Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Suppress ArrayIndexOutOfBoundsException in XorCsrfTokenRequestAttributeHandler

Browse Source 
Closes gh-13310
This commit is contained in:
Kevin2Jordan
2023-07-17 09:13:30 +05:30
committed by Josh Cummings
parent 75e0068925
commit e21da061d3
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
web/src/main/java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandler.java
View File

@@ -97,7 +97,7 @@ public final class XorCsrfTokenRequestAttributeHandler extends CsrfTokenRequestA
System.arraycopy(actualBytes, randomBytesSize, xoredCsrf, 0, tokenSize);
byte[] csrfBytes = xorCsrf(randomBytes, xoredCsrf);
return Utf8.decode(csrfBytes);
return (csrfBytes != null) ? Utf8.decode(csrfBytes) : null;
}
private static String createXoredCsrfToken(SecureRandom secureRandom, String token) {
@@ -114,6 +114,9 @@ public final class XorCsrfTokenRequestAttributeHandler extends CsrfTokenRequestA
}
private static byte[] xorCsrf(byte[] randomBytes, byte[] csrfBytes) {
if (csrfBytes.length < randomBytes.length) {
return null;
}
int len = Math.min(randomBytes.length, csrfBytes.length);
byte[] xoredCsrf = new byte[len];
System.arraycopy(csrfBytes, 0, xoredCsrf, 0, csrfBytes.length);