Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Publish Constants for Firewall Header and Parameter Predicates

Browse Source 
Introduced public static final Predicates for allowed header names,
header values, parameter names, and parameter values for building
expressions.

Closes gh-13639
This commit is contained in:
baezzys
2024-06-01 12:15:44 +09:00
committed by Josh Cummings
parent df76537470
commit 4169c0cf36
2 changed files with 51 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java
View File

@@ -75,6 +75,7 @@ import org.springframework.util.Assert;
*
* @author Rob Winch
* @author Eddú Meléndez
* @author Jinwoo Bae
* @since 4.2.4
* @see DefaultHttpFirewall
*/
@@ -134,13 +135,21 @@ public class StrictHttpFirewall implements HttpFirewall {
private static final Predicate<String> HEADER_VALUE_PREDICATE = (s) -> HEADER_VALUE_PATTERN.matcher(s).matches();
private Predicate<String> allowedHeaderNames = ASSIGNED_AND_NOT_ISO_CONTROL_PREDICATE;
private Predicate<String> allowedHeaderNames = ALLOWED_HEADER_NAMES;
private Predicate<String> allowedHeaderValues = HEADER_VALUE_PREDICATE;
public static final Predicate<String> ALLOWED_HEADER_NAMES = ASSIGNED_AND_NOT_ISO_CONTROL_PREDICATE;
private Predicate<String> allowedParameterNames = ASSIGNED_AND_NOT_ISO_CONTROL_PREDICATE;
private Predicate<String> allowedHeaderValues = ALLOWED_HEADER_VALUES;
private Predicate<String> allowedParameterValues = (value) -> true;
public static final Predicate<String> ALLOWED_HEADER_VALUES = HEADER_VALUE_PREDICATE;
private Predicate<String> allowedParameterNames = ALLOWED_PARAMETER_NAMES;
public static final Predicate<String> ALLOWED_PARAMETER_NAMES = ASSIGNED_AND_NOT_ISO_CONTROL_PREDICATE;
private Predicate<String> allowedParameterValues = ALLOWED_PARAMETER_VALUES;
public static final Predicate<String> ALLOWED_PARAMETER_VALUES = (value) -> true;
public StrictHttpFirewall() {
urlBlocklistsAddAll(FORBIDDEN_SEMICOLON);