Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Reject user names with "%2F" in STOMP

Browse Source 
Closes gh-23836
This commit is contained in:
Rossen Stoyanchev
2019-11-26 16:21:48 +00:00
parent 08669cc7c3
commit 30d68f2de7
4 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
spring-messaging/src/test/java/org/springframework/messaging/simp/SimpMessagingTemplateTests.java
View File

@@ -36,6 +36,7 @@ import org.springframework.messaging.support.NativeMessageHeaderAccessor;
import org.springframework.util.LinkedMultiValueMap;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
/**
* Unit tests for {@link org.springframework.messaging.simp.SimpMessagingTemplate}.
@@ -86,6 +87,12 @@ public class SimpMessagingTemplateTests {
assertThat(headerAccessor.getDestination()).isEqualTo("/user/https:%2F%2Fjoe.openid.example.org%2F/queue/foo");
}
@Test // gh-23836
public void convertAndSendToUserWithInvalidSequence() {
assertThatIllegalArgumentException().isThrownBy(() ->
this.messagingTemplate.convertAndSendToUser("joe%2F", "/queue/foo", "data"));
}
@Test
public void convertAndSendWithCustomHeader() {
Map<String, Object> headers = Collections.<String, Object>singletonMap("key", "value");

10
spring-messaging/src/test/java/org/springframework/messaging/simp/user/DefaultUserDestinationResolverTests.java
View File

@@ -29,6 +29,7 @@ import org.springframework.messaging.support.MessageBuilder;
import org.springframework.util.StringUtils;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
import static org.mockito.BDDMockito.given;
import static org.mockito.Mockito.mock;
@@ -113,6 +114,15 @@ public class DefaultUserDestinationResolverTests {
assertThat(actual.getUser()).isNull();
}
@Test // gh-23836
public void handleSubscribeInvalidUserName() {
TestPrincipal user = new TestPrincipal("joe%2F");
String sourceDestination = "/user/queue/foo";
Message<?> message = createMessage(SimpMessageType.SUBSCRIBE, user, "123", sourceDestination);
assertThatIllegalArgumentException().isThrownBy(() -> this.resolver.resolveDestination(message));
}
@Test
public void handleUnsubscribe() {
TestPrincipal user = new TestPrincipal("joe");