Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Disable SpEL selector support in WebSocket messaging by default

Browse Source 
This commit disables support for evaluating SpEL expressions from
untrusted sources by default. Specifically, this applies to the
SpEL-based 'selector' header support in WebSocket messaging, which
includes the DefaultSubscriptionRegistry and the classes used to
configure the 'selector' header name (SimpleBrokerMessageHandler and
SimpleBrokerRegistration).

The selector header support remains in place but will have to be
explicitly enabled beginning with Spring Framework 6.1.

For example, a custom implementation of WebSocketMessageBrokerConfigurer
can override the configureMessageBroker() method and configure the
selector header name as follows.

  registry.enableSimpleBroker().setSelectorHeaderName("selector");

Closes gh-30550
This commit is contained in:
Sam Brannen
2023-06-04 17:01:55 +02:00
parent 75466fee8d
commit 5bc80fc094
6 changed files with 35 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
spring-websocket/src/test/java/org/springframework/web/socket/config/annotation/WebSocketMessageBrokerConfigurationSupportTests.java
View File

@@ -165,8 +165,8 @@ class WebSocketMessageBrokerConfigurationSupportTests {
}
@Test
void selectorHeaderEnabledByDefault() {
ApplicationContext context = createContext(TestChannelConfig.class, TestConfigurer.class);
void selectorHeaderEnabled() {
ApplicationContext context = createContext(TestChannelConfig.class, SelectorHeaderConfigurer.class);
SimpleBrokerMessageHandler simpleBrokerMessageHandler = simpleBrokerMessageHandler(context);
assertThat(simpleBrokerMessageHandler.getSubscriptionRegistry())
@@ -176,8 +176,8 @@ class WebSocketMessageBrokerConfigurationSupportTests {
}
@Test
void selectorHeaderDisabled() {
ApplicationContext context = createContext(TestChannelConfig.class, SelectorHeaderConfigurer.class);
void selectorHeaderDisabledByDefault() {
ApplicationContext context = createContext(TestChannelConfig.class, TestConfigurer.class);
SimpleBrokerMessageHandler simpleBrokerMessageHandler = simpleBrokerMessageHandler(context);
assertThat(simpleBrokerMessageHandler.getSubscriptionRegistry())
@@ -282,8 +282,8 @@ class WebSocketMessageBrokerConfigurationSupportTests {
@Override
public void configureMessageBroker(MessageBrokerRegistry registry) {
// Explicitly disable selector header support
registry.enableSimpleBroker().setSelectorHeaderName(null);
// Explicitly enable selector header support
registry.enableSimpleBroker().setSelectorHeaderName("selector");
}
}

2
spring-websocket/src/test/java/org/springframework/web/socket/messaging/StompWebSocketIntegrationTests.java
View File

@@ -320,7 +320,7 @@ class StompWebSocketIntegrationTests extends AbstractWebSocketIntegrationTests {
@Override
public void configureMessageBroker(MessageBrokerRegistry configurer) {
configurer.setApplicationDestinationPrefixes("/app");
configurer.enableSimpleBroker("/topic", "/queue");
configurer.enableSimpleBroker("/topic", "/queue").setSelectorHeaderName("selector");
}
@Bean