diff --git a/web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java b/web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java index 75075be3425..bdef4d3cde8 100644 --- a/web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java +++ b/web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2021 the original author or authors. + * Copyright 2012-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -713,7 +713,7 @@ public String getHeader(String name) { } String value = super.getHeader(name); if (value != null) { - validateAllowedHeaderValue(value); + validateAllowedHeaderValue(name, value); } return value; } @@ -734,7 +734,7 @@ public boolean hasMoreElements() { @Override public String nextElement() { String value = headers.nextElement(); - validateAllowedHeaderValue(value); + validateAllowedHeaderValue(name, value); return value; } @@ -768,7 +768,7 @@ public String getParameter(String name) { } String value = super.getParameter(name); if (value != null) { - validateAllowedParameterValue(value); + validateAllowedParameterValue(name, value); } return value; } @@ -781,7 +781,7 @@ public Map getParameterMap() { String[] values = entry.getValue(); validateAllowedParameterName(name); for (String value : values) { - validateAllowedParameterValue(value); + validateAllowedParameterValue(name, value); } } return parameterMap; @@ -815,7 +815,7 @@ public String[] getParameterValues(String name) { String[] values = super.getParameterValues(name); if (values != null) { for (String value : values) { - validateAllowedParameterValue(value); + validateAllowedParameterValue(name, value); } } return values; @@ -828,10 +828,10 @@ private void validateAllowedHeaderName(String headerNames) { } } - private void validateAllowedHeaderValue(String value) { + private void validateAllowedHeaderValue(String name, String value) { if (!StrictHttpFirewall.this.allowedHeaderValues.test(value)) { - throw new RequestRejectedException( - "The request was rejected because the header value \"" + value + "\" is not allowed."); + throw new RequestRejectedException("The request was rejected because the header: \"" + name + + " \" has a value \"" + value + "\" that is not allowed."); } } @@ -842,10 +842,10 @@ private void validateAllowedParameterName(String name) { } } - private void validateAllowedParameterValue(String value) { + private void validateAllowedParameterValue(String name, String value) { if (!StrictHttpFirewall.this.allowedParameterValues.test(value)) { - throw new RequestRejectedException( - "The request was rejected because the parameter value \"" + value + "\" is not allowed."); + throw new RequestRejectedException("The request was rejected because the parameter: \"" + name + + " \" has a value \"" + value + "\" that is not allowed."); } }