Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add section on RFD + whitelist yml/properties/csv

Browse Source 
Issue: SPR-13643
This commit is contained in:
Rossen Stoyanchev
2015-11-05 16:39:03 -05:00
parent b46a301e8a
commit f0464e8176
4 changed files with 98 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
spring-web/src/main/java/org/springframework/web/accept/ContentNegotiationManagerFactoryBean.java
View File

@@ -118,11 +118,15 @@ public class ContentNegotiationManagerFactoryBean
}
/**
* Add mappings from keys, extracted from a path extension or a query
* Add a mapping from a key, extracted from a path extension or a query
* parameter, to a MediaType. This is required in order for the parameter
* strategy to work. The path extension strategy will also try
* {@link ServletContext#getMimeType} and JAF if it is present and is not
* suppressed via {@link #setUseJaf}.
* strategy to work. Any extensions explicitly registered here are also
* whitelisted for the purpose of Reflected File Download attack detection
* (see Spring Framework reference documentation for more details on RFD
* attack protection).
* <p>The path extension strategy will also try to use
* {@link ServletContext#getMimeType} and JAF (if present) to resolve path
* extensions. To change this behavior see the {@link #useJaf} property.
* @param mediaTypes media type mappings
* @see #addMediaType(String, MediaType)
* @see #addMediaTypes(Map)