Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

StrictFirewallHttpRequest.buid returns StrictFirewallHttpRequest

Browse Source 
Closes gh-16069
This commit is contained in:
Rob Winch
2024-12-11 15:46:31 -06:00
parent 2b6d586987
commit 6a0b683e60
2 changed files with 85 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
web/src/test/java/org/springframework/security/web/server/firewall/StrictServerWebExchangeFirewallTests.java
View File

@@ -513,4 +513,25 @@ class StrictServerWebExchangeFirewallTests {
assertThat(exchange.getRequest().getHeaders().get(null)).isNull();
}
@Test
void getFirewalledExchangeWhenMutateThenHeadersStillFirewalled() {
String invalidHeaderName = "bad name";
this.firewall.setAllowedHeaderNames((name) -> !name.equals(invalidHeaderName));
ServerWebExchange exchange = getFirewalledExchange();
ServerWebExchange mutatedExchange = exchange.mutate().request(exchange.getRequest().mutate().build()).build();
HttpHeaders headers = mutatedExchange.getRequest().getHeaders();
assertThatExceptionOfType(ServerExchangeRejectedException.class)
.isThrownBy(() -> headers.get(invalidHeaderName));
}
@Test
void getMutatedFirewalledExchangeGetHeaderWhenNotAllowedHeaderNameThenException() {
String invalidHeaderName = "bad name";
this.firewall.setAllowedHeaderNames((name) -> !name.equals(invalidHeaderName));
ServerWebExchange exchange = getFirewalledExchange();
HttpHeaders headers = exchange.getRequest().mutate().build().getHeaders();
assertThatExceptionOfType(ServerExchangeRejectedException.class)
.isThrownBy(() -> headers.get(invalidHeaderName));
}
}