Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix filtered HTTP headers in data binding

Browse Source 
Prior to this commit, several common HTTP headers were ignored from the
data binding process when collecting property values, in gh-34039 and
gh-34182.

This commit completes the initial enhancement by ensuring that the
default header predicate is also considering cases where constructor
binding is applied and the Java type has a lowercase variant of the HTTP
header name to filter.

Fixes gh-34292
This commit is contained in:
Brian Clozel
2025-01-29 16:06:19 +01:00
parent 7c5b6f1e1c
commit d80de043ce
4 changed files with 35 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
spring-webflux/src/main/java/org/springframework/web/reactive/result/method/annotation/ExtendedWebExchangeDataBinder.java
View File

@@ -17,6 +17,7 @@
package org.springframework.web.reactive.result.method.annotation;
import java.util.List;
import java.util.Locale;
import java.util.Map;
import java.util.Set;
import java.util.function.Predicate;
@@ -43,11 +44,11 @@ import org.springframework.web.server.ServerWebExchange;
*/
public class ExtendedWebExchangeDataBinder extends WebExchangeDataBinder {
private static final Set<String> FILTERED_HEADER_NAMES = Set.of("Accept", "Authorization", "Connection",
"Cookie", "From", "Host", "Origin", "Priority", "Range", "Referer", "Upgrade");
private static final Set<String> FILTERED_HEADER_NAMES = Set.of("accept", "authorization", "connection",
"cookie", "from", "host", "origin", "priority", "range", "referer", "upgrade");
private Predicate<String> headerPredicate = name -> !FILTERED_HEADER_NAMES.contains(name);
private Predicate<String> headerPredicate = name -> !FILTERED_HEADER_NAMES.contains(name.toLowerCase(Locale.ROOT));
public ExtendedWebExchangeDataBinder(@Nullable Object target, String objectName) {

2
spring-webflux/src/test/java/org/springframework/web/reactive/result/method/annotation/InitBinderBindingContextTests.java
View File

@@ -224,7 +224,7 @@ class InitBinderBindingContextTests {
@ParameterizedTest
@ValueSource(strings = {"Accept", "Authorization", "Connection",
"Cookie", "From", "Host", "Origin", "Priority", "Range", "Referer", "Upgrade"})
"Cookie", "From", "Host", "Origin", "Priority", "Range", "Referer", "Upgrade", "priority"})
void filteredHeaders(String headerName) throws Exception {
MockServerHttpRequest request = MockServerHttpRequest.get("/path")
.header(headerName, "u1")