From 8d17bcea5b06979cca48c9e3cd75420a75b7f267 Mon Sep 17 00:00:00 2001
From: Rossen Stoyanchev <rstoyanchev@vmware.com>
Date: Tue, 25 May 2021 21:24:54 +0100
Subject: [PATCH] Validate top-level SockJS URL

Closes gh-26933
---
 .../web/socket/sockjs/support/AbstractSockJsService.java      | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/spring-websocket/src/main/java/org/springframework/web/socket/sockjs/support/AbstractSockJsService.java b/spring-websocket/src/main/java/org/springframework/web/socket/sockjs/support/AbstractSockJsService.java
index ac5c2271e4..682ac8dbcf 100644
--- a/spring-websocket/src/main/java/org/springframework/web/socket/sockjs/support/AbstractSockJsService.java
+++ b/spring-websocket/src/main/java/org/springframework/web/socket/sockjs/support/AbstractSockJsService.java
@@ -398,6 +398,10 @@ public abstract class AbstractSockJsService implements SockJsService, CorsConfig
 				if (requestInfo != null) {
 					logger.debug("Processing transport request: " + requestInfo);
 				}
+				if ("websocket".equalsIgnoreCase(request.getHeaders().getUpgrade())) {
+					response.setStatusCode(HttpStatus.BAD_REQUEST);
+					return;
+				}
 				response.getHeaders().setContentType(new MediaType("text", "plain", StandardCharsets.UTF_8));
 				response.getBody().write("Welcome to SockJS!\n".getBytes(StandardCharsets.UTF_8));
 			}