Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Do not tokenize Forward header value

Browse Source 
This commit remove the tokenization previously used in
UriComponentsBuilder#adaptFromForwardedHeaders, in order to support
Forwarded headers that have multiple, comma-separated 'for' elements.

Closes gh-25737
This commit is contained in:
Arjen Poutsma
2020-09-09 16:31:24 +02:00
parent ed3b7cd10f
commit 07d2c08f48
2 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java
View File

@@ -754,8 +754,7 @@ public class UriComponentsBuilder implements UriBuilder, Cloneable {
try {
String forwardedHeader = headers.getFirst("Forwarded");
if (StringUtils.hasText(forwardedHeader)) {
String forwardedToUse = StringUtils.tokenizeToStringArray(forwardedHeader, ",")[0];
Matcher matcher = FORWARDED_PROTO_PATTERN.matcher(forwardedToUse);
Matcher matcher = FORWARDED_PROTO_PATTERN.matcher(forwardedHeader);
if (matcher.find()) {
scheme(matcher.group(1).trim());
port(null);
@@ -764,7 +763,7 @@ public class UriComponentsBuilder implements UriBuilder, Cloneable {
scheme("https");
port(null);
}
matcher = FORWARDED_HOST_PATTERN.matcher(forwardedToUse);
matcher = FORWARDED_HOST_PATTERN.matcher(forwardedHeader);
if (matcher.find()) {
adaptForwardedHost(matcher.group(1).trim());
}