root
/
spring-framework
mirror of https://github.com/spring-projects/spring-framework.git
1
0
Fork 0
Code Issues Actions 8 Packages Projects Releases Wiki Activity

Whitelist extension if present in the request mapping 

We know skip the Content-Disposition header for any extension if the
chosen request mapping explicitly contains the URl extension.

Issue: SPR-13629
This commit is contained in:
Rossen Stoyanchev 2015-11-06 12:37:13 -05:00
parent 889366320d
commit 237439ef97
2 changed files with 36 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/AbstractMessageConverterMethodProcessor.java
View File

@ -375,13 +375,12 @@ public abstract class AbstractMessageConverterMethodProcessor extends AbstractMe
if (this.safeExtensions.contains(extension)) { if (this.safeExtensions.contains(extension)) {
return true; return true;
} }
if (extension.equals("html")) { String pattern = (String) request.getAttribute(HandlerMapping.BEST_MATCHING_PATTERN_ATTRIBUTE);
String name = HandlerMapping.BEST_MATCHING_PATTERN_ATTRIBUTE; if (pattern != null && pattern.endsWith("." + extension)) {
String pattern = (String) request.getAttribute(name);
if (pattern != null && pattern.endsWith(".html")) {
return true; return true;
} }
name = HandlerMapping.PRODUCIBLE_MEDIA_TYPES_ATTRIBUTE; if (extension.equals("html")) {
String name = HandlerMapping.PRODUCIBLE_MEDIA_TYPES_ATTRIBUTE;
Set<MediaType> mediaTypes = (Set<MediaType>) request.getAttribute(name); Set<MediaType> mediaTypes = (Set<MediaType>) request.getAttribute(name);
if (!CollectionUtils.isEmpty(mediaTypes) && mediaTypes.contains(MediaType.TEXT_HTML)) { if (!CollectionUtils.isEmpty(mediaTypes) && mediaTypes.contains(MediaType.TEXT_HTML)) {
return true; return true;

31
spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/ServletAnnotationControllerHandlerMethodTests.java
View File

@ -1711,6 +1711,32 @@ public class ServletAnnotationControllerHandlerMethodTests extends AbstractServl
assertArrayEquals(content, response.getContentAsByteArray()); assertArrayEquals(content, response.getContentAsByteArray());
} }
@Test
public void responseBodyAsTextWithCssExtension() throws Exception {
initServlet(new ApplicationContextInitializer<GenericWebApplicationContext>() {
@Override
public void initialize(GenericWebApplicationContext wac) {
ContentNegotiationManagerFactoryBean factoryBean = new ContentNegotiationManagerFactoryBean();
factoryBean.afterPropertