Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add section on RFD + whitelist yml/properties/csv

Browse Source 
Issue: SPR-13643
This commit is contained in:
Rossen Stoyanchev
2015-11-05 19:42:30 -05:00
parent e190f26669
commit 71a9eb7102
4 changed files with 105 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
spring-webmvc/src/main/java/org/springframework/web/servlet/config/annotation/ContentNegotiationConfigurer.java
View File

@@ -62,9 +62,19 @@ public class ContentNegotiationConfigurer {
}
/**
* Add mappings from file extensions to media types.
* <p>If this property is not set, the Java Action Framework, if available, may
* still be used in conjunction with {@link #favorPathExtension(boolean)}.
* Add a mapping from a key, extracted from a path extension or a query
* parameter, to a MediaType. This is required in order for the parameter
* strategy to work. Any extensions explicitly registered here are also
* whitelisted for the purpose of Reflected File Download attack detection
* (see Spring Framework reference documentation for more details on RFD
* attack protection).
* <p>The path extension strategy will also try to use
* {@link ServletContext#getMimeType} and JAF (if present) to resolve path
* extensions. To change this behavior see the {@link #useJaf} property.
* @param extension the key to look up
* @param mediaType the media type
* @see #mediaTypes(Map)
* @see #replaceMediaTypes(Map)
*/
public ContentNegotiationConfigurer mediaType(String extension, MediaType mediaType) {
this.mediaTypes.put(extension, mediaType);
@@ -72,9 +82,7 @@ public class ContentNegotiationConfigurer {
}
/**
* Add mappings from file extensions to media types.
* <p>If this property is not set, the Java Action Framework, if available, may
* still be used in conjunction with {@link #favorPathExtension(boolean)}.
* An alternative to {@link #mediaType} with a Map of registrations to add.
*/
public ContentNegotiationConfigurer mediaTypes(Map<String, MediaType> mediaTypes) {
if (mediaTypes != null) {

5
spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/AbstractMessageConverterMethodProcessor.java
View File

@@ -69,8 +69,9 @@ public abstract class AbstractMessageConverterMethodProcessor extends AbstractMe
/* Extensions associated with the built-in message converters */
private static final Set<String> WHITELISTED_EXTENSIONS = new HashSet<String>(Arrays.asList(
"txt", "text", "json", "xml", "atom", "rss", "png", "jpe", "jpeg", "jpg", "gif", "wbmp", "bmp"));
"txt", "text", "yml", "properties", "csv",
"json", "xml", "atom", "rss",
"png", "jpe", "jpeg", "jpg", "gif", "wbmp", "bmp"));
private final ContentNegotiationManager contentNegotiationManager;