Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Validate top-level SockJS URL

Browse Source 
Closes gh-26933
This commit is contained in:
Rossen Stoyanchev
2021-05-25 21:24:54 +01:00
parent 597b31b1fc
commit 8d17bcea5b
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
spring-websocket/src/main/java/org/springframework/web/socket/sockjs/support/AbstractSockJsService.java
View File

@@ -398,6 +398,10 @@ public abstract class AbstractSockJsService implements SockJsService, CorsConfig
if (requestInfo != null) {
logger.debug("Processing transport request: " + requestInfo);
}
if ("websocket".equalsIgnoreCase(request.getHeaders().getUpgrade())) {
response.setStatusCode(HttpStatus.BAD_REQUEST);
return;
}
response.getHeaders().setContentType(new MediaType("text", "plain", StandardCharsets.UTF_8));
response.getBody().write("Welcome to SockJS!\n".getBytes(StandardCharsets.UTF_8));
}