Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Improve StrictHttpFirewall Error Messaging

Browse Source 
Better error strings for invalid header and parameter values.

Closes gh-13615
This commit is contained in:
Bjorn Harvold
2023-08-04 10:59:11 +07:00
committed by Josh Cummings
parent 9df9cb5aed
commit 5e715c5297
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java
View File

@@ -713,7 +713,7 @@ public class StrictHttpFirewall implements HttpFirewall {
}
String value = super.getHeader(name);
if (value != null) {
validateAllowedHeaderValue(value);
validateAllowedHeaderValue(name, value);
}
return value;
}
@@ -734,7 +734,7 @@ public class StrictHttpFirewall implements HttpFirewall {
@Override
public String nextElement() {
String value = headers.nextElement();
validateAllowedHeaderValue(value);
validateAllowedHeaderValue(name, value);
return value;
}
@@ -768,7 +768,7 @@ public class StrictHttpFirewall implements HttpFirewall {
}
String value = super.getParameter(name);
if (value != null) {
validateAllowedParameterValue(value);
validateAllowedParameterValue(name, value);
}
return value;
}
@@ -781,7 +781,7 @@ public class StrictHttpFirewall implements HttpFirewall {
String[] values = entry.getValue();
validateAllowedParameterName(name);
for (String value : values) {
validateAllowedParameterValue(value);
validateAllowedParameterValue(name, value);
}
}
return parameterMap;
@@ -815,7 +815,7 @@ public class StrictHttpFirewall implements HttpFirewall {
String[] values = super.getParameterValues(name);
if (values != null) {
for (String value : values) {
validateAllowedParameterValue(value);
validateAllowedParameterValue(name, value);
}
}
return values;
@@ -828,10 +828,10 @@ public class StrictHttpFirewall implements HttpFirewall {
}
}
private void validateAllowedHeaderValue(String value) {
private void validateAllowedHeaderValue(String name, String value) {
if (!StrictHttpFirewall.this.allowedHeaderValues.test(value)) {
throw new RequestRejectedException(
"The request was rejected because the header value \"" + value + "\" is not allowed.");
"The request was rejected because the header: \"" + name + " \" has a value \"" + value + "\" that is not allowed.");
}
}
@@ -842,10 +842,10 @@ public class StrictHttpFirewall implements HttpFirewall {
}
}
private void validateAllowedParameterValue(String value) {
private void validateAllowedParameterValue(String name, String value) {
if (!StrictHttpFirewall.this.allowedParameterValues.test(value)) {
throw new RequestRejectedException(
"The request was rejected because the parameter value \"" + value + "\" is not allowed.");
"The request was rejected because the parameter: \"" + name + " \" has a value \"" + value + "\" that is not allowed.");
}
}