Skip to content

Fix AllowedOrigins according to RFC 6454 #875

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 5 commits into from
Closed

Fix AllowedOrigins according to RFC 6454 #875

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4ca174d
Fix AllowedOrigins according to RFC 6454
GeorgeCGV Sep 18, 2015
c7145f8
Added missing origin string length check
GeorgeCGV Sep 18, 2015
490b9ed
Fix for origin comparison
GeorgeCGV Sep 18, 2015
8060051
Adapted valid origin comparison
GeorgeCGV Sep 22, 2015
7f1ef9e
Restored isValidOrigin to its previous state
GeorgeCGV Sep 22, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 25 additions & 14 deletions spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@
* @author Rossen Stoyanchev
* @author Phillip Webb
* @author Oliver Gierke
* @author Georgij Cernysiov
* @since 3.1
* @see #newInstance()
* @see #fromPath(String)
Expand Down Expand Up @@ -338,24 +339,34 @@ public static UriComponentsBuilder fromHttpRequest(HttpRequest request) {


/**
* Create an instance by parsing the "origin" header of an HTTP request.
* Creates a new {@code UriComponents} instance from the {@code ORIGIN} header of an HTTP request.
* @param origin the {@code ORIGIN} header value
* @return the URI components of the {@code ORIGIN} value
* @see <a href="https://tools.ietf.org/html/rfc6454">RFC 6454: The Web Origin Concept</a>
*/
public static UriComponentsBuilder fromOriginHeader(String origin) {
UriComponentsBuilder builder = UriComponentsBuilder.newInstance();
if (StringUtils.hasText(origin)) {
int schemaIdx = origin.indexOf("://");
String schema = (schemaIdx != -1 ? origin.substring(0, schemaIdx) : "http");
builder.scheme(schema);
String hostString = (schemaIdx != -1 ? origin.substring(schemaIdx + 3) : origin);
if (hostString.contains(":")) {
String[] hostAndPort = StringUtils.split(hostString, ":");
builder.host(hostAndPort[0]);
builder.port(Integer.parseInt(hostAndPort[1]));
}
else {
builder.host(hostString);
final UriComponentsBuilder builder = new UriComponentsBuilder().scheme("").host("").port(-1);

if (StringUtils.hasLength(origin)) {
Matcher matcher = URI_PATTERN.matcher(origin);
if (matcher.matches()) {
String scheme = matcher.group(2);
String host = matcher.group(6);
String port = matcher.group(8);

if (StringUtils.hasLength(scheme)) {
int schemaIdx = origin.indexOf("://");
scheme = (schemaIdx != -1 ? origin.substring(0, schemaIdx) : "");
}
builder.scheme(scheme);

builder.host(host);
if (StringUtils.hasLength(port)) {
builder.port(port);
}
}
}

return builder;
}

Expand Down
19 changes: 18 additions & 1 deletion spring-web/src/main/java/org/springframework/web/util/WebUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@
* @author Rod Johnson
* @author Juergen Hoeller
* @author Sebastien Deleuze
* @author Georgij Cernysiov
*/
public abstract class WebUtils {

Expand Down Expand Up @@ -810,7 +811,23 @@ public static boolean isSameOrigin(HttpRequest request) {
}
UriComponents actualUrl = UriComponentsBuilder.fromHttpRequest(request).build();
UriComponents originUrl = UriComponentsBuilder.fromOriginHeader(origin).build();
return (actualUrl.getHost().equals(originUrl.getHost()) && getPort(actualUrl) == getPort(originUrl));
return isSameHostAndPort(actualUrl, originUrl);
}

/**
* Checks {@link UriComponents} {@code Host} and {@code Port}.
* @return {@code true} if components have the same {@code Host} and {@code Port}.
* @since 4.2.2
*/
public static boolean isSameHostAndPort(UriComponents a, UriComponents b) {
if (a == null && b == null) {
return true;
}
else if (a == null || b == null) {
return false;
}

return (a.getHost().equals(b.getHost()) && getPort(a) == getPort( b));
}

private static int getPort(UriComponents component) {
Expand Down
40 changes: 38 additions & 2 deletions spring-web/src/test/java/org/springframework/web/util/WebUtilsTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@
* @author Arjen Poutsma
* @author Rossen Stoyanchev
* @author Sebastien Deleuze
* @author Georgij Cernysiov
*/
public class WebUtilsTests {

Expand Down Expand Up @@ -107,15 +108,34 @@ public void parseMatrixVariablesString() {

