Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish gh-16214

Browse Source 
This commit applies the following changes:

* Added local Content-Security-Policy with script-src nonce directive
* Removed form-redirect.js and associated changes
* Renamed to FormPostRedirectStrategy
* Removed HtmlUtils usage
* Moved to same package as DefaultRedirectStrategy
This commit is contained in:
Steve Riesenberg
2025-01-28 11:29:14 -06:00
parent 58534e7f60
commit 54a6a19e05
12 changed files with 147 additions and 260 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
web/src/test/java/org/springframework/security/web/server/ui/FormRedirectStrategyTests.java → web/src/test/java/org/springframework/security/web/FormPostRedirectStrategyTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2023 the original author or authors.
* Copyright 2002-2025 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -14,10 +14,11 @@
* limitations under the License.
*/
package org.springframework.security.web.server.ui;
package org.springframework.security.web;
import java.io.IOException;
import org.assertj.core.api.ThrowingConsumer;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
@@ -30,9 +31,11 @@ import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
import static org.assertj.core.api.Assertions.assertThat;
public class FormRedirectStrategyTests {
public class FormPostRedirectStrategyTests {
private FormRedirectStrategy formRedirectStrategy;
private static final String POLICY_DIRECTIVE_PATTERN = "script-src 'nonce-(.+)'";
private FormPostRedirectStrategy redirectStrategy;
private MockHttpServletRequest request;
@@ -40,7 +43,7 @@ public class FormRedirectStrategyTests {
@BeforeEach
public void beforeEach() {
this.formRedirectStrategy = new FormRedirectStrategy();
this.redirectStrategy = new FormPostRedirectStrategy();
final MockServletContext mockServletContext = new MockServletContext();
mockServletContext.setContextPath("/contextPath");
// the request URL doesn't matter
@@ -50,39 +53,43 @@ public class FormRedirectStrategyTests {
@Test
public void absoluteUrlNoParametersRedirect() throws IOException {
this.formRedirectStrategy.sendRedirect(this.request, this.response, "https://example.com");
this.redirectStrategy.sendRedirect(this.request, this.response, "https://example.com");
assertThat(this.response.getStatus()).isEqualTo(HttpStatus.OK.value());
assertThat(this.response.getContentType()).isEqualTo(MediaType.TEXT_HTML_VALUE);
assertThat(this.response.getContentAsString()).contains("action=\"https://example.com\"");
assertThat(this.response).satisfies(hasScriptSrcNonce());
}
@Test
public void rootRelativeUrlNoParametersRedirect() throws IOException {
this.formRedirectStrategy.sendRedirect(this.request, this.response, "/test");
this.redirectStrategy.sendRedirect(this.request, this.response, "/test");
assertThat(this.response.getStatus()).isEqualTo(HttpStatus.OK.value());
assertThat(this.response.getContentType()).isEqualTo(MediaType.TEXT_HTML_VALUE);
assertThat(this.response.getContentAsString()).contains("action=\"/test\"");
assertThat(this.response).satisfies(hasScriptSrcNonce());
}
@Test
public void relativeUrlNoParametersRedirect() throws IOException {
this.formRedirectStrategy.sendRedirect(this.request, this.response, "test");
this.redirectStrategy.sendRedirect(this.request, this.response, "test");
assertThat(this.response.getStatus()).isEqualTo(HttpStatus.OK.value());
assertThat(this.response.getContentType()).isEqualTo(MediaType.TEXT_HTML_VALUE);
assertThat(this.response.getContentAsString()).contains("action=\"test\"");
assertThat(this.response).satisfies(hasScriptSrcNonce());
}
@Test
public void absoluteUrlWithFragmentRedirect() throws IOException {
this.formRedirectStrategy.sendRedirect(this.request, this.response, "https://example.com/path#fragment");
this.redirectStrategy.sendRedirect(this.request, this.response, "https://example.com/path#fragment");
assertThat(this.response.getStatus()).isEqualTo(HttpStatus.OK.value());
assertThat(this.response.getContentType()).isEqualTo(MediaType.TEXT_HTML_VALUE);
assertThat(this.response.getContentAsString()).contains("action=\"https://example.com/path#fragment\"");
assertThat(this.response).satisfies(hasScriptSrcNonce());
}
@Test
public void absoluteUrlWithQueryParamsRedirect() throws IOException {
this.formRedirectStrategy.sendRedirect(this.request, this.response,
this.redirectStrategy.sendRedirect(this.request, this.response,
"https://example.com/path?param1=one&param2=two#fragment");
assertThat(this.response.getStatus()).isEqualTo(HttpStatus.OK.value());
assertThat(this.response.getContentType()).isEqualTo(MediaType.TEXT_HTML_VALUE);
@@ -91,6 +98,18 @@ public class FormRedirectStrategyTests {
.contains("<input name=\"param1\" type=\"hidden\" value=\"one\" />");
assertThat(this.response.getContentAsString())
.contains("<input name=\"param2\" type=\"hidden\" value=\"two\" />");
assertThat(this.response).satisfies(hasScriptSrcNonce());
}
private ThrowingConsumer<MockHttpServletResponse> hasScriptSrcNonce() {
return (response) -> {
final String policyDirective = response.getHeader("Content-Security-Policy");
assertThat(policyDirective).isNotEmpty();
assertThat(policyDirective).matches(POLICY_DIRECTIVE_PATTERN);
final String nonce = policyDirective.replaceFirst(POLICY_DIRECTIVE_PATTERN, "$1");
assertThat(response.getContentAsString()).contains("<script nonce=\"%s\">".formatted(nonce));
};
}
}

