Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Expand range of whitelisted extensions by media type

Browse Source 
This commit expands the range of whitelisted extensions by checking
if an extension can be resolved to image/*, audio/*, video/*, as well
as any content type that ends with +xml.

Issue: SPR-13643
This commit is contained in:
Rossen Stoyanchev
2015-11-11 17:46:36 -05:00
parent cde4431c80
commit f5f57e9544
3 changed files with 62 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/AbstractMessageConverterMethodProcessor.java
View File

@@ -39,6 +39,8 @@ import org.springframework.util.CollectionUtils;
import org.springframework.util.StringUtils;
import org.springframework.web.HttpMediaTypeNotAcceptableException;
import org.springframework.web.accept.ContentNegotiationManager;
import org.springframework.web.accept.ContentNegotiationStrategy;
import org.springframework.web.accept.PathExtensionContentNegotiationStrategy;
import org.springframework.web.context.request.NativeWebRequest;
import org.springframework.web.context.request.ServletWebRequest;
import org.springframework.web.method.support.HandlerMethodReturnValueHandler;
@@ -73,8 +75,14 @@ public abstract class AbstractMessageConverterMethodProcessor extends AbstractMe
"json", "xml", "atom", "rss",
"png", "jpe", "jpeg", "jpg", "gif", "wbmp", "bmp"));
private static final Set<String> WHITELISTED_MEDIA_BASE_TYPES = new HashSet<String>(
Arrays.asList("audio", "image", "video"));
private final ContentNegotiationManager contentNegotiationManager;
private final PathExtensionContentNegotiationStrategy pathStrategy;
private final ResponseBodyAdviceChain adviceChain;
private final Set<String> safeExtensions = new HashSet<String>();
@@ -94,11 +102,21 @@ public abstract class AbstractMessageConverterMethodProcessor extends AbstractMe
super(messageConverters);
this.contentNegotiationManager = (manager != null ? manager : new ContentNegotiationManager());
this.pathStrategy = initPathStrategy(this.contentNegotiationManager);
this.adviceChain = new ResponseBodyAdviceChain(responseBodyAdvice);
this.safeExtensions.addAll(this.contentNegotiationManager.getAllFileExtensions());
this.safeExtensions.addAll(WHITELISTED_EXTENSIONS);
}
private static PathExtensionContentNegotiationStrategy initPathStrategy(ContentNegotiationManager manager) {
for (ContentNegotiationStrategy strategy : manager.getStrategies()) {
if (strategy instanceof PathExtensionContentNegotiationStrategy) {
return (PathExtensionContentNegotiationStrategy) strategy;
}
}
return new PathExtensionContentNegotiationStrategy();
}
protected ResponseBodyAdviceChain getAdviceChain() {
return this.adviceChain;
@@ -322,7 +340,31 @@ public abstract class AbstractMessageConverterMethodProcessor extends AbstractMe
return true;
}
}
return false;
return safeMediaTypesForExtension(extension);
}
private boolean safeMediaTypesForExtension(String extension) {
List<MediaType> mediaTypes = null;
try {
mediaTypes = this.pathStrategy.resolveMediaTypeKey(null, extension);
}
catch (HttpMediaTypeNotAcceptableException e) {
// Ignore
}
if (CollectionUtils.isEmpty(mediaTypes)) {
return false;
}
for (MediaType mediaType : mediaTypes) {
if (!safeMediaType(mediaType)) {
return false;
}
}
return true;
}
private boolean safeMediaType(MediaType mediaType) {
return (WHITELISTED_MEDIA_BASE_TYPES.contains(mediaType.getType()) ||
mediaType.getSubtype().endsWith("+xml"));
}
}