Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Protect against RFD exploits

Browse Source 
Issue: SPR-13548
This commit is contained in:
Rossen Stoyanchev
2015-10-04 21:25:41 -04:00
committed by Stephane Nicoll
parent 161fd98656
commit 2bd1daa75e
20 changed files with 465 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
spring-web/src/main/java/org/springframework/http/converter/json/MappingJackson2HttpMessageConverter.java
View File

@@ -95,6 +95,7 @@ public class MappingJackson2HttpMessageConverter extends AbstractJackson2HttpMes
String jsonpFunction =
(object instanceof MappingJacksonValue ? ((MappingJacksonValue) object).getJsonpFunction() : null);
if (jsonpFunction != null) {
generator.writeRaw("/**/");
generator.writeRaw(jsonpFunction + "(");
}
}

10
spring-web/src/main/java/org/springframework/web/accept/ContentNegotiationManager.java
View File

@@ -120,6 +120,16 @@ public class ContentNegotiationManager implements ContentNegotiationStrategy,
return new ArrayList<String>(result);
}
/**
* {@inheritDoc}
* <p>At startup this method returns extensions explicitly registered with
* either {@link PathExtensionContentNegotiationStrategy} or
* {@link ParameterContentNegotiationStrategy}. At runtime if there is a
* "path extension" strategy and its
* {@link PathExtensionContentNegotiationStrategy#setUseJaf(boolean)
* useJaf} property is set to "true", the list of extensions may
* increase as file extensions are resolved via JAF and cached.
*/
@Override
public List<String> getAllFileExtensions() {
Set<String> result = new LinkedHashSet<String>();

7
spring-web/src/main/java/org/springframework/web/accept/ContentNegotiationManagerFactoryBean.java
View File

@@ -178,6 +178,10 @@ public class ContentNegotiationManagerFactoryBean
this.useJaf = useJaf;
}
private boolean isUseJafTurnedOff() {
return (this.useJaf != null && !this.useJaf);
}
/**
* Whether a request parameter ("format" by default) should be used to
* determine the requested media type. For this option to work you must
@@ -240,7 +244,7 @@ public class ContentNegotiationManagerFactoryBean
if (this.favorPathExtension) {
PathExtensionContentNegotiationStrategy strategy;
if (this.servletContext != null) {
if (this.servletContext != null && !isUseJafTurnedOff()) {
strategy = new ServletPathExtensionContentNegotiationStrategy(
this.servletContext, this.mediaTypes);
}
@@ -272,7 +276,6 @@ public class ContentNegotiationManagerFactoryBean
this.contentNegotiationManager = new ContentNegotiationManager(strategies);
}
@Override
public ContentNegotiationManager getObject() {
return this.contentNegotiationManager;

8
spring-web/src/main/java/org/springframework/web/accept/PathExtensionContentNegotiationStrategy.java
View File

@@ -66,7 +66,8 @@ public class PathExtensionContentNegotiationStrategy
PATH_HELPER.setUrlDecode(false);
}
private boolean useJaf = JAF_PRESENT;
private boolean useJaf = true;
private boolean ignoreUnknownExtensions = true;
@@ -89,8 +90,7 @@ public class PathExtensionContentNegotiationStrategy
/**
* Whether to use the Java Activation Framework to look up file extensions.
* <p>By default if this property is not set JAF is present on the
* classpath it will be used.
* <p>By default this is set to "true" but depends on JAF being present.
*/
public void setUseJaf(boolean useJaf) {
this.useJaf = useJaf;
@@ -123,7 +123,7 @@ public class PathExtensionContentNegotiationStrategy
protected MediaType handleNoMatch(NativeWebRequest webRequest, String extension)
throws HttpMediaTypeNotAcceptableException {
if (this.useJaf) {
if (this.useJaf && JAF_PRESENT) {
MediaType mediaType = JafMediaTypeFactory.getMediaType("file." + extension);
if (mediaType != null && !MediaType.APPLICATION_OCTET_STREAM.equals(mediaType)) {
return mediaType;

2
spring-web/src/main/java/org/springframework/web/util/UrlPathHelper.java
View File

@@ -438,7 +438,7 @@ public class UrlPathHelper {
* @see java.net.URLDecoder#decode(String)
*/
public String decodeRequestString(HttpServletRequest request, String source) {
if (this.urlDecode) {
if (this.urlDecode && source != null) {
return decodeInternal(request, source);
}
return source;

11
spring-web/src/main/java/org/springframework/web/util/WebUtils.java
View File

@@ -723,20 +723,23 @@ public abstract class WebUtils {
}
/**
* Extract the full URL filename (including file extension) from the given request URL path.
* Correctly resolves nested paths such as "/products/view.html" as well.
* Extract the full URL filename (including file extension) from the given
* request URL path. Correctly resolve nested paths such as
* "/products/view.html" and remove any path and or query parameters.
* @param urlPath the request URL path (e.g. "/products/index.html")
* @return the extracted URI filename (e.g. "index.html")
*/
public static String extractFullFilenameFromUrlPath(String urlPath) {
int end = urlPath.indexOf(';');
int end = urlPath.indexOf('?');
if (end == -1) {
end = urlPath.indexOf('?');
end = urlPath.indexOf('#');
if (end == -1) {
end = urlPath.length();
}
}
int begin = urlPath.lastIndexOf('/', end) + 1;
int paramIndex = urlPath.indexOf(';', begin);
end = (paramIndex != -1 && paramIndex < end ? paramIndex : end);
return urlPath.substring(begin, end);
}