From bc2448419bb814dd5a8d06956ea65436f1b7bb3c Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Mon, 14 Feb 2011 19:02:28 +0000 Subject: [PATCH] SEC-1679: Make sure whitespace is trimmed from cookie names when specifying multiple cookies. --- .../security/config/http/LogoutBeanDefinitionParser.java | 2 +- .../security/config/http/MiscHttpConfigTests.groovy | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/src/main/java/org/springframework/security/config/http/LogoutBeanDefinitionParser.java b/config/src/main/java/org/springframework/security/config/http/LogoutBeanDefinitionParser.java index 5dd4f14627..e4d5de5000 100644 --- a/config/src/main/java/org/springframework/security/config/http/LogoutBeanDefinitionParser.java +++ b/config/src/main/java/org/springframework/security/config/http/LogoutBeanDefinitionParser.java @@ -86,7 +86,7 @@ class LogoutBeanDefinitionParser implements BeanDefinitionParser { if (StringUtils.hasText(deleteCookies)) { BeanDefinition cookieDeleter = new RootBeanDefinition(CookieClearingLogoutHandler.class); - String[] names = StringUtils.commaDelimitedListToStringArray(deleteCookies); + String[] names = StringUtils.tokenizeToStringArray(deleteCookies, ","); cookieDeleter.getConstructorArgumentValues().addGenericArgumentValue(names); handlers.add(cookieDeleter); } diff --git a/config/src/test/groovy/org/springframework/security/config/http/MiscHttpConfigTests.groovy b/config/src/test/groovy/org/springframework/security/config/http/MiscHttpConfigTests.groovy index fb9c6778c6..8a606b56ff 100644 --- a/config/src/test/groovy/org/springframework/security/config/http/MiscHttpConfigTests.groovy +++ b/config/src/test/groovy/org/springframework/security/config/http/MiscHttpConfigTests.groovy @@ -355,8 +355,8 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests { expect: handlers[1] instanceof CookieClearingLogoutHandler - handlers[1].cookiesToClear[0] = 'JSESSIONID' - handlers[1].cookiesToClear[1] = 'mycookie' + handlers[1].cookiesToClear[0] == 'JSESSIONID' + handlers[1].cookiesToClear[1] == 'mycookie' } def invalidLogoutUrlIsDetected() {