Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Reinstate removal of jsessionid from lookup path

Browse Source 
Closes gh-25864
This commit is contained in:
Rossen Stoyanchev
2020-10-07 11:31:52 +01:00
parent da84155d8d
commit 3371c23343
4 changed files with 56 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/RequestResponseBodyMethodProcessorTests.java
View File

@@ -375,7 +375,7 @@ public class RequestResponseBodyMethodProcessorTests {
Collections.singletonList(new StringHttpMessageConverter()),
factory.getObject());
assertContentDisposition(processor, false, "/hello.json", "whitelisted extension");
assertContentDisposition(processor, false, "/hello.json", "safe extension");
assertContentDisposition(processor, false, "/hello.pdf", "registered extension");
assertContentDisposition(processor, true, "/hello.dataless", "unknown extension");
@@ -383,7 +383,8 @@ public class RequestResponseBodyMethodProcessorTests {
assertContentDisposition(processor, false, "/hello.json;a=b", "path param shouldn't cause issue");
assertContentDisposition(processor, true, "/hello.json;a=b;setup.dataless", "unknown ext in path params");
assertContentDisposition(processor, true, "/hello.dataless;a=b;setup.json", "unknown ext in filename");
assertContentDisposition(processor, false, "/hello.json;a=b;setup.json", "whitelisted extensions");
assertContentDisposition(processor, false, "/hello.json;a=b;setup.json", "safe extensions");
assertContentDisposition(processor, true, "/hello.json;jsessionid=foo.bar", "jsessionid shouldn't cause issue");
// encoded dot
assertContentDisposition(processor, true, "/hello%2Edataless;a=b;setup.json", "encoded dot in filename");

28
spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/UriTemplateServletAnnotationControllerHandlerMethodTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2016 the original author or authors.
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -69,6 +69,28 @@ public class UriTemplateServletAnnotationControllerHandlerMethodTests extends Ab
assertEquals("test-42-7", response.getContentAsString());
}
@Test // gh-25864
public void literalMappingWithPathParams() throws Exception {
initServletWithControllers(MultipleUriTemplateController.class);
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/data");
MockHttpServletResponse response = new MockHttpServletResponse();
getServlet().service(request, response);
assertEquals(200, response.getStatus());
assertEquals("test", response.getContentAsString());
request = new MockHttpServletRequest("GET", "/data;foo=bar");
response = new MockHttpServletResponse();
getServlet().service(request, response);
assertEquals(404, response.getStatus());
request = new MockHttpServletRequest("GET", "/data;jsessionid=123");
response = new MockHttpServletResponse();
getServlet().service(request, response);
assertEquals(200, response.getStatus());
assertEquals("test", response.getContentAsString());
}
@Test
public void multiple() throws Exception {
initServletWithControllers(MultipleUriTemplateController.class);
@@ -388,6 +410,10 @@ public class UriTemplateServletAnnotationControllerHandlerMethodTests extends Ab
writer.write("test-" + hotel + "-q" + qHotel + "-" + booking + "-" + other + "-q" + qOther);
}
@RequestMapping("/data")
void handleWithLiteralMapping(Writer writer) throws IOException {
writer.write("test");
}
}
@Controller