Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-01 09:42:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '6.3.x' into 6.4.x

Browse Source 
Closes gh-17032
This commit is contained in:
Josh Cummings 2025-05-02 10:57:55 -06:00
commit 57fc29e614
No known key found for this signature in database
GPG Key ID: 869B37A20E876129
2 changed files with 23 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
web/src/main/java/org/springframework/security/web/server/firewall/StrictServerWebExchangeFirewall.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2024 the original author or authors. * Copyright 2002-2025 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -802,42 +802,42 @@ public class StrictServerWebExchangeFirewall implements ServerWebExchangeFirewal
@Override @Override
public Builder method(HttpMethod httpMethod) { public Builder method(HttpMethod httpMethod) {
return this.delegate.method(httpMethod); return new StrictFirewallBuilder(this.delegate.method(httpMethod));
} }
@Override @Override
public Builder uri(URI uri) { public Builder uri(URI uri) {
return this.delegate.uri(uri); return new StrictFirewallBuilder(this.delegate.uri(uri));
} }
@Override @Override
public Builder path(String path) { public Builder path(String path) {
return this.delegate.path(path); return new StrictFirewallBuilder(this.delegate.path(path));
} }
@Override @Override
public Builder contextPath(String contextPath) { public Builder contextPath(String contextPath) {
return this.delegate.contextPath(contextPath); return new StrictFirewallBuilder(this.delegate.contextPath(contextPath));
} }
@Override @Override
public Builder header(String headerName, String... headerValues) { public Builder header(String headerName, String... headerValues) {
return this.delegate.header(headerName, headerValues); return new StrictFirewallBuilder(this.delegate.header(headerName, headerValues));
} }
@Override @Override
public Builder headers(Consumer<HttpHeaders> headersConsumer) { public Builder headers(Consumer<HttpHeaders> headersConsumer) {
return this.delegate.headers(headersConsumer); return new StrictFirewallBuilder(this.delegate.headers(headersConsumer));
} }
@Override @Override
public Builder sslInfo(SslInfo sslInfo) { public Builder sslInfo(SslInfo sslInfo) {
return this.delegate.sslInfo(sslInfo); return new StrictFirewallBuilder(this.delegate.sslInfo(sslInfo));
} }
@Override @Override
public Builder remoteAddress(InetSocketAddress remoteAddress) { public Builder remoteAddress(InetSocketAddress remoteAddress) {
return this.delegate.remoteAddress(remoteAddress); return new StrictFirewallBuilder(this.delegate.remoteAddress(remoteAddress));
} }
@Override @Override

15
web/src/test/java/org/springframework/security/web/server/firewall/StrictServerWebExchangeFirewallTests.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2024 the original author or authors. * Copyright 2002-2025 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -534,4 +534,17 @@ class StrictServerWebExchangeFirewallTests {
.isThrownBy(() -> headers.get(invalidHeaderName)); .isThrownBy(() -> headers.get(invalidHeaderName));
} }
// gh-16978
@Test
void getMutatedFirewalledExchangeHeadersGetHeaderWhenNotAllowedHeaderNameThenException() {
String invalidHeaderName = "bad name";
this.firewall.setAllowedHeaderNames((name) -> !name.equals(invalidHeaderName));
ServerWebExchange exchange = getFirewalledExchange();
var mutatedRequest = exchange.getRequest().mutate().method(HttpMethod.POST).build();
var mutatedExchange = exchange.mutate().request(mutatedRequest).build();
HttpHeaders headers = mutatedExchange.getRequest().getHeaders();
assertThatExceptionOfType(ServerExchangeRejectedException.class)
.isThrownBy(() -> headers.get(invalidHeaderName));
}
} }