Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove individual detection of forwarded headers

Browse Source 
This commit removes all places where forwarded headers are checked
implicitly, on an ad-hoc basis.

ForwardedHeaderFilter is expected to be used instead providing
centralized control over using or discarding such headers.

Issue: SPR-16668
This commit is contained in:
Rossen Stoyanchev
2018-05-11 09:31:39 -04:00
parent 82a8e42ff9
commit 4da43de7e1
14 changed files with 251 additions and 299 deletions
Download Patch File Download Diff File Expand all files Collapse all files

90
spring-webmvc/src/main/java/org/springframework/web/servlet/support/ServletUriComponentsBuilder.java
View File

@@ -16,18 +16,14 @@
package org.springframework.web.servlet.support;
import java.util.Enumeration;
import javax.servlet.http.HttpServletRequest;
import org.springframework.http.HttpRequest;
import org.springframework.http.server.ServletServerHttpRequest;
import org.springframework.lang.Nullable;
import org.springframework.util.Assert;
import org.springframework.util.StringUtils;
import org.springframework.web.context.request.RequestAttributes;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.web.util.UriComponents;
import org.springframework.web.util.UriComponentsBuilder;
import org.springframework.web.util.UriUtils;
import org.springframework.web.util.UrlPathHelper;
@@ -81,17 +77,14 @@ public class ServletUriComponentsBuilder extends UriComponentsBuilder {
* Prepare a builder from the host, port, scheme, and context path of the
* given HttpServletRequest.
*
* <p><strong>Note:</strong> This method extracts values from "Forwarded"
* and "X-Forwarded-*" headers if found. See class-level docs.
*
* <p>As of 4.3.15, this method replaces the contextPath with the value
* of "X-Forwarded-Prefix" rather than prepending, thus aligning with
* {@code ForwardedHeaderFiller}.
* <p><strong>Note:</strong> as of 5.1 this method ignores
* {@code "Forwarded"} and {@code "X-Forwarded-*"} headers that specify the
* client-originated address. Consider using the {@code ForwardedHeaderFilter}
* to extract and use, or to discard such headers.
*/
public static ServletUriComponentsBuilder fromContextPath(HttpServletRequest request) {
ServletUriComponentsBuilder builder = initFromRequest(request);
String forwardedPrefix = getForwardedPrefix(request);
builder.replacePath(forwardedPrefix != null ? forwardedPrefix : request.getContextPath());
builder.replacePath(request.getContextPath());
return builder;
}
@@ -103,12 +96,10 @@ public class ServletUriComponentsBuilder extends UriComponentsBuilder {
* {@code "/"} or {@code "*.do"}, the result will be the same as
* if calling {@link #fromContextPath(HttpServletRequest)}.
*
* <p><strong>Note:</strong> This method extracts values from "Forwarded"
* and "X-Forwarded-*" headers if found. See class-level docs.
*
* <p>As of 4.3.15, this method replaces the contextPath with the value
* of "X-Forwarded-Prefix" rather than prepending, thus aligning with
* {@code ForwardedHeaderFiller}.
* <p><strong>Note:</strong> as of 5.1 this method ignores
* {@code "Forwarded"} and {@code "X-Forwarded-*"} headers that specify the
* client-originated address. Consider using the {@code ForwardedHeaderFilter}
* to extract and use, or to discard such headers.
*/
public static ServletUriComponentsBuilder fromServletMapping(HttpServletRequest request) {
ServletUriComponentsBuilder builder = fromContextPath(request);
@@ -122,16 +113,14 @@ public class ServletUriComponentsBuilder extends UriComponentsBuilder {
* Prepare a builder from the host, port, scheme, and path (but not the query)
* of the HttpServletRequest.
*
* <p><strong>Note:</strong> This method extracts values from "Forwarded"
