From 2fe7ab1f92914205d917586d8866a351197791ab Mon Sep 17 00:00:00 2001 From: "kevin.kep" Date: Wed, 10 Jul 2024 09:45:07 +0900 Subject: [PATCH] Trim last allowed origin in comma-delimited list See gh-33181 --- .../java/org/springframework/web/cors/CorsConfiguration.java | 2 +- .../org/springframework/web/cors/CorsConfigurationTests.java | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java b/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java index dbb22c4253..ad6d65feb4 100644 --- a/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java +++ b/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java @@ -281,7 +281,7 @@ public class CorsConfiguration { } } if (start < rawValue.length()) { - valueConsumer.accept(rawValue.substring(start)); + valueConsumer.accept(rawValue.substring(start).trim()); } } diff --git a/spring-web/src/test/java/org/springframework/web/cors/CorsConfigurationTests.java b/spring-web/src/test/java/org/springframework/web/cors/CorsConfigurationTests.java index 0dfdee1ba0..092781475f 100644 --- a/spring-web/src/test/java/org/springframework/web/cors/CorsConfigurationTests.java +++ b/spring-web/src/test/java/org/springframework/web/cors/CorsConfigurationTests.java @@ -305,6 +305,11 @@ class CorsConfigurationTests { assertThat(config.checkOrigin("https://a1.com")).isEqualTo("https://a1.com"); assertThat(config.checkOrigin("https://a2.com/")).isEqualTo("https://a2.com/"); + // comma-delimited origins list with space + config.setAllowedOrigins(Collections.singletonList("https://a1.com, https://a2.com")); + assertThat(config.checkOrigin("https://a1.com")).isEqualTo("https://a1.com"); + assertThat(config.checkOrigin("https://a2.com/")).isEqualTo("https://a2.com/"); + // specific origin matches Origin header with or without trailing "/" config.setAllowedOrigins(Collections.singletonList("https://domain.com")); assertThat(config.checkOrigin("https://domain.com")).isEqualTo("https://domain.com");