Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Reject the NULL character in paths in StrictHttpFirewall #8703

Merged
merged 1 commit into from
Jun 18, 2020
Merged

Reject the NULL character in paths in StrictHttpFirewall #8703

merged 1 commit into from
Jun 18, 2020

Conversation

candrews
Copy link
Contributor

  • Adds setAllowNull
  • By default, denies null in paths

@candrews candrews mentioned this pull request Jun 17, 2020
Merged
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Jun 17, 2020
@jzheaux jzheaux self-assigned this Jun 17, 2020
@jzheaux jzheaux added in: web An issue in web modules (web, webmvc) type: enhancement A general enhancement and removed status: waiting-for-triage An issue we've not yet triaged labels Jun 17, 2020
jzheaux
jzheaux requested changes Jun 17, 2020
View reviewed changes
Copy link
Contributor

@jzheaux jzheaux left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, @candrews! I think it's a good idea to look at this change separately from the others.

I've left some feedback inline.

web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java Show resolved Hide resolved
web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java Show resolved Hide resolved
@candrews candrews requested a review from jzheaux June 17, 2020 18:43
@candrews
Reject the NULL character in paths in StrictHttpFirewall
2e9c998 
Adds `setAllowNull`
By default, denies null in paths
@candrews
Copy link
Contributor Author

Done!

@jzheaux jzheaux merged commit efb6953 into spring-projects:master Jun 18, 2020
@jzheaux
Copy link
Contributor

jzheaux commented Jun 18, 2020

Thanks again for the PR, @candrews! This is now merged into master.

@jzheaux jzheaux added this to the 5.4.0-M2 milestone Jun 19, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jzheaux jzheaux jzheaux approved these changes

Assignees

@jzheaux jzheaux

Labels
in: web An issue in web modules (web, webmvc) type: enhancement A general enhancement
Projects
None yet
Milestone
5.4.0-M2
Development

Successfully merging this pull request may close these issues.
3 participants
@candrews @jzheaux @spring-projects-issues