Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-23 12:32:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '6.3.x'

Browse Source
This commit is contained in:
Josh Cummings 2024-05-30 17:52:04 -06:00
commit fbeb82ef62
No known key found for this signature in database
GPG Key ID: A306A51F43B8E5A5
2 changed files with 30 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
web/src/main/java/org/springframework/security/web/util/matcher/IpAddressMatcher.java
View File

@ -18,6 +18,7 @@ package org.springframework.security.web.util.matcher;
import java.net.InetAddress; import java.net.InetAddress;
import java.net.UnknownHostException; import java.net.UnknownHostException;
import java.util.Scanner;
import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletRequest;
@ -47,7 +48,7 @@ public final class IpAddressMatcher implements RequestMatcher {
* come. * come.
*/ */
public IpAddressMatcher(String ipAddress) { public IpAddressMatcher(String ipAddress) {
assertStartsWithHexa(ipAddress); assertNotHostName(ipAddress);
if (ipAddress.indexOf('/') > 0) { if (ipAddress.indexOf('/') > 0) {
String[] addressAndMask = StringUtils.split(ipAddress, "/"); String[] addressAndMask = StringUtils.split(ipAddress, "/");
ipAddress = addressAndMask[0]; ipAddress = addressAndMask[0];
@ -68,7 +69,7 @@ public final class IpAddressMatcher implements RequestMatcher {
} }
public boolean matches(String address) { public boolean matches(String address) {
assertStartsWithHexa(address); assertNotHostName(address);
InetAddress remoteAddress = parseAddress(address); InetAddress remoteAddress = parseAddress(address);
if (!this.requiredAddress.getClass().equals(remoteAddress.getClass())) { if (!this.requiredAddress.getClass().equals(remoteAddress.getClass())) {
return false; return false;
@ -91,11 +92,17 @@ public final class IpAddressMatcher implements RequestMatcher {
return true; return true;
} }
private void assertStartsWithHexa(String ipAddress) { private void assertNotHostName(String ipAddress) {
Assert.isTrue( String error = "ipAddress " + ipAddress + " doesn't look like an IP Address. Is it a host name?";
ipAddress.charAt(0) == '[' || ipAddress.charAt(0) == ':' Assert.isTrue(ipAddress.charAt(0) == '[' || ipAddress.charAt(0) == ':'
|| Character.digit(ipAddress.charAt(0), 16) != -1, || Character.digit(ipAddress.charAt(0), 16) != -1, error);
"ipAddress must start with a [, :, or a hexadecimal digit"); if (!ipAddress.contains(":")) {
Scanner parts = new Scanner(ipAddress);
parts.useDelimiter("[./]");
while (parts.hasNext()) {
Assert.isTrue(parts.hasNextInt() && parts.nextInt() >> 8 == 0, error);
}
}
} }
private InetAddress parseAddress(String address) { private InetAddress parseAddress(String address) {

17
web/src/test/java/org/springframework/security/web/util/matcher/IpAddressMatcherTests.java
View File

@ -22,6 +22,7 @@ import org.junit.jupiter.api.Test;
import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.mock.web.MockHttpServletRequest;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatException;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException; import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
/** /**
@ -108,7 +109,21 @@ public class IpAddressMatcherTests {
@Test @Test
public void invalidAddressThenIllegalArgumentException() { public void invalidAddressThenIllegalArgumentException() {
assertThatIllegalArgumentException().isThrownBy(() -> new IpAddressMatcher("invalid-ip")) assertThatIllegalArgumentException().isThrownBy(() -> new IpAddressMatcher("invalid-ip"))
.withMessage("ipAddress must start with a [, :, or a hexadecimal digit"); .withMessage("ipAddress invalid-ip doesn't look like an IP Address. Is it a host name?");
}
// gh-15172
@Test
public void hexadecimalDomainNameThenIllegalArgumentException() {
assertThatException().isThrownBy(() -> new IpAddressMatcher("deadbeef.abc"))
.withMessage("ipAddress deadbeef.abc doesn't look like an IP Address. Is it a host name?");
}
// gh-15172
@Test
public void numericDomainNameThenIllegalArgumentException() {
assertThatException().isThrownBy(() -> new IpAddressMatcher("123.156.7.18.org"))
.withMessage("ipAddress 123.156.7.18.org doesn't look like an IP Address. Is it a host name?");
} }
} }