Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Disable SpEL selector support in WebSocket messaging by default

Browse Source 
This commit disables support for evaluating SpEL expressions from
untrusted sources by default. Specifically, this applies to the
SpEL-based 'selector' header support in WebSocket messaging, which
includes the DefaultSubscriptionRegistry and the classes used to
configure the 'selector' header name (SimpleBrokerMessageHandler and
SimpleBrokerRegistration).

The selector header support remains in place but will have to be
explicitly enabled beginning with Spring Framework 6.1.

For example, a custom implementation of WebSocketMessageBrokerConfigurer
can override the configureMessageBroker() method and configure the
selector header name as follows.

  registry.enableSimpleBroker().setSelectorHeaderName("selector");

Closes gh-30550
This commit is contained in:
Sam Brannen
2023-06-04 17:01:55 +02:00
parent 75466fee8d
commit 5bc80fc094
6 changed files with 35 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
spring-messaging/src/test/java/org/springframework/messaging/simp/broker/DefaultSubscriptionRegistryTests.java
View File

@@ -253,7 +253,7 @@ class DefaultSubscriptionRegistryTests {
}
@Test
void registerSubscriptionWithSelectorHeaderEnabledByDefault() {
void registerSubscriptionWithSelectorHeaderEnabled() {
String sessionId1 = "sess01";
String sessionId2 = "sess02";
String sessionId3 = "sess03";
@@ -264,6 +264,9 @@ class DefaultSubscriptionRegistryTests {
String selector1 = "headers.foo == 'bar'";
String selector2 = "headers.foo == 'enigma'";
// Explicitly enable selector support
this.registry.setSelectorHeaderName("selector");
// Register subscription with matching selector header
this.registry.registerSubscription(subscribeMessage(sessionId1, subscriptionId1, destination, selector1));
// Register subscription with non-matching selector header
@@ -297,7 +300,7 @@ class DefaultSubscriptionRegistryTests {
}
@Test
void registerSubscriptionWithSelectorHeaderDisabled() {
void registerSubscriptionWithSelectorHeaderDisabledByDefault() {
String sessionId1 = "sess01";
String sessionId2 = "sess02";
String sessionId3 = "sess03";
@@ -308,9 +311,6 @@ class DefaultSubscriptionRegistryTests {
String selector1 = "headers.foo == 'bar'";
String selector2 = "headers.foo == 'enigma'";
// Explicitly disable selector header support
this.registry.setSelectorHeaderName(null);
// Register subscription with matching selector header
this.registry.registerSubscription(subscribeMessage(sessionId1, subscriptionId1, destination, selector1));
// Register subscription with non-matching selector header