From 1c17305d7b641c25b4eb85fdbe6de4fcd7e10d36 Mon Sep 17 00:00:00 2001 From: Rossen Stoyanchev Date: Tue, 1 Jun 2021 20:58:14 +0100 Subject: [PATCH] Check for null in allowedOrigin list Closes gh-26987 --- .../web/cors/CorsConfiguration.java | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java b/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java index 1ef8d15f974..e605ed8070d 100644 --- a/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java +++ b/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java @@ -22,6 +22,7 @@ import java.util.Arrays; import java.util.Collections; import java.util.LinkedHashSet; import java.util.List; +import java.util.Objects; import java.util.Set; import java.util.regex.Matcher; import java.util.regex.Pattern; @@ -138,13 +139,13 @@ public class CorsConfiguration { * However an instance of this class is often initialized further, e.g. for * {@code @CrossOrigin}, via {@link #applyPermitDefaultValues()}. */ - public void setAllowedOrigins(@Nullable List allowedOrigins) { - this.allowedOrigins = (allowedOrigins != null ? - allowedOrigins.stream().map(this::trimTrailingSlash).collect(Collectors.toList()) : null); + public void setAllowedOrigins(@Nullable List origins) { + this.allowedOrigins = (origins == null ? null : + origins.stream().filter(Objects::nonNull).map(this::trimTrailingSlash).collect(Collectors.toList())); } private String trimTrailingSlash(String origin) { - return origin.endsWith("/") ? origin.substring(0, origin.length() - 1) : origin; + return (origin.endsWith("/") ? origin.substring(0, origin.length() - 1) : origin); } /** @@ -158,7 +159,11 @@ public class CorsConfiguration { /** * Variant of {@link #setAllowedOrigins} for adding one origin at a time. */ + @SuppressWarnings("ConstantConditions") public void addAllowedOrigin(String origin) { + if (origin == null) { + return; + } if (this.allowedOrigins == null) { this.allowedOrigins = new ArrayList<>(4); } @@ -220,7 +225,11 @@ public class CorsConfiguration { * Variant of {@link #setAllowedOriginPatterns} for adding one origin at a time. * @since 5.3 */ + @SuppressWarnings("ConstantConditions") public void addAllowedOriginPattern(String originPattern) { + if (originPattern == null) { + return; + } if (this.allowedOriginPatterns == null) { this.allowedOriginPatterns = new ArrayList<>(4); }