Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Restrict HTTP methods on Servlet HiddenHttpMethodFilter

Browse Source 
This commit restricts the allowed HTTP methods on HiddenHttpMethodFilter
(Servlet variant) to the following: PUT, DELETE, PATCH.

This filter is meant to be used to simulate those methods from HTML
forms sent by browsers, so no other methods are allowed.

Issue: SPR-16836
This commit is contained in:
Brian Clozel
2018-05-18 10:56:50 +02:00
parent d196cdc5cd
commit f64fa3dea1
2 changed files with 38 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
spring-web/src/test/java/org/springframework/web/filter/HiddenHttpMethodFilterTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2014 the original author or authors.
* Copyright 2002-2018 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -31,7 +31,10 @@ import org.springframework.mock.web.test.MockHttpServletResponse;
import static org.junit.Assert.*;
/**
* Tests for {@link HiddenHttpMethodFilter}.
*
* @author Arjen Poutsma
* @author Brian Clozel
*/
public class HiddenHttpMethodFilterTests {
@@ -39,25 +42,29 @@ public class HiddenHttpMethodFilterTests {
@Test
public void filterWithParameter() throws IOException, ServletException {
MockHttpServletRequest request = new MockHttpServletRequest("POST", "/hotels");
request.addParameter("_method", "delete");
MockHttpServletResponse response = new MockHttpServletResponse();
filterWithParameterForMethod("delete", "DELETE");
filterWithParameterForMethod("put", "PUT");
filterWithParameterForMethod("patch", "PATCH");
}
FilterChain filterChain = new FilterChain() {
@Override
public void doFilter(ServletRequest filterRequest,
ServletResponse filterResponse) throws IOException, ServletException {
assertEquals("Invalid method", "DELETE",
((HttpServletRequest) filterRequest).getMethod());
}
};
filter.doFilter(request, response, filterChain);
@Test
public void filterWithParameterDisallowedMethods() throws IOException, ServletException {
filterWithParameterForMethod("trace", "POST");
filterWithParameterForMethod("head", "POST");
filterWithParameterForMethod("options", "POST");
}
@Test
public void filterWithNoParameter() throws IOException, ServletException {
filterWithParameterForMethod(null, "POST");
}
private void filterWithParameterForMethod(String methodParam, String expectedMethod)
throws IOException, ServletException {
MockHttpServletRequest request = new MockHttpServletRequest("POST", "/hotels");
if(methodParam != null) {
request.addParameter("_method", methodParam);
}
MockHttpServletResponse response = new MockHttpServletResponse();
FilterChain filterChain = new FilterChain() {
@@ -65,11 +72,11 @@ public class HiddenHttpMethodFilterTests {
@Override
public void doFilter(ServletRequest filterRequest,
ServletResponse filterResponse) throws IOException, ServletException {
assertEquals("Invalid method", "POST",
assertEquals("Invalid method", expectedMethod,
((HttpServletRequest) filterRequest).getMethod());
}
};
filter.doFilter(request, response, filterChain);
this.filter.doFilter(request, response, filterChain);
}
}