Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Allow tab in HTTP header values.

Browse Source 
Closes gh-14573
This commit is contained in:
Christian Becker
2024-02-11 22:37:35 +01:00
committed by Josh Cummings
parent 45c37c4454
commit 2f762fefe1
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
web/src/test/java/org/springframework/security/web/firewall/StrictHttpFirewallTests.java
View File

@@ -782,6 +782,13 @@ public class StrictHttpFirewallTests {
assertThatExceptionOfType(RequestRejectedException.class).isThrownBy(() -> request.getHeader("Something"));
}
@Test
public void getFirewalledRequestGetHeaderWhenHorizontalTabInHeaderValueThenNoException() {
this.request.addHeader("Something", "tab\tvalue");
HttpServletRequest request = this.firewall.getFirewalledRequest(this.request);
assertThat(request.getHeader("Something")).isEqualTo("tab\tvalue");
}
@Test
public void getFirewalledRequestGetHeaderWhenUndefinedCharacterInHeaderValueThenException() {
this.request.addHeader("Something", "bad\uFFFEvalue");