@Test
public void isValidOrigin() {
List<String> allowed = Collections.emptyList();
List<String> allowed = Collections.emptyList();
assertTrue(checkValidOrigin("mydomain1.com", -1, "http://mydomain1.com", allowed));
assertTrue(checkValidOrigin("mydomain1.com", -1, "http://mydomain1.com/", allowed));
assertTrue(checkValidOrigin("mydomain1.com", 80, "http://mydomain1.com:80/", allowed));
assertTrue(checkValidOrigin("mydomain1.com", -1, null, allowed));

assertFalse(checkValidOrigin("mydomain1.com", -1, "", allowed));
assertFalse(checkValidOrigin("mydomain1.com", -1, "null", allowed));
assertFalse(checkValidOrigin("mydomain1.com", -1, "http://mydomain1.com:9090/", allowed));
assertFalse(checkValidOrigin("mydomain1.com", -1, "http://mydomain2.com", allowed));

allowed = Collections.singletonList("*");
assertTrue(checkValidOrigin("mydomain1.com", -1, "", allowed));
assertTrue(checkValidOrigin("mydomain1.com", -1, "null", allowed));
assertTrue(checkValidOrigin("mydomain1.com", -1, null, allowed));

assertTrue(checkValidOrigin("mydomain1.com", -1, "http://mydomain2.com", allowed));
assertTrue(checkValidOrigin("mydomain1.com", -1, "http://mydomain2.com/", allowed));
assertTrue(checkValidOrigin("mydomain1.com:8080", -1, "http://mydomain2.com:8080/", allowed));

allowed = Collections.singletonList("http://mydomain1.com");
assertTrue(checkValidOrigin("mydomain2.com", -1, "http://mydomain1.com", allowed));
assertTrue(checkValidOrigin("mydomain1.com", -1, null, allowed));

assertFalse(checkValidOrigin("mydomain2.com", -1, "http://mydomain1.com/", allowed));
assertFalse(checkValidOrigin("mydomain2.com", -1, "http://mydomain1.com/path/file", allowed));
assertFalse(checkValidOrigin("mydomain1.com", -1, "", allowed));
assertFalse(checkValidOrigin("mydomain1.com", -1, "null", allowed));
assertFalse(checkValidOrigin("mydomain2.com", -1, "http://mydomain3.com", allowed));
}

Expand All @@ -124,14 +144,30 @@ public void isSameOrigin() {
assertTrue(checkSameOrigin("mydomain1.com", -1, "http://mydomain1.com"));
assertTrue(checkSameOrigin("mydomain1.com", -1, "http://mydomain1.com:80"));
assertTrue(checkSameOrigin("mydomain1.com", 443, "https://mydomain1.com"));
assertTrue(checkSameOrigin("mydomain1.com", 443, "https://mydomain1.com/"));
assertTrue(checkSameOrigin("mydomain1.com", 80, "http://mydomain1.com:80/"));
assertTrue(checkSameOrigin("mydomain1.com", 80, "http://mydomain1.com:80/path/file"));
assertTrue(checkSameOrigin("mydomain1.com", 80, "http://mydomain1.com:80/path/file/"));
assertTrue(checkSameOrigin("mydomain1.com", 443, "https://mydomain1.com:443"));
assertTrue(checkSameOrigin("mydomain1.com", 443, "https://mydomain1.com:443/"));
assertTrue(checkSameOrigin("mydomain1.com", 123, "http://mydomain1.com:123"));
assertTrue(checkSameOrigin("mydomain1.com", -1, "ws://mydomain1.com"));
assertTrue(checkSameOrigin("mydomain1.com", -1, "ws://mydomain1.com/"));
assertTrue(checkSameOrigin("mydomain1.com", -1, "ws://mydomain1.com/path/file"));
assertTrue(checkSameOrigin("mydomain1.com", -1, "ws://mydomain1.com/path/file/"));
assertTrue(checkSameOrigin("mydomain1.com", 443, "wss://mydomain1.com"));

assertTrue(checkSameOrigin("mydomain1.com", -1, null));

assertFalse(checkSameOrigin("mydomain1.com", -1, "mydomain1.org"));
assertFalse(checkSameOrigin("mydomain1.com", -1, "http://mydomain2.com"));
assertFalse(checkSameOrigin("mydomain1.com", -1, "https://mydomain1.com"));
assertFalse(checkSameOrigin("mydomain1.com", -1, "ws://mydomain1.com:8080"));
assertFalse(checkSameOrigin("mydomain1.com", -1, "ws://mydomain1.com:8080/"));
assertFalse(checkSameOrigin("mydomain1.com", -1, "ws://mydomain1.com:8080/path/file"));
assertFalse(checkSameOrigin("mydomain1.com", -1, "ws://mydomain1.com:8080/path/file/"));
assertFalse(checkSameOrigin("mydomain1.com", -1, "invalid-origin"));
assertFalse(checkSameOrigin("mydomain1.com", -1, "null"));
assertFalse(checkSameOrigin("mydomain1.com", -1, ""));
}


Expand Down