Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Skip Content-Disposition header if status != 2xx

Browse Source 
Issue: SPR-13588
This commit is contained in:
Rossen Stoyanchev
2015-10-26 16:01:32 -04:00
parent 994a11da3e
commit 050e79e45e
1 changed files with 16 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/AbstractMessageConverterMethodProcessor.java
View File

@@ -315,11 +315,12 @@ public abstract class AbstractMessageConverterMethodProcessor extends AbstractMe
} }
/** /**
* Check if the path has a file extension and whether the extension is either * Check if the path has a file extension and whether the extension is
* {@link #WHITELISTED_EXTENSIONS whitelisted} or * either {@link #WHITELISTED_EXTENSIONS whitelisted} or explicitly
* {@link ContentNegotiationManager#getAllFileExtensions() explicitly * {@link ContentNegotiationManager#getAllFileExtensions() registered}.
* registered}. If not add a 'Content-Disposition' header with a safe * If not, and the status is in the 2xx range, a 'Content-Disposition'
* attachment file name ("f.txt") to prevent RFD exploits. * header with a safe attachment file name ("f.txt") is added to prevent
* RFD exploits.
*/ */
private void addContentDispositionHeader(ServletServerHttpRequest request, private void addContentDispositionHeader(ServletServerHttpRequest request,
ServletServerHttpResponse response) { ServletServerHttpResponse response) {
@@ -329,6 +330,16 @@ public abstract class AbstractMessageConverterMethodProcessor extends AbstractMe
return; return;
} }
try {
int status = response.getServletResponse().getStatus();
if (status < 200 || status > 299) {
return;
}
}
catch (Throwable ex) {
// Ignore
}
HttpServletRequest servletRequest = request.getServletRequest(); HttpServletRequest servletRequest = request.getServletRequest();
String requestUri = RAW_URL_PATH_HELPER.getOriginatingRequestUri(servletRequest); String requestUri = RAW_URL_PATH_HELPER.getOriginatingRequestUri(servletRequest);