* and "X-Forwarded-*" headers if found. See class-level docs.
*
* <p>As of 4.3.15, this method replaces the contextPath with the value
* of "X-Forwarded-Prefix" rather than prepending, thus aligning with
* {@code ForwardedHeaderFiller}.
* <p><strong>Note:</strong> as of 5.1 this method ignores
* {@code "Forwarded"} and {@code "X-Forwarded-*"} headers that specify the
* client-originated address. Consider using the {@code ForwardedHeaderFilter}
* to extract and use, or to discard such headers.
*/
public static ServletUriComponentsBuilder fromRequestUri(HttpServletRequest request) {
ServletUriComponentsBuilder builder = initFromRequest(request);
builder.initPath(getRequestUriWithForwardedPrefix(request));
builder.initPath(request.getRequestURI());
return builder;
}
@@ -139,16 +128,14 @@ public class ServletUriComponentsBuilder extends UriComponentsBuilder {
* Prepare a builder by copying the scheme, host, port, path, and
* query string of an HttpServletRequest.
*
* <p><strong>Note:</strong> This method extracts values from "Forwarded"
* and "X-Forwarded-*" headers if found. See class-level docs.
*
* <p>As of 4.3.15, this method replaces the contextPath with the value
* of "X-Forwarded-Prefix" rather than prepending, thus aligning with
* {@code ForwardedHeaderFiller}.
* <p><strong>Note:</strong> as of 5.1 this method ignores
* {@code "Forwarded"} and {@code "X-Forwarded-*"} headers that specify the
* client-originated address. Consider using the {@code ForwardedHeaderFilter}
* to extract and use, or to discard such headers.
*/
public static ServletUriComponentsBuilder fromRequest(HttpServletRequest request) {
ServletUriComponentsBuilder builder = initFromRequest(request);
builder.initPath(getRequestUriWithForwardedPrefix(request));
builder.initPath(request.getRequestURI());
builder.query(request.getQueryString());
return builder;
}
@@ -157,11 +144,9 @@ public class ServletUriComponentsBuilder extends UriComponentsBuilder {
* Initialize a builder with a scheme, host,and port (but not path and query).
*/
private static ServletUriComponentsBuilder initFromRequest(HttpServletRequest request) {
HttpRequest httpRequest = new ServletServerHttpRequest(request);
UriComponents uriComponents = UriComponentsBuilder.fromHttpRequest(httpRequest).build();
String scheme = uriComponents.getScheme();
String host = uriComponents.getHost();
int port = uriComponents.getPort();
String scheme = request.getScheme();
String host = request.getServerName();
int port = request.getServerPort();
ServletUriComponentsBuilder builder = new ServletUriComponentsBuilder();
builder.scheme(scheme);
@@ -172,37 +157,6 @@ public class ServletUriComponentsBuilder extends UriComponentsBuilder {
return builder;
}
@Nullable
private static String getForwardedPrefix(HttpServletRequest request) {
String prefix = null;
Enumeration<String> names = request.getHeaderNames();
while (names.hasMoreElements()) {
String name = names.nextElement();
if ("X-Forwarded-Prefix".equalsIgnoreCase(name)) {
prefix = request.getHeader(name);
}
}
if (prefix != null) {
while (prefix.endsWith("/")) {
prefix = prefix.substring(0, prefix.length() - 1);
}
}
return prefix;
}
private static String getRequestUriWithForwardedPrefix(HttpServletRequest request) {
String path = request.getRequestURI();
String forwardedPrefix = getForwardedPrefix(request);
if (forwardedPrefix != null) {
String contextPath = request.getContextPath();
if (!StringUtils.isEmpty(contextPath) && !contextPath.equals("/") && path.startsWith(contextPath)) {
path = path.substring(contextPath.length());
}
path = forwardedPrefix + path;
}
return path;
}
// Alternative methods relying on RequestContextHolder to find the request

