_Bastler/we.bstly-back
1
0
Fork 0
Code Issues 1 Pull Requests Projects Releases Wiki Activity

fix UTF-8 headers

Browse Source
This commit is contained in:
_Bastler 2022-12-02 13:57:28 +01:00
parent 74394f0582
commit 7d5f08646e
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
core/src/main/java/de/bstly/we/security/SecurityConfig.java
View File

@ -3,8 +3,10 @@
*/ */
package de.bstly.we.security; package de.bstly.we.security;
import java.io.UnsupportedEncodingException;
import java.util.Collections; import java.util.Collections;
import java.util.List; import java.util.List;
import java.util.regex.Pattern;
import javax.sql.DataSource; import javax.sql.DataSource;
@ -27,6 +29,7 @@ import org.springframework.security.web.authentication.rememberme.JdbcTokenRepos
import org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices; import org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices;
import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository; import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;
import org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy; import org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy;
import org.springframework.security.web.firewall.StrictHttpFirewall;
import org.springframework.security.web.header.writers.ReferrerPolicyHeaderWriter.ReferrerPolicy; import org.springframework.security.web.header.writers.ReferrerPolicyHeaderWriter.ReferrerPolicy;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher; import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.web.cors.CorsConfiguration; import org.springframework.web.cors.CorsConfiguration;
@ -297,4 +300,21 @@ public class SecurityConfig {
return rememberMeServices; return rememberMeServices;
} }
@Bean
public StrictHttpFirewall httpFirewall() {
StrictHttpFirewall firewall = new StrictHttpFirewall();
Pattern allowed = Pattern.compile("[\\p{IsAssigned}&&[^\\p{IsControl}]]*");
firewall.setAllowedHeaderValues((header) -> {
String parsed;
try {
parsed = new String(header.getBytes("ISO_8859_1"), "UTF_8");
return allowed.matcher(parsed).matches();
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
}
return allowed.matcher(header).matches();
});
return firewall;
}
} }

2
pom.xml
View File

@ -13,7 +13,7 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<java.version>11</java.version> <java.version>11</java.version>
<log4j2.version>2.19.0</log4j2.version> <log4j2.version>2.19.0</log4j2.version>
<revision>2.0.0-SNAPSHOT</revision> <revision>2.0.1-SNAPSHOT</revision>
</properties> </properties>
<parent> <parent>