Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixes: gh-5190

This commit is contained in:
Rob Winch 2018-04-16 17:51:35 -05:00
parent 6095340e93
commit afdefe7b13
2 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java
View File

@ -314,7 +314,7 @@ public class StrictHttpFirewall implements HttpFirewall {
int length = uri.length();
for (int i = 0; i < length; i++) {
char c = uri.charAt(i);
if (c < '\u0021' || '\u007e' < c) {
if (c < '\u0020' || c > '\u007e') {
return false;
}
}

24
web/src/test/java/org/springframework/security/web/firewall/StrictHttpFirewallTests.java
View File

@ -297,6 +297,30 @@ public class StrictHttpFirewallTests {
this.firewall.getFirewalledRequest(this.request);
}
@Test(expected = RequestRejectedException.class)
public void getFirewalledRequestWhenExceedsLowerboundAsciiThenException() {
this.request.setRequestURI("/\u0019");
this.firewall.getFirewalledRequest(this.request);
}
@Test
public void getFirewalledRequestWhenContainsLowerboundAsciiThenNoException() {
this.request.setRequestURI("/ ");
this.firewall.getFirewalledRequest(this.request);
}
@Test
public void getFirewalledRequestWhenContainsUpperboundAsciiThenNoException() {
this.request.setRequestURI("/~");
this.firewall.getFirewalledRequest(this.request);
}
@Test(expected = RequestRejectedException.class)
public void getFirewalledRequestWhenExceedsUpperboundAsciiThenException() {
this.request.setRequestURI("/\u007f");
this.firewall.getFirewalledRequest(this.request);
}
// --- from DefaultHttpFirewallTests ---
/**