Skip to content

Improve StrictHttpFirewall error messaging #13614

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 12, 2023
Merged

Improve StrictHttpFirewall error messaging #13614

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0f7426b
Improve StrictHttpFirewall Error Messaging
bjornharvold Aug 4, 2023
b667509
Update Copyright and Formatting
jzheaux Aug 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 12 additions & 12 deletions web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright 2012-2021 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
Expand Down Expand Up @@ -713,7 +713,7 @@ public String getHeader(String name) {
}
String value = super.getHeader(name);
if (value != null) {
validateAllowedHeaderValue(value);
validateAllowedHeaderValue(name, value);
}
return value;
}
Expand All @@ -734,7 +734,7 @@ public boolean hasMoreElements() {
@Override
public String nextElement() {
String value = headers.nextElement();
validateAllowedHeaderValue(value);
validateAllowedHeaderValue(name, value);
return value;
}

Expand Down Expand Up @@ -768,7 +768,7 @@ public String getParameter(String name) {
}
String value = super.getParameter(name);
if (value != null) {
validateAllowedParameterValue(value);
validateAllowedParameterValue(name, value);
}
return value;
}
Expand All @@ -781,7 +781,7 @@ public Map<String, String[]> getParameterMap() {
String[] values = entry.getValue();
validateAllowedParameterName(name);
for (String value : values) {
validateAllowedParameterValue(value);
validateAllowedParameterValue(name, value);
}
}
return parameterMap;
Expand Down Expand Up @@ -815,7 +815,7 @@ public String[] getParameterValues(String name) {
String[] values = super.getParameterValues(name);
if (values != null) {
for (String value : values) {
validateAllowedParameterValue(value);
validateAllowedParameterValue(name, value);
}
}
return values;
Expand All @@ -828,10 +828,10 @@ private void validateAllowedHeaderName(String headerNames) {
}
}

private void validateAllowedHeaderValue(String value) {
private void validateAllowedHeaderValue(String name, String value) {
if (!StrictHttpFirewall.this.allowedHeaderValues.test(value)) {
throw new RequestRejectedException(
"The request was rejected because the header value \"" + value + "\" is not allowed.");
throw new RequestRejectedException("The request was rejected because the header: \"" + name
+ " \" has a value \"" + value + "\" that is not allowed.");
}
}

Expand All @@ -842,10 +842,10 @@ private void validateAllowedParameterName(String name) {
}
}

private void validateAllowedParameterValue(String value) {
private void validateAllowedParameterValue(String name, String value) {
if (!StrictHttpFirewall.this.allowedParameterValues.test(value)) {
throw new RequestRejectedException(
"The request was rejected because the parameter value \"" + value + "\" is not allowed.");
throw new RequestRejectedException("The request was rejected because the parameter: \"" + name
+ " \" has a value \"" + value + "\" that is not allowed.");
}
}

Expand Down