Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

LocaleChangeInterceptor validates locale values in order to prevent XSS vulnerability (SPR-7779)

Browse Source
This commit is contained in:
Juergen Hoeller
2011-01-26 20:30:30 +00:00
parent b3f039ae5f
commit f4a2282d9d
3 changed files with 26 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
org.springframework.core/src/main/java/org/springframework/util/StringUtils.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2010 the original author or authors.
* Copyright 2002-2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -643,7 +643,7 @@ public abstract class StringUtils {
}
/**
* Parse the given <code>localeString</code> into a {@link Locale}.
* Parse the given <code>localeString</code> value into a {@link Locale}.
* <p>This is the inverse operation of {@link Locale#toString Locale's toString}.
* @param localeString the locale string, following <code>Locale's</code>
* <code>toString()</code> format ("en", "en_UK", etc);
@@ -651,6 +651,13 @@ public abstract class StringUtils {
* @return a corresponding <code>Locale</code> instance
*/
public static Locale parseLocaleString(String localeString) {
for (int i = 0; i < localeString.length(); i++) {
char ch = localeString.charAt(i);
if (ch != '_' && !Character.isLetterOrDigit(ch)) {
throw new IllegalArgumentException(
"Locale value \"" + localeString + "\" contains invalid characters");
}
}
String[] parts = tokenizeToStringArray(localeString, "_ ", false, false);
String language = (parts.length > 0 ? parts[0] : "");
String country = (parts.length > 1 ? parts[1] : "");

15
org.springframework.core/src/test/java/org/springframework/util/StringUtilsTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2008 the original author or authors.
* Copyright 2002-2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -611,4 +611,17 @@ public class StringUtilsTests extends TestCase {
assertEquals("Multi-valued variant portion of the Locale not extracted correctly.", variant, locale.getVariant());
}
/**
* <a href="http://opensource.atlassian.com/projects/spring/browse/SPR-7779">See SPR-7779</a>.
*/
public void testParseLocaleWithInvalidCharacters() {
try {
StringUtils.parseLocaleString("%0D%0AContent-length:30%0D%0A%0D%0A%3Cscript%3Ealert%28123%29%3C/script%3E");
fail("Should have thrown IllegalArgumentException");
}
catch (IllegalArgumentException ex) {
// expected
}
}
}