6
web/src/test/java/org/springframework/security/web/aot/hint/WebMvcSecurityRuntimeHintsTests.java
View File

@@ -74,10 +74,4 @@ class WebMvcSecurityRuntimeHintsTests {
.forResource("org/springframework/security/spring-security-webauthn.js")).accepts(this.hints);
}
@Test
void formRedirectJavascriptHasHints() {
assertThat(RuntimeHintsPredicates.resource().forResource("org/springframework/security/form-redirect.js"))
.accepts(this.hints);
}
}

31
web/src/test/java/org/springframework/security/web/authentication/ui/DefaultResourcesFilterTests.java
View File

@@ -94,35 +94,4 @@ public class DefaultResourcesFilterTests {
}
@Nested
class FormRedirectJavascriptFilter {
private final DefaultResourcesFilter formRedirectJavascriptFilter = DefaultResourcesFilter
.formRedirectJavascript();
private final MockMvc mockMvc = MockMvcBuilders.standaloneSetup(new Object())
.addFilters(this.formRedirectJavascriptFilter)
.build();
@Test
void doFilterThenRender() throws Exception {
this.mockMvc.perform(get("/form-redirect.js"))
.andExpect(status().isOk())
.andExpect(content().contentType("text/javascript;charset=UTF-8"))
.andExpect(content().string(containsString("submit")));
}
@Test
void doFilterWhenPathDoesNotMatchThenCallsThrough() throws Exception {
this.mockMvc.perform(get("/does-not-match")).andExpect(status().isNotFound());
}
@Test
void toStringPrintsPathAndResource() {
assertThat(this.formRedirectJavascriptFilter.toString()).isEqualTo(
"DefaultResourcesFilter [matcher=Ant [pattern='/form-redirect.js', GET], resource=org/springframework/security/form-redirect.js]");
}
}
}

77
web/src/test/java/org/springframework/security/web/server/ui/DefaultResourcesFormRedirectJavascriptWebFilterTests.java
View File

@@ -1,77 +0,0 @@
/*
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web.server.ui;
import java.nio.charset.StandardCharsets;
import java.util.List;
import org.junit.jupiter.api.Test;
import reactor.core.publisher.Mono;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
import org.springframework.mock.web.server.MockServerWebExchange;
import org.springframework.web.server.WebFilterChain;
import org.springframework.web.server.WebHandler;
import org.springframework.web.server.handler.DefaultWebFilterChain;
import static org.assertj.core.api.Assertions.assertThat;
/**
* @author Craig Andrews
* @since 6.4
*/
class DefaultResourcesFormRedirectJavascriptWebFilterTests {
private final WebHandler notFoundHandler = (exchange) -> {
exchange.getResponse().setStatusCode(HttpStatus.NOT_FOUND);
return Mono.empty();
};
private final DefaultResourcesWebFilter filter = DefaultResourcesWebFilter.formRedirectJavascript();
@Test
void filterWhenPathMatchesThenRenders() {
MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/form-redirect.js"));
WebFilterChain filterChain = new DefaultWebFilterChain(this.notFoundHandler, List.of(this.filter));
filterChain.filter(exchange).block();
assertThat(exchange.getResponse().getStatusCode()).isEqualTo(HttpStatus.OK);
assertThat(exchange.getResponse().getHeaders().getContentType())
.isEqualTo(new MediaType("text", "javascript", StandardCharsets.UTF_8));
assertThat(exchange.getResponse().getBodyAsString().block()).contains("document");
}
@Test
void filterWhenPathDoesNotMatchThenCallsThrough() {
MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/does-not-match"));
WebFilterChain filterChain = new DefaultWebFilterChain(this.notFoundHandler, List.of(this.filter));
filterChain.filter(exchange).block();
assertThat(exchange.getResponse().getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
}
@Test
void toStringPrintsPathAndResource() {
assertThat(this.filter.toString()).isEqualTo(
"DefaultResourcesWebFilter{matcher=PathMatcherServerWebExchangeMatcher{pattern='/form-redirect.js', method=GET}, resource='org/springframework/security/form-redirect.js'}");
}
}

2
web/src/test/java/org/springframework/security/web/server/ui/DefaultResourcesCssWebFilterTests.java → web/src/test/java/org/springframework/security/web/server/ui/DefaultResourcesWebFilterTests.java
View File

@@ -36,7 +36,7 @@ import static org.assertj.core.api.Assertions.assertThat;
* @author Daniel Garnier-Moiroux
* @since 6.4
*/
class DefaultResourcesCssWebFilterTests {
class DefaultResourcesWebFilterTests {
private final WebHandler notFoundHandler = (exchange) -> {
exchange.getResponse().setStatusCode(HttpStatus.NOT_FOUND);