Change SockJS and Websocket default allowedOrigins to same origin

This commit adds support for a same origin check that compares
Origin header to Host header. It also changes the default setting
from all origins allowed to only same origin allowed.

Issues: SPR-12697, SPR-12685
(cherry picked from commit 6062e15)

spring-web/src/main/java/org/springframework/web/util/WebUtils.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2014 the original author or authors.
+ * Copyright 2002-2015 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@ package org.springframework.web.util;
 import java.io.File;
 import java.io.FileNotFoundException;
 import java.util.Enumeration;
+import java.util.List;
 import java.util.Map;
 import java.util.StringTokenizer;
 import java.util.TreeMap;
@@ -32,6 +33,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
+import org.springframework.http.server.ServerHttpRequest;
 import org.springframework.util.Assert;
 import org.springframework.util.LinkedMultiValueMap;
 import org.springframework.util.MultiValueMap;
@@ -43,6 +45,7 @@ import org.springframework.util.StringUtils;
  *
  * @author Rod Johnson
  * @author Juergen Hoeller
+ * @author Sebastien Deleuze
  */
 public abstract class WebUtils {
 
@@ -765,4 +768,47 @@ public abstract class WebUtils {
 		}
 		return result;
 	}
+
+	/**
+	 * Check the given request origin against a list of allowed origins.
+	 * A list containing "*" means that all origins are allowed.
+	 * An empty list means only same origin is allowed.
+	 *
+	 * @return true if the request origin is valid, false otherwise
+	 * @since 4.1.5
+	 * @see <a href="https://tools.ietf.org/html/rfc6454">RFC 6454: The Web Origin Concept</a>
+	 */
+	public static boolean isValidOrigin(ServerHttpRequest request, List<String> allowedOrigins) {
+		Assert.notNull(request, "Request must not be null");
+		Assert.notNull(allowedOrigins, "Allowed origins must not be null");
+
+		String origin = request.getHeaders().getOrigin();
+		if (origin == null || allowedOrigins.contains("*")) {
+			return true;
+		}
+		else if (allowedOrigins.isEmpty()) {
+			UriComponents originComponents = UriComponentsBuilder.fromHttpUrl(origin).build();
+			UriComponents requestComponents = UriComponentsBuilder.fromHttpRequest(request).build();
+			int originPort = getPort(originComponents);
+			int requestPort = getPort(requestComponents);
+			return originComponents.getHost().equals(requestComponents.getHost()) && (originPort == requestPort);
+		}
+		else {
+			return allowedOrigins.contains(origin);
+		}
+	}
+
+	private static int getPort(UriComponents component) {
+		int port = component.getPort();
+		if (port == -1) {
+			if ("http".equals(component.getScheme())) {
+				port = 80;
+			}
+			else if ("https".equals(component.getScheme())) {
+				port = 443;
+			}
+		}
+		return port;
+	}
+
 }

spring-web/src/test/java/org/springframework/web/util/WebUtilsTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2008 the original author or authors.
+ * Copyright 2002-2015 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,12 +16,18 @@
 
 package org.springframework.web.util;
 
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 
 import org.junit.Test;
 
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.server.ServerHttpRequest;
+import org.springframework.http.server.ServletServerHttpRequest;
+import org.springframework.mock.web.test.MockHttpServletRequest;
 import org.springframework.util.MultiValueMap;
 
 import static org.junit.Assert.*;
@@ -30,6 +36,7 @@ import static org.junit.Assert.*;
  * @author Juergen Hoeller
  * @author Arjen Poutsma
  * @author Rossen Stoyanchev
+ * @author Sebastien Deleuze
  */
 public class WebUtilsTests {
 
@@ -98,4 +105,57 @@ public class WebUtilsTests {
 		assertEquals(Arrays.asList("red", "blue", "green"), variables.get("colors"));
 	}
 
+	@Test
+	public void isValidOrigin() {
+		List<String> allowedOrigins = new ArrayList<>();
+		MockHttpServletRequest servletRequest = new MockHttpServletRequest();
+		ServerHttpRequest request = new ServletServerHttpRequest(servletRequest);
+
+		servletRequest.setServerName("mydomain1.com");
+		request.getHeaders().set(HttpHeaders.ORIGIN, "http://mydomain1.com");
+		assertTrue(WebUtils.isValidOrigin(request, allowedOrigins));
+
+		servletRequest.setServerName("mydomain1.com");
+		request.getHeaders().set(HttpHeaders.ORIGIN, "http://mydomain1.com:80");
+		assertTrue(WebUtils.isValidOrigin(request, allowedOrigins));
+
+		servletRequest.setServerName("mydomain1.com");
+		servletRequest.setServerPort(443);
+		request.getHeaders().set(HttpHeaders.ORIGIN, "https://mydomain1.com");
+		assertTrue(WebUtils.isValidOrigin(request, allowedOrigins));
+
+		servletRequest.setServerName("mydomain1.com");
+		servletRequest.setServerPort(443);
+		request.getHeaders().set(HttpHeaders.ORIGIN, "https://mydomain1.com:443");
+		assertTrue(WebUtils.isValidOrigin(request, allowedOrigins));
+
+		servletRequest.setServerName("mydomain1.com");
+		servletRequest.setServerPort(123);
+		request.getHeaders().set(HttpHeaders.ORIGIN, "http://mydomain1.com:123");
+		assertTrue(WebUtils.isValidOrigin(request, allowedOrigins));
+
+		servletRequest.setServerName("mydomain1.com");
+		request.getHeaders().set(HttpHeaders.ORIGIN, "http://mydomain2.com");
+		assertFalse(WebUtils.isValidOrigin(request, allowedOrigins));
+
+		servletRequest.setServerName("mydomain1.com");
+		request.getHeaders().set(HttpHeaders.ORIGIN, "https://mydomain1.com");
+		assertFalse(WebUtils.isValidOrigin(request, allowedOrigins));
+
+		allowedOrigins = Arrays.asList("*");
+		servletRequest.setServerName("mydomain1.com");
+		request.getHeaders().set(HttpHeaders.ORIGIN, "http://mydomain2.com");
+		assertTrue(WebUtils.isValidOrigin(request, allowedOrigins));
+
+		allowedOrigins = Arrays.asList("http://mydomain1.com");
+		servletRequest.setServerName("mydomain2.com");
+		request.getHeaders().set(HttpHeaders.ORIGIN, "http://mydomain1.com");
+		assertTrue(WebUtils.isValidOrigin(request, allowedOrigins));
+
+		allowedOrigins = Arrays.asList("http://mydomain1.com");
+		servletRequest.setServerName("mydomain2.com");
+		request.getHeaders().set(HttpHeaders.ORIGIN, "http://mydomain3.com");
+		assertFalse(WebUtils.isValidOrigin(request, allowedOrigins));
+	}
+
 }