Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Reject invalid forwarded headers

Browse Source 
Issue: SPR-16660
This commit is contained in:
Rossen Stoyanchev
2018-03-29 16:16:20 -04:00
parent bcda243f63
commit e8c656d2bc
1 changed files with 33 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java
View File

@@ -677,35 +677,42 @@ public class UriComponentsBuilder implements Cloneable {
* @since 4.2.7 * @since 4.2.7
*/ */
UriComponentsBuilder adaptFromForwardedHeaders(HttpHeaders headers) { UriComponentsBuilder adaptFromForwardedHeaders(HttpHeaders headers) {
String forwardedHeader = headers.getFirst("Forwarded"); try {
if (StringUtils.hasText(forwardedHeader)) { String forwardedHeader = headers.getFirst("Forwarded");
String forwardedToUse = StringUtils.tokenizeToStringArray(forwardedHeader, ",")[0]; if (StringUtils.hasText(forwardedHeader)) {
Matcher matcher = FORWARDED_PROTO_PATTERN.matcher(forwardedToUse); String forwardedToUse = StringUtils.tokenizeToStringArray(forwardedHeader, ",")[0];
if (matcher.find()) { Matcher matcher = FORWARDED_PROTO_PATTERN.matcher(forwardedToUse);
scheme(matcher.group(1).trim()); if (matcher.find()) {
port(null); scheme(matcher.group(1).trim());
port(null);
}
matcher = FORWARDED_HOST_PATTERN.matcher(forwardedToUse);
if (matcher.find()) {
adaptForwardedHost(matcher.group(1).trim());
}
} }
matcher = FORWARDED_HOST_PATTERN.matcher(forwardedToUse); else {
if (matcher.find()) { String protocolHeader = headers.getFirst("X-Forwarded-Proto");
adaptForwardedHost(matcher.group(1).trim()); if (StringUtils.hasText(protocolHeader)) {
scheme(StringUtils.tokenizeToStringArray(protocolHeader, ",")[0]);
port(null);
}
String hostHeader = headers.getFirst("X-Forwarded-Host");
if (StringUtils.hasText(hostHeader)) {
adaptForwardedHost(StringUtils.tokenizeToStringArray(hostHeader, ",")[0]);
}
String portHeader = headers.getFirst("X-Forwarded-Port");
if (StringUtils.hasText(portHeader)) {
port(Integer.parseInt(StringUtils.tokenizeToStringArray(portHeader, ",")[0]));
}
} }
} }
else { catch (NumberFormatException ex) {
String protocolHeader = headers.getFirst("X-Forwarded-Proto"); throw new IllegalArgumentException("Failed to parse a port from \"forwarded\"-type headers. " +
if (StringUtils.hasText(protocolHeader)) { "If not behind a trusted proxy, consider using ForwardedHeaderFilter " +
scheme(StringUtils.tokenizeToStringArray(protocolHeader, ",")[0]); "with the removeOnly=true. Request headers: " + headers);
port(null);
}
String hostHeader = headers.getFirst("X-Forwarded-Host");
if (StringUtils.hasText(hostHeader)) {
adaptForwardedHost(StringUtils.tokenizeToStringArray(hostHeader, ",")[0]);
}
String portHeader = headers.getFirst("X-Forwarded-Port");
if (StringUtils.hasText(portHeader)) {
port(Integer.parseInt(StringUtils.tokenizeToStringArray(portHeader, ",")[0]));
}
} }
if (this.scheme != null && ((this.scheme.equals("http") && "80".equals(this.port)) || if (this.scheme != null && ((this.scheme.equals("http") && "80".equals(this.port)) ||