Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish gh-16214

Browse Source 
This commit applies the following changes:

* Added local Content-Security-Policy with script-src nonce directive
* Removed form-redirect.js and associated changes
* Renamed to FormPostRedirectStrategy
* Removed HtmlUtils usage
* Moved to same package as DefaultRedirectStrategy
This commit is contained in:
Steve Riesenberg
2025-01-28 11:29:14 -06:00
parent 58534e7f60
commit 54a6a19e05
12 changed files with 147 additions and 260 deletions
Download Patch File Download Diff File Expand all files Collapse all files

116
web/src/main/java/org/springframework/security/web/FormPostRedirectStrategy.java Normal file
View File

@@ -0,0 +1,116 @@
/*
* Copyright 2002-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web;
import java.io.IOException;
import java.util.Base64;
import java.util.List;
import java.util.Map.Entry;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.security.crypto.keygen.Base64StringKeyGenerator;
import org.springframework.security.crypto.keygen.StringKeyGenerator;
import org.springframework.web.util.HtmlUtils;
import org.springframework.web.util.UriComponentsBuilder;
/**
* Redirect using an auto-submitting HTML form using the POST method. All query params
* provided in the URL are changed to inputs in the form so they are submitted as POST
* data instead of query string data.
*
* @author Craig Andrews
* @author Steve Riesenberg
* @since 6.5
*/
public final class FormPostRedirectStrategy implements RedirectStrategy {
private static final String CONTENT_SECURITY_POLICY_HEADER = "Content-Security-Policy";
private static final String REDIRECT_PAGE_TEMPLATE = """
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<meta name="description" content="">
<meta name="author" content="">
<title>Redirect</title>
</head>
<body>
<form id="redirect-form" method="POST" action="{{action}}">
{{params}}
<noscript>
<p>JavaScript is not enabled for this page.</p>
<button type="submit">Click to continue</button>
</noscript>
</form>
<script nonce="{{nonce}}">
document.getElementById("redirect-form").submit();
</script>
</body>
</html>
""";
private static final String HIDDEN_INPUT_TEMPLATE = """
<input name="{{name}}" type="hidden" value="{{value}}" />
""";
private static final StringKeyGenerator DEFAULT_NONCE_GENERATOR = new Base64StringKeyGenerator(
Base64.getUrlEncoder().withoutPadding(), 96);
@Override
public void sendRedirect(final HttpServletRequest request, final HttpServletResponse response, final String url)
throws IOException {
final UriComponentsBuilder uriComponentsBuilder = UriComponentsBuilder.fromUriString(url);
final StringBuilder hiddenInputsHtmlBuilder = new StringBuilder();
for (final Entry<String, List<String>> entry : uriComponentsBuilder.build().getQueryParams().entrySet()) {
final String name = entry.getKey();
for (final String value : entry.getValue()) {
// @formatter:off
final String hiddenInput = HIDDEN_INPUT_TEMPLATE
.replace("{{name}}", HtmlUtils.htmlEscape(name))
.replace("{{value}}", HtmlUtils.htmlEscape(value));
// @formatter:on
hiddenInputsHtmlBuilder.append(hiddenInput.trim());
}
}
// Create the script-src policy directive for the Content-Security-Policy header
final String nonce = DEFAULT_NONCE_GENERATOR.generateKey();
final String policyDirective = "script-src 'nonce-%s'".formatted(nonce);
// @formatter:off
final String html = REDIRECT_PAGE_TEMPLATE
// Clear the query string as we don't want that to be part of the form action URL
.replace("{{action}}", HtmlUtils.htmlEscape(uriComponentsBuilder.query(null).build().toUriString()))
.replace("{{params}}", hiddenInputsHtmlBuilder.toString())
.replace("{{nonce}}", HtmlUtils.htmlEscape(nonce));
// @formatter:on
response.setStatus(HttpStatus.OK.value());
response.setContentType(MediaType.TEXT_HTML_VALUE);
response.setHeader(CONTENT_SECURITY_POLICY_HEADER, policyDirective);
response.getWriter().write(html);
response.getWriter().flush();
}
}

5
web/src/main/java/org/springframework/security/web/aot/hint/WebMvcSecurityRuntimeHints.java
View File

@@ -54,11 +54,6 @@ class WebMvcSecurityRuntimeHints implements RuntimeHintsRegistrar {
hints.resources().registerResource(webauthnJavascript);
}
ClassPathResource redirect = new ClassPathResource("org/springframework/security/form-redirect.js");
if (redirect.exists()) {
hints.resources().registerResource(redirect);
}
}
}

16
web/src/main/java/org/springframework/security/web/authentication/ui/DefaultResourcesFilter.java
View File

