From cb2331966327adb171f121865877513aab509d2d Mon Sep 17 00:00:00 2001 From: spencergibb Date: Tue, 23 Nov 2021 16:41:18 -0500 Subject: [PATCH] Makes ProxyExchange.DEFAULT_SENSITIVE read only. Fixes gh-2413 --- .../org/springframework/cloud/gateway/mvc/ProxyExchange.java | 3 ++- .../springframework/cloud/gateway/webflux/ProxyExchange.java | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/spring-cloud-gateway-mvc/src/main/java/org/springframework/cloud/gateway/mvc/ProxyExchange.java b/spring-cloud-gateway-mvc/src/main/java/org/springframework/cloud/gateway/mvc/ProxyExchange.java index ed57d180..f97b3477 100644 --- a/spring-cloud-gateway-mvc/src/main/java/org/springframework/cloud/gateway/mvc/ProxyExchange.java +++ b/spring-cloud-gateway-mvc/src/main/java/org/springframework/cloud/gateway/mvc/ProxyExchange.java @@ -140,7 +140,8 @@ public class ProxyExchange { /** * Contains headers that are considered case-sensitive by default. */ - public static Set DEFAULT_SENSITIVE = new HashSet<>(Arrays.asList("cookie", "authorization")); + public static Set DEFAULT_SENSITIVE = Collections + .unmodifiableSet(new HashSet<>(Arrays.asList("cookie", "authorization"))); private URI uri; diff --git a/spring-cloud-gateway-webflux/src/main/java/org/springframework/cloud/gateway/webflux/ProxyExchange.java b/spring-cloud-gateway-webflux/src/main/java/org/springframework/cloud/gateway/webflux/ProxyExchange.java index 5044ffcb..f82f4e2e 100644 --- a/spring-cloud-gateway-webflux/src/main/java/org/springframework/cloud/gateway/webflux/ProxyExchange.java +++ b/spring-cloud-gateway-webflux/src/main/java/org/springframework/cloud/gateway/webflux/ProxyExchange.java @@ -20,6 +20,7 @@ import java.lang.reflect.Type; import java.net.URI; import java.net.URISyntaxException; import java.util.Arrays; +import java.util.Collections; import java.util.HashSet; import java.util.Set; import java.util.function.Function; @@ -113,7 +114,8 @@ public class ProxyExchange { /** * Contains headers that are considered case-sensitive by default. */ - public static Set DEFAULT_SENSITIVE = new HashSet<>(Arrays.asList("cookie", "authorization")); + public static Set DEFAULT_SENSITIVE = Collections + .unmodifiableSet(new HashSet<>(Arrays.asList("cookie", "authorization"))); private HttpMethod httpMethod;