Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix filtered HTTP headers in data binding

Browse Source 
Prior to this commit, several common HTTP headers were ignored from the
data binding process when collecting property values, in gh-34039 and
gh-34182.

This commit completes the initial enhancement by ensuring that the
default header predicate is also considering cases where constructor
binding is applied and the Java type has a lowercase variant of the HTTP
header name to filter.

Fixes gh-34292
This commit is contained in:
Brian Clozel
2025-01-29 16:06:19 +01:00
parent 7c5b6f1e1c
commit d80de043ce
4 changed files with 35 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/ExtendedServletRequestDataBinder.java
View File

@@ -19,6 +19,7 @@ package org.springframework.web.servlet.mvc.method.annotation;
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.List;
import java.util.Locale;
import java.util.Map;
import java.util.Set;
import java.util.function.Predicate;
@@ -39,7 +40,7 @@ import org.springframework.web.servlet.HandlerMapping;
*
* <p><strong>WARNING</strong>: Data binding can lead to security issues by exposing
* parts of the object graph that are not meant to be accessed or modified by
* external clients. Therefore the design and use of data binding should be considered
* external clients. Therefore, the design and use of data binding should be considered
* carefully with regard to security. For more details, please refer to the dedicated
* sections on data binding for
* <a href="https://docs.spring.io/spring-framework/docs/current/reference/html/web.html#mvc-ann-initbinder-model-design">Spring Web MVC</a> and
@@ -53,11 +54,11 @@ import org.springframework.web.servlet.HandlerMapping;
*/
public class ExtendedServletRequestDataBinder extends ServletRequestDataBinder {
private static final Set<String> FILTERED_HEADER_NAMES = Set.of("Accept", "Authorization", "Connection",
"Cookie", "From", "Host", "Origin", "Priority", "Range", "Referer", "Upgrade");
private static final Set<String> FILTERED_HEADER_NAMES = Set.of("accept", "authorization", "connection",
"cookie", "from", "host", "origin", "priority", "range", "referer", "upgrade");
private Predicate<String> headerPredicate = name -> !FILTERED_HEADER_NAMES.contains(name);
private Predicate<String> headerPredicate = name -> !FILTERED_HEADER_NAMES.contains(name.toLowerCase(Locale.ROOT));
/**