQuery();
}
/**

10
web/src/test/java/org/springframework/security/web/savedrequest/DefaultSavedRequestTests.java
View File

@ -122,4 +122,14 @@ public class DefaultSavedRequestTests {
assertThat(new URL(savedRequest.getRedirectUrl())).hasQuery("foo=bar&success");
}
// gh-13438
@Test
public void getRedirectUrlWhenQueryAlreadyHasSuccessThenDoesNotAdd() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setQueryString("foo=bar&success");
DefaultSavedRequest savedRequest = new DefaultSavedRequest(request, new MockPortResolver(8080, 8443),
"success");
assertThat(savedRequest.getRedirectUrl()).contains("foo=bar&success");
}
}