Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Protect against RFD exploits

Browse Source 
Issue: SPR-13548
This commit is contained in:
Rossen Stoyanchev
2015-10-09 13:51:50 -04:00
committed by Stephane Nicoll
parent 271e5fd76a
commit a95c3d820d
19 changed files with 421 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
spring-websocket/src/test/java/org/springframework/web/socket/sockjs/support/SockJsServiceTests.java
View File

@@ -76,6 +76,7 @@ public class SockJsServiceTests extends AbstractHttpRequestTests {
resetResponseAndHandleRequest("GET", "/echo/server/session/", HttpStatus.NOT_FOUND);
resetResponseAndHandleRequest("GET", "/echo/s.erver/session/websocket", HttpStatus.NOT_FOUND);
resetResponseAndHandleRequest("GET", "/echo/server/s.ession/websocket", HttpStatus.NOT_FOUND);
resetResponseAndHandleRequest("GET", "/echo/server/session/jsonp;Setup.pl", HttpStatus.NOT_FOUND);
}
@Test

46
spring-websocket/src/test/java/org/springframework/web/socket/sockjs/transport/handler/HttpSendingTransportHandlerTests.java
View File

@@ -24,6 +24,7 @@ import org.junit.Test;
import org.springframework.scheduling.TaskScheduler;
import org.springframework.web.socket.AbstractHttpRequestTests;
import org.springframework.web.socket.WebSocketHandler;
import org.springframework.web.socket.sockjs.SockJsTransportFailureException;
import org.springframework.web.socket.sockjs.frame.SockJsFrame;
import org.springframework.web.socket.sockjs.frame.SockJsFrameFormat;
import org.springframework.web.socket.sockjs.transport.session.AbstractSockJsSession;
@@ -91,24 +92,45 @@ public class HttpSendingTransportHandlerTests extends AbstractHttpRequestTests
@Test
public void jsonpTransport() throws Exception {
testJsonpTransport(null, false);
testJsonpTransport("_jp123xYz", true);
testJsonpTransport("A..B__3..4", true);
testJsonpTransport("!jp!abc", false);
testJsonpTransport("<script>", false);
testJsonpTransport("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_.", true);
}
private void testJsonpTransport(String callbackValue, boolean expectSuccess) throws Exception {
JsonpPollingTransportHandler transportHandler = new JsonpPollingTransportHandler();
transportHandler.initialize(this.sockJsConfig);
PollingSockJsSession session = transportHandler.createSession("1", this.webSocketHandler, null);
transportHandler.handleRequest(this.request, this.response, this.webSocketHandler, session);
assertEquals(500, this.servletResponse.getStatus());
assertEquals("\"callback\" parameter required", this.servletResponse.getContentAsString());
resetRequestAndResponse();
setRequest("POST", "/");
this.servletRequest.setQueryString("c=callback");
this.servletRequest.addParameter("c", "callback");
transportHandler.handleRequest(this.request, this.response, this.webSocketHandler, session);
assertEquals("application/javascript;charset=UTF-8", this.response.getHeaders().getContentType().toString());
assertFalse("Polling request should complete after open frame", this.servletRequest.isAsyncStarted());
verify(this.webSocketHandler).afterConnectionEstablished(session);
if (callbackValue != null) {
this.servletRequest.setQueryString("c=" + callbackValue);
this.servletRequest.addParameter("c", callbackValue);
}
try {
transportHandler.handleRequest(this.request, this.response, this.webSocketHandler, session);
}
catch (SockJsTransportFailureException ex) {
if (expectSuccess) {
throw new AssertionError("Unexpected transport failure", ex);
}
}
if (expectSuccess) {
assertEquals(200, this.servletResponse.getStatus());
assertEquals("application/javascript;charset=UTF-8", this.response.getHeaders().getContentType().toString());
verify(this.webSocketHandler).afterConnectionEstablished(session);
}
else {
assertEquals(500, this.servletResponse.getStatus());
verifyNoMoreInteractions(this.webSocketHandler);
}
}
@Test
@@ -184,7 +206,7 @@ public class HttpSendingTransportHandlerTests extends AbstractHttpRequestTests
format = new JsonpPollingTransportHandler().getFrameFormat(this.request);
formatted = format.format(frame);
assertEquals("callback(\"" + frame.getContent() + "\");\r\n", formatted);
assertEquals("/**/callback(\"" + frame.getContent() + "\");\r\n", formatted);
}
}