Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Check scheme in (WebUtils|CorsUtils)#isSameOrigin

Browse Source 
Issue: SPR-16362
This commit is contained in:
Sebastien Deleuze
2018-08-08 11:31:18 +02:00
parent 7e9b7102b7
commit 896eb5687a
4 changed files with 42 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
spring-web/src/main/java/org/springframework/web/cors/reactive/CorsUtils.java
View File

@@ -69,13 +69,16 @@ public abstract class CorsUtils {
}
URI uri = request.getURI();
String actualScheme = uri.getScheme();
String actualHost = uri.getHost();
int actualPort = getPort(uri.getScheme(), uri.getPort());
Assert.notNull(actualScheme, "Actual request scheme must not be null");
Assert.notNull(actualHost, "Actual request host must not be null");
Assert.isTrue(actualPort != -1, "Actual request port must not be undefined");
UriComponents originUrl = UriComponentsBuilder.fromOriginHeader(origin).build();
return (actualHost.equals(originUrl.getHost()) &&
return (actualScheme.equals(originUrl.getScheme()) &&
actualHost.equals(originUrl.getHost()) &&
actualPort == getPort(originUrl.getScheme(), originUrl.getPort()));
}

3
spring-web/src/main/java/org/springframework/web/util/WebUtils.java
View File

@@ -813,7 +813,8 @@ public abstract class WebUtils {
}
UriComponents originUrl = UriComponentsBuilder.fromOriginHeader(origin).build();
return (ObjectUtils.nullSafeEquals(host, originUrl.getHost()) &&
return (ObjectUtils.nullSafeEquals(scheme, originUrl.getScheme()) &&
ObjectUtils.nullSafeEquals(host, originUrl.getHost()) &&
getPort(scheme, port) == getPort(originUrl.getScheme(), originUrl.getPort()));
}