From 9f4d4d18297581ad770a6281097f733c4f6342d3 Mon Sep 17 00:00:00 2001
From: Rossen Stoyanchev <rstoyanchev@gopivotal.com>
Date: Wed, 11 Jun 2014 22:40:48 -0400
Subject: [PATCH] Check X-Forwarded-Host in ServletUriComponentsBuilder

Issue: SPR-11855
---
 .../support/ServletUriComponentsBuilder.java  | 16 ++++++++-----
 .../ServletUriComponentsBuilderTests.java     | 23 ++++++++++++++++---
 2 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/support/ServletUriComponentsBuilder.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/support/ServletUriComponentsBuilder.java
index 0cc50024e5..d9879dbe6f 100644
--- a/spring-webmvc/src/main/java/org/springframework/web/servlet/support/ServletUriComponentsBuilder.java
+++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/support/ServletUriComponentsBuilder.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2013 the original author or authors.
+ * Copyright 2002-2014 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -97,13 +97,12 @@ public class ServletUriComponentsBuilder extends UriComponentsBuilder {
 	 */
 	public static ServletUriComponentsBuilder fromRequest(HttpServletRequest request) {
 		String scheme = request.getScheme();
-		int port = request.getServerPort();
 		String host = request.getServerName();
+		int port = request.getServerPort();
 
-		String header = request.getHeader("X-Forwarded-Host");
-
-		if (StringUtils.hasText(header)) {
-			String[] hosts = StringUtils.commaDelimitedListToStringArray(header);
+		String hostHeader = request.getHeader("X-Forwarded-Host");
+		if (StringUtils.hasText(hostHeader)) {
+			String[] hosts = StringUtils.commaDelimitedListToStringArray(hostHeader);
 			String hostToUse = hosts[0];
 			if (hostToUse.contains(":")) {
 				String[] hostAndPort = StringUtils.split(hostToUse, ":");
@@ -115,6 +114,11 @@ public class ServletUriComponentsBuilder extends UriComponentsBuilder {
 			}
 		}
 
+		String portHeader = request.getHeader("X-Forwarded-Port");
+		if (StringUtils.hasText(portHeader)) {
+			port = Integer.parseInt(portHeader);
+		}
+
 		ServletUriComponentsBuilder builder = new ServletUriComponentsBuilder();
 		builder.scheme(scheme);
 		builder.host(host);
diff --git a/spring-webmvc/src/test/java/org/springframework/web/servlet/support/ServletUriComponentsBuilderTests.java b/spring-webmvc/src/test/java/org/springframework/web/servlet/support/ServletUriComponentsBuilderTests.java
index 9c11585610..16560cec29 100644
--- a/spring-webmvc/src/test/java/org/springframework/web/servlet/support/ServletUriComponentsBuilderTests.java
+++ b/spring-webmvc/src/test/java/org/springframework/web/servlet/support/ServletUriComponentsBuilderTests.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2013 the original author or authors.
+ * Copyright 2002-2014 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,8 +24,12 @@ import org.springframework.web.context.request.ServletRequestAttributes;
 import org.springframework.web.util.UriComponents;
 
 import static org.junit.Assert.*;
+import static org.junit.Assert.assertEquals;
 
 /**
+ * Unit tests for
+ * {@link org.springframework.web.servlet.support.ServletUriComponentsBuilder}.
+ *
  * @author Rossen Stoyanchev
  */
 public class ServletUriComponentsBuilderTests {
@@ -85,7 +89,7 @@ public class ServletUriComponentsBuilderTests {
 	}
 
 	@Test
-	public void fromRequestWithForwardedHostHeader() {
+	public void fromRequestWithForwardedHost() {
 		request.addHeader("X-Forwarded-Host", "anotherHost");
 		request.setRequestURI("/mvc-showcase/data/param");
 		request.setQueryString("foo=123");
@@ -97,7 +101,7 @@ public class ServletUriComponentsBuilderTests {
 	// SPR-10701
 
 	@Test
-	public void fromRequestWithForwardedHostAndPortHeader() {
+	public void fromRequestWithForwardedHostIncludingPort() {
 		request.addHeader("X-Forwarded-Host", "webtest.foo.bar.com:443");
 		request.setRequestURI("/mvc-showcase/data/param");
 		request.setQueryString("foo=123");
@@ -116,6 +120,19 @@ public class ServletUriComponentsBuilderTests {
 		assertEquals("a.example.org", ServletUriComponentsBuilder.fromRequest(this.request).build().getHost());
 	}
 
+	// SPR-11855
+
+	@Test
+	public void fromRequestWithForwardedHostAndPort() {
+		this.request.addHeader("X-Forwarded-Host", "foobarhost");
+		this.request.addHeader("X-Forwarded-Port", "9090");
+		this.request.setServerPort(8080);
+		UriComponents uriComponents = ServletUriComponentsBuilder.fromRequest(this.request).build();
+
+		assertEquals("foobarhost", uriComponents.getHost());
+		assertEquals(9090, uriComponents.getPort());
+	}
+
 	@Test
 	public void fromContextPath() {
 		request.setRequestURI("/mvc-showcase/data/param");