23
spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/MvcUriComponentsBuilderTests.java
View File

@@ -23,6 +23,7 @@ import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
import java.util.Arrays;
import java.util.List;
import javax.servlet.http.HttpServletRequest;
import org.hamcrest.Matchers;
import org.joda.time.DateTime;
@@ -36,7 +37,9 @@ import org.springframework.format.annotation.DateTimeFormat;
import org.springframework.format.annotation.DateTimeFormat.ISO;
import org.springframework.http.HttpEntity;
import org.springframework.http.MediaType;
import org.springframework.mock.web.test.MockFilterChain;
import org.springframework.mock.web.test.MockHttpServletRequest;
import org.springframework.mock.web.test.MockHttpServletResponse;
import org.springframework.mock.web.test.MockServletContext;
import org.springframework.stereotype.Controller;
import org.springframework.util.MultiValueMap;
@@ -49,6 +52,7 @@ import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
import org.springframework.web.filter.ForwardedHeaderFilter;
import org.springframework.web.servlet.DispatcherServlet;
import org.springframework.web.servlet.ModelAndView;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
@@ -136,29 +140,40 @@ public class MvcUriComponentsBuilderTests {
}
@Test
public void usesForwardedHostAsHostIfHeaderIsSet() {
public void usesForwardedHostAsHostIfHeaderIsSet() throws Exception {
this.request.addHeader("X-Forwarded-Host", "somethingDifferent");
adaptRequestFromForwardedHeaders();
UriComponents uriComponents = fromController(PersonControllerImpl.class).build();
assertThat(uriComponents.toUriString(), startsWith("http://somethingDifferent"));
}
@Test
public void usesForwardedHostAndPortFromHeader() {
public void usesForwardedHostAndPortFromHeader() throws Exception {
request.addHeader("X-Forwarded-Host", "foobar:8088");
adaptRequestFromForwardedHeaders();
UriComponents uriComponents = fromController(PersonControllerImpl.class).build();
assertThat(uriComponents.toUriString(), startsWith("http://foobar:8088"));
}
@Test
public void usesFirstHostOfXForwardedHost() {
request.addHeader("X-Forwarded-Host", "barfoo:8888, localhost:8088");
public void usesFirstHostOfXForwardedHost() throws Exception {
this.request.addHeader("X-Forwarded-Host", "barfoo:8888, localhost:8088");
adaptRequestFromForwardedHeaders();
UriComponents uriComponents = fromController(PersonControllerImpl.class).build();
assertThat(uriComponents.toUriString(), startsWith("http://barfoo:8888"));
}
// SPR-16668
private void adaptRequestFromForwardedHeaders() throws Exception {
MockFilterChain chain = new MockFilterChain();
new ForwardedHeaderFilter().doFilter(this.request, new MockHttpServletResponse(), chain);
HttpServletRequest adaptedRequest = (HttpServletRequest) chain.getRequest();
RequestContextHolder.setRequestAttributes(new ServletRequestAttributes(adaptedRequest));
}
@Test
public void fromMethodNamePathVariable() {
UriComponents uriComponents = fromMethodName(ControllerWithMethods.class,

57
spring-webmvc/src/test/java/org/springframework/web/servlet/support/ServletUriComponentsBuilderTests.java
View File

