From b03f8905679838c108a3de9a1ca0f649d8877b98 Mon Sep 17 00:00:00 2001 From: Phillip Webb Date: Wed, 30 May 2018 11:14:26 -0700 Subject: [PATCH 1/4] Upgrade to spring-javaformat 0.0.2 --- spring-boot-dependencies/pom.xml | 5 ++--- spring-boot-parent/pom.xml | 7 +------ spring-boot-samples/pom.xml | 2 +- spring-boot-samples/spring-boot-sample-ant/pom.xml | 9 ++++----- spring-boot-starters/spring-boot-starter-parent/pom.xml | 7 +++---- 5 files changed, 11 insertions(+), 19 deletions(-) diff --git a/spring-boot-dependencies/pom.xml b/spring-boot-dependencies/pom.xml index 47a0a94362..e6ac988c64 100644 --- a/spring-boot-dependencies/pom.xml +++ b/spring-boot-dependencies/pom.xml @@ -1,5 +1,4 @@ - - + 4.0.0 org.springframework.boot spring-boot-dependencies @@ -3258,4 +3257,4 @@ integration-test - + \ No newline at end of file diff --git a/spring-boot-parent/pom.xml b/spring-boot-parent/pom.xml index 4df432ffb7..d1402a2947 100644 --- a/spring-boot-parent/pom.xml +++ b/spring-boot-parent/pom.xml @@ -26,7 +26,7 @@ UTF-8 UTF-8 3.1.1 - 0.0.1 + 0.0.2 http://github.com/spring-projects/spring-boot @@ -506,11 +506,6 @@ io.spring.javaformat spring-javaformat-maven-plugin ${spring-javaformat.version} - - - **/HelpMojo.java - - validate diff --git a/spring-boot-samples/pom.xml b/spring-boot-samples/pom.xml index 14263d5858..524abeedd2 100644 --- a/spring-boot-samples/pom.xml +++ b/spring-boot-samples/pom.xml @@ -21,7 +21,7 @@ ${basedir}/.. 1.8 - 0.0.1 + 0.0.2 spring-boot-sample-ant diff --git a/spring-boot-samples/spring-boot-sample-ant/pom.xml b/spring-boot-samples/spring-boot-sample-ant/pom.xml index 8452b89d13..6274590f93 100644 --- a/spring-boot-samples/spring-boot-sample-ant/pom.xml +++ b/spring-boot-samples/spring-boot-sample-ant/pom.xml @@ -1,5 +1,4 @@ - - + 4.0.0 @@ -62,8 +61,8 @@ package - - + + @@ -103,4 +102,4 @@ - + \ No newline at end of file diff --git a/spring-boot-starters/spring-boot-starter-parent/pom.xml b/spring-boot-starters/spring-boot-starter-parent/pom.xml index 1516f021c0..813e6e6dff 100644 --- a/spring-boot-starters/spring-boot-starter-parent/pom.xml +++ b/spring-boot-starters/spring-boot-starter-parent/pom.xml @@ -1,5 +1,4 @@ - - + 4.0.0 org.springframework.boot @@ -206,7 +205,7 @@ META-INF/spring.schemas - + ${start-class} @@ -218,4 +217,4 @@ - + \ No newline at end of file From 4d84933ee46ae6095bd916819c7b38f3706f006e Mon Sep 17 00:00:00 2001 From: Phillip Webb Date: Wed, 30 May 2018 12:02:46 -0700 Subject: [PATCH 2/4] Also call setHttpOnly property on Tomcat context Update `ServerProperties` to also call `setHttpOnly` on the `TomcatContext`. It appears that this is required in addition to using the `ServletContextInitializer` to setup `SessionCookieConfig`. Closes gh-12580 --- .../boot/autoconfigure/web/ServerProperties.java | 11 +++++++++++ .../autoconfigure/web/ServerPropertiesTests.java | 14 ++++++++++++++ 2 files changed, 25 insertions(+) diff --git a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java index 1ad128448c..fe8dac9a37 100644 --- a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java +++ b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java @@ -864,6 +864,17 @@ public class ServerProperties .getIncludeStacktrace() == ErrorProperties.IncludeStacktrace.NEVER) { customizeErrorReportValve(factory); } + Cookie cookie = serverProperties.getSession().getCookie(); + if (cookie.getHttpOnly() != null) { + factory.addContextCustomizers(new TomcatContextCustomizer() { + + @Override + public void customize(Context context) { + context.setUseHttpOnly(cookie.getHttpOnly()); + } + + }); + } } private void customizeErrorReportValve( diff --git a/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java b/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java index c15666133b..571af472e7 100644 --- a/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java +++ b/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java @@ -32,6 +32,8 @@ import javax.servlet.SessionTrackingMode; import org.apache.catalina.Context; import org.apache.catalina.Valve; +import org.apache.catalina.core.StandardContext; +import org.apache.catalina.startup.Tomcat; import org.apache.catalina.valves.AccessLogValve; import org.apache.catalina.valves.ErrorReportValve; import org.apache.catalina.valves.RemoteIpValve; @@ -734,6 +736,18 @@ public class ServerPropertiesTests { "spring-boot-*.jar"); } + @Test + public void customTomcatHttpOnlyCookie() throws Exception { + this.properties.getSession().getCookie().setHttpOnly(false); + TomcatEmbeddedServletContainerFactory factory = new TomcatEmbeddedServletContainerFactory(); + this.properties.customize(factory); + EmbeddedServletContainer container = factory.getEmbeddedServletContainer(); + Tomcat tomcat = ((TomcatEmbeddedServletContainer) container).getTomcat(); + StandardContext context = (StandardContext) tomcat.getHost().findChildren()[0]; + assertThat(context.getUseHttpOnly()).isFalse(); + container.stop(); + } + @Test