@@ -111,20 +111,4 @@ public final class DefaultResourcesFilter extends GenericFilterBean {
new MediaType("text", "javascript", StandardCharsets.UTF_8));
}
/**
* Create an instance of {@link DefaultResourcesFilter} serving Spring Security's
* default webauthn javascript.
* <p>
* The created {@link DefaultResourcesFilter} matches requests
* {@code HTTP GET /form-redirect.js}, and returns the default webauthn javascript at
* {@code org/springframework/security/form-redirect.js} with content-type
* {@code text/javascript;charset=UTF-8}.
* @return -
*/
public static DefaultResourcesFilter formRedirectJavascript() {
return new DefaultResourcesFilter(AntPathRequestMatcher.antMatcher(HttpMethod.GET, "/form-redirect.js"),
new ClassPathResource("org/springframework/security/form-redirect.js"),
new MediaType("text", "javascript", StandardCharsets.UTF_8));
}
}

17
web/src/main/java/org/springframework/security/web/server/ui/DefaultResourcesWebFilter.java
View File

@@ -98,21 +98,4 @@ public final class DefaultResourcesWebFilter implements WebFilter {
new MediaType("text", "css", StandardCharsets.UTF_8));
}
/**
* Create an instance of {@link DefaultResourcesWebFilter} serving Spring Security's
* form redirect javascript.
* <p>
* The created {@link DefaultResourcesFilter} matches requests
* {@code HTTP GET /form-redirect.js}, and returns the default javascript at
* {@code org/springframework/security/form-redirect.js} with content-type
* {@code text/javascript;charset=UTF-8}.
* @return -
*/
public static DefaultResourcesWebFilter formRedirectJavascript() {
return new DefaultResourcesWebFilter(
new PathPatternParserServerWebExchangeMatcher("/form-redirect.js", HttpMethod.GET),
new ClassPathResource("org/springframework/security/form-redirect.js"),
new MediaType("text", "javascript", StandardCharsets.UTF_8));
}
}

95
web/src/main/java/org/springframework/security/web/server/ui/FormRedirectStrategy.java
View File

@@ -1,95 +0,0 @@
/*
* Copyright 2002-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web.server.ui;
import java.io.IOException;
import java.util.List;
import java.util.Map.Entry;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.security.web.RedirectStrategy;
import org.springframework.web.util.UriComponentsBuilder;
/**
* Redirect using an autosubmitting HTML form using the POST method. All query params
* provided in the URL are changed to inputs in the form so they are submitted as POST
* data instead of query string data.
*/
/* default */ class FormRedirectStrategy implements RedirectStrategy {
private static final String REDIRECT_PAGE_TEMPLATE = """
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<meta name="description" content="">
<meta name="author" content="">
<title>Redirect</title>
<link href="{{contextPath}}/default-ui.css" rel="stylesheet" />
</head>
<body>
<div class="content">
<form id="redirectForm" class="redirect-form" method="POST" action="{{action}}">
{{params}}
<button class="primary" type="submit">Click to Continue</button>
</form>
</div>
<script src="{{contextPath}}/form-redirect.js"></script>
</body>
</html>
""";
private static final String HIDDEN_INPUT_TEMPLATE = """
<input name="{{name}}" type="hidden" value="{{value}}" />
""";
@Override
public void sendRedirect(final HttpServletRequest request, final HttpServletResponse response, final String url)
throws IOException {
final UriComponentsBuilder uriComponentsBuilder = UriComponentsBuilder.fromUriString(url);
final StringBuilder hiddenInputsHtmlBuilder = new StringBuilder();
// inputs
for (final Entry<String, List<String>> entry : uriComponentsBuilder.build().getQueryParams().entrySet()) {
final String name = entry.getKey();
for (final String value : entry.getValue()) {
hiddenInputsHtmlBuilder.append(HtmlTemplates.fromTemplate(HIDDEN_INPUT_TEMPLATE)
.withValue("name", name)
.withValue("value", value)
.render());
}
}
final String html = HtmlTemplates.fromTemplate(REDIRECT_PAGE_TEMPLATE)
// clear the query string as we don't want that to be part of the form action
// URL
.withValue("action", uriComponentsBuilder.query(null).build().toUriString())
.withRawHtml("params", hiddenInputsHtmlBuilder.toString())
.withValue("contextPath", request.getContextPath())
.render();
response.setStatus(HttpStatus.OK.value());
response.setContentType(MediaType.TEXT_HTML_VALUE);
response.getWriter().write(html);
response.getWriter().flush();
}
}

1
web/src/main/resources/org/springframework/security/form-redirect.js
View File

@@ -1 +0,0 @@
document.getElementById("redirectForm").submit();