@@ -16,12 +16,17 @@
package org.springframework.web.servlet.support;
import javax.servlet.http.HttpServletRequest;
import org.junit.Before;
import org.junit.Test;
import org.springframework.mock.web.test.MockFilterChain;
import org.springframework.mock.web.test.MockHttpServletRequest;
import org.springframework.mock.web.test.MockHttpServletResponse;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import org.springframework.web.filter.ForwardedHeaderFilter;
import org.springframework.web.util.UriComponents;
import static org.junit.Assert.*;
@@ -78,10 +83,10 @@ public class ServletUriComponentsBuilderTests {
assertEquals("https://localhost:9043/mvc-showcase", result);
}
// Most X-Forwarded-* tests in UriComponentsBuilderTests
// Some X-Forwarded-* tests in addition to the ones in UriComponentsBuilderTests
@Test
public void fromRequestWithForwardedHostAndPort() {
public void fromRequestWithForwardedHostAndPort() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setScheme("http");
request.setServerName("localhost");
@@ -90,7 +95,10 @@ public class ServletUriComponentsBuilderTests {
request.addHeader("X-Forwarded-Proto", "https");
request.addHeader("X-Forwarded-Host", "84.198.58.199");
request.addHeader("X-Forwarded-Port", "443");
UriComponents result = ServletUriComponentsBuilder.fromRequest(request).build();
HttpServletRequest requestToUse = adaptFromForwardedHeaders(request);
UriComponents result = ServletUriComponentsBuilder.fromRequest(requestToUse).build();
assertEquals("https://84.198.58.199/mvc-showcase", result.toString());
}
@@ -103,29 +111,38 @@ public class ServletUriComponentsBuilderTests {
}
@Test // SPR-16650
public void fromRequestWithForwardedPrefix() {
public void fromRequestWithForwardedPrefix() throws Exception {
this.request.addHeader("X-Forwarded-Prefix", "/prefix");
this.request.setContextPath("/mvc-showcase");
this.request.setRequestURI("/mvc-showcase/bar");
UriComponents result = ServletUriComponentsBuilder.fromRequest(this.request).build();
HttpServletRequest requestToUse = adaptFromForwardedHeaders(this.request);
UriComponents result = ServletUriComponentsBuilder.fromRequest(requestToUse).build();
assertEquals("http://localhost/prefix/bar", result.toUriString());
}
@Test // SPR-16650
public void fromRequestWithForwardedPrefixTrailingSlash() {
public void fromRequestWithForwardedPrefixTrailingSlash() throws Exception {
this.request.addHeader("X-Forwarded-Prefix", "/foo/");
this.request.setContextPath("/spring-mvc-showcase");
this.request.setRequestURI("/spring-mvc-showcase/bar");
UriComponents result = ServletUriComponentsBuilder.fromRequest(this.request).build();
HttpServletRequest requestToUse = adaptFromForwardedHeaders(this.request);
UriComponents result = ServletUriComponentsBuilder.fromRequest(requestToUse).build();
assertEquals("http://localhost/foo/bar", result.toUriString());
}
@Test // SPR-16650
public void fromRequestWithForwardedPrefixRoot() {
public void fromRequestWithForwardedPrefixRoot() throws Exception {
this.request.addHeader("X-Forwarded-Prefix", "/");
this.request.setContextPath("/mvc-showcase");
this.request.setRequestURI("/mvc-showcase/bar");
UriComponents result = ServletUriComponentsBuilder.fromRequest(this.request).build();
HttpServletRequest requestToUse = adaptFromForwardedHeaders(this.request);
UriComponents result = ServletUriComponentsBuilder.fromRequest(requestToUse).build();
assertEquals("http://localhost/bar", result.toUriString());
}
@@ -138,11 +155,14 @@ public class ServletUriComponentsBuilderTests {
}
@Test // SPR-16650
public void fromContextPathWithForwardedPrefix() {
public void fromContextPathWithForwardedPrefix() throws Exception {
this.request.addHeader("X-Forwarded-Prefix", "/prefix");
this.request.setContextPath("/mvc-showcase");
this.request.setRequestURI("/mvc-showcase/simple");
String result = ServletUriComponentsBuilder.fromContextPath(this.request).build().toUriString();
HttpServletRequest requestToUse = adaptFromForwardedHeaders(this.request);
String result = ServletUriComponentsBuilder.fromContextPath(requestToUse).build().toUriString();
assertEquals("http://localhost/prefix", result);
}
@@ -156,12 +176,15 @@ public class ServletUriComponentsBuilderTests {
}
@Test // SPR-16650
public void fromServletMappingWithForwardedPrefix() {
public void fromServletMappingWithForwardedPrefix() throws Exception {
this.request.addHeader("X-Forwarded-Prefix", "/prefix");
this.request.setContextPath("/mvc-showcase");
this.request.setServletPath("/app");
this.request.setRequestURI("/mvc-showcase/app/simple");
String result = ServletUriComponentsBuilder.fromServletMapping(this.request).build().toUriString();
HttpServletRequest requestToUse = adaptFromForwardedHeaders(this.request);
String result = ServletUriComponentsBuilder.fromServletMapping(requestToUse).build().toUriString();
assertEquals("http://localhost/prefix/app", result);
}
@@ -194,4 +217,12 @@ public class ServletUriComponentsBuilderTests {
ServletUriComponentsBuilder builder = ServletUriComponentsBuilder.fromRequestUri(this.request);
assertNull(builder.removePathExtension());
}
// SPR-16668
private HttpServletRequest adaptFromForwardedHeaders(HttpServletRequest request) throws Exception {
MockFilterChain chain = new MockFilterChain();
new ForwardedHeaderFilter().doFilter(request, new MockHttpServletResponse(), chain);
return (HttpServletRequest) chain.getRequest();
}
}