public void defaultUseForwardHeadersUndertow() throws Exception { UndertowEmbeddedServletContainerFactory container = spy( From 09fa1e7e117fdf810a04f80d1865069c54e60830 Mon Sep 17 00:00:00 2001 From: Phillip Webb Date: Wed, 30 May 2018 12:11:44 -0700 Subject: [PATCH 3/4] Polish --- .../boot/autoconfigure/condition/OnExpressionCondition.java | 6 ++---- .../boot/gradle/plugin/SinglePublishedArtifact.java | 2 +- .../sample/atmosphere/SampleAtmosphereApplicationTests.java | 2 +- .../src/main/java/sample/MessageController.java | 2 +- .../echo/CustomContainerWebSocketsApplicationTests.java | 2 +- .../websocket/tomcat/SampleWebSocketsApplicationTests.java | 2 +- .../echo/CustomContainerWebSocketsApplicationTests.java | 2 +- .../undertow/SampleWebSocketsApplicationTests.java | 2 +- .../echo/CustomContainerWebSocketsApplicationTests.java | 2 +- 9 files changed, 10 insertions(+), 12 deletions(-) diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/condition/OnExpressionCondition.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/condition/OnExpressionCondition.java index dfba242844..c6dde2b2ed 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/condition/OnExpressionCondition.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/condition/OnExpressionCondition.java @@ -51,10 +51,8 @@ class OnExpressionCondition extends SpringBootCondition { boolean result = evaluateExpression(beanFactory, expression); return new ConditionOutcome(result, messageBuilder.resultedIn(result)); } - else { - return ConditionOutcome - .noMatch(messageBuilder.because("no BeanFactory available.")); - } + return ConditionOutcome + .noMatch(messageBuilder.because("no BeanFactory available.")); } private Boolean evaluateExpression(ConfigurableListableBeanFactory beanFactory, diff --git a/spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/java/org/springframework/boot/gradle/plugin/SinglePublishedArtifact.java b/spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/java/org/springframework/boot/gradle/plugin/SinglePublishedArtifact.java index 0d4fbff52f..1017399710 100644 --- a/spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/java/org/springframework/boot/gradle/plugin/SinglePublishedArtifact.java +++ b/spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/java/org/springframework/boot/gradle/plugin/SinglePublishedArtifact.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2017 the original author or authors. + * Copyright 2012-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/spring-boot-samples/spring-boot-sample-atmosphere/src/test/java/sample/atmosphere/SampleAtmosphereApplicationTests.java b/spring-boot-samples/spring-boot-sample-atmosphere/src/test/java/sample/atmosphere/SampleAtmosphereApplicationTests.java index 252e30fc9d..6ee0f348ac 100644 --- a/spring-boot-samples/spring-boot-sample-atmosphere/src/test/java/sample/atmosphere/SampleAtmosphereApplicationTests.java +++ b/spring-boot-samples/spring-boot-sample-atmosphere/src/test/java/sample/atmosphere/SampleAtmosphereApplicationTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2017 the original author or authors. + * Copyright 2012-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/spring-boot-samples/spring-boot-sample-junit-jupiter/src/main/java/sample/MessageController.java b/spring-boot-samples/spring-boot-sample-junit-jupiter/src/main/java/sample/MessageController.java index d097e17aea..82c8c16051 100644 --- a/spring-boot-samples/spring-boot-sample-junit-jupiter/src/main/java/sample/MessageController.java +++ b/spring-boot-samples/spring-boot-sample-junit-jupiter/src/main/java/sample/MessageController.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2017 the original author or authors. + * Copyright 2012-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/spring-boot-samples/spring-boot-sample-websocket-jetty/src/test/java/samples/websocket/jetty/echo/CustomContainerWebSocketsApplicationTests.java b/spring-boot-samples/spring-boot-sample-websocket-jetty/src/test/java/samples/websocket/jetty/echo/CustomContainerWebSocketsApplicationTests.java index 51a2ef65a7..fee76b4346 100644 --- a/spring-boot-samples/spring-boot-sample-websocket-jetty/src/test/java/samples/websocket/jetty/echo/CustomContainerWebSocketsApplicationTests.java +++ b/spring-boot-samples/spring-boot-sample-websocket-jetty/src/test/java/samples/websocket/jetty/echo/CustomContainerWebSocketsApplicationTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2017 the original author or authors. + * Copyright 2012-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/spring-boot-samples/spring-boot-sample-websocket-tomcat/src/test/java/samples/websocket/tomcat/SampleWebSocketsApplicationTests.java b/spring-boot-samples/spring-boot-sample-websocket-tomcat/src/test/java/samples/websocket/tomcat/SampleWebSocketsApplicationTests.java index eeee5103ba..fd638f57ee 100644 --- a/spring-boot-samples/spring-boot-sample-websocket-tomcat/src/test/java/samples/websocket/tomcat/SampleWebSocketsApplicationTests.java +++ b/spring-boot-samples/spring-boot-sample-websocket-tomcat/src/test/java/samples/websocket/tomcat/SampleWebSocketsApplicationTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2017 the original author or authors. + * Copyright 2012-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/spring-boot-samples/spring-boot-sample-websocket-tomcat/src/test/java/samples/websocket/tomcat/echo/CustomContainerWebSocketsApplicationTests.java b/spring-boot-samples/spring-boot-sample-websocket-tomcat/src/test/java/samples/websocket/tomcat/echo/CustomContainerWebSocketsApplicationTests.java index ef6dd19786..393a138cde 100644 --- a/spring-boot-samples/spring-boot-sample-websocket-tomcat/src/test/java/samples/websocket/tomcat/echo/CustomContainerWebSocketsApplicationTests.java +++ b/spring-boot-samples/spring-boot-sample-websocket-tomcat/src/test/java/samples/websocket/tomcat/echo/CustomContainerWebSocketsApplicationTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2017 the original author or authors. + * Copyright 2012-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/spring-boot-samples/spring-boot-sample-websocket-undertow/src/test/java/samples/websocket/undertow/SampleWebSocketsApplicationTests.java b/spring-boot-samples/spring-boot-sample-websocket-undertow/src/test/java/samples/websocket/undertow/SampleWebSocketsApplicationTests.java index f339d990d3..cf5d61a03d 100644 --- a/spring-boot-samples/spring-boot-sample-websocket-undertow/src/test/java/samples/websocket/undertow/SampleWebSocketsApplicationTests.java +++ b/spring-boot-samples/spring-boot-sample-websocket-undertow/src/test/java/samples/websocket/undertow/SampleWebSocketsApplicationTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2017 the original author or authors. + * Copyright 2012-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. diff --git a/spring-boot-samples/spring-boot-sample-websocket-undertow/src/test/java/samples/websocket/undertow/echo/CustomContainerWebSocketsApplicationTests.java b/spring-boot-samples/spring-boot-sample-websocket-undertow/src/test/java/samples/websocket/undertow/echo/CustomContainerWebSocketsApplicationTests.java index e6ee34f88a..724134f44c 100644 --- a/spring-boot-samples/spring-boot-sample-websocket-undertow/src/test/java/samples/websocket/undertow/echo/CustomContainerWebSocketsApplicationTests.java +++ b/spring-boot-samples/spring-boot-sample-websocket-undertow/src/test/java/samples/websocket/undertow/echo/CustomContainerWebSocketsApplicationTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2017 the original author or authors. + * Copyright 2012-2018 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. From 587df6a07aebd422495e3a4e833f258085a3fb05 Mon Sep 17 00:00:00 2001 From: Phillip Webb Date: Wed, 30 May 2018 12:23:40 -0700 Subject: [PATCH 4/4] Port call setHttpOnly property on Tomcat context Port "setHttpOnly on the TomcatContext" fix from commit 4d84933ee4 to 2.0.x. Since `Session` details are now configured on the `WebServerFactory` we can directly configure the context. See gh-12580 --- .../tomcat/TomcatServletWebServerFactory.java | 4 ++++ .../tomcat/TomcatServletWebServerFactoryTests.java | 11 +++++++++++ 2 files changed, 15 insertions(+) diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java index 6947f403c2..d69fbab7cc 100644 --- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java +++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java @@ -354,6 +354,10 @@ public class TomcatServletWebServerFactory extends AbstractServletWebServerFacto private void configureSession(Context context) { long sessionTimeout = getSessionTimeoutInMinutes(); context.setSessionTimeout((int) sessionTimeout); + Boolean httpOnly = getSession().getCookie().getHttpOnly(); + if (httpOnly != null) { + context.setUseHttpOnly(httpOnly); + } if (getSession().isPersistent()) { Manager manager = context.getManager(); if (manager == null) { diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java index 761fd68ad5..562e55a3c3 100644 --- a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java +++ b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java @@ -420,6 +420,17 @@ public class TomcatServletWebServerFactoryTests assertThat(tldSkipSet).contains("foo.jar", "bar.jar"); } + @Test + public void customTomcatHttpOnlyCookie() { + TomcatServletWebServerFactory factory = getFactory(); + factory.getSession().getCookie().setHttpOnly(false); + this.webServer = factory.getWebServer(); + this.webServer.start(); + Tomcat tomcat = ((TomcatWebServer) this.webServer).getTomcat(); + Context context = (Context) tomcat.getHost().findChildren()[0]; + assertThat(context.getUseHttpOnly()).isFalse(); + } + @Override protected JspServlet getJspServlet() throws ServletException { Tomcat tomcat = ((TomcatWebServer) this.webServer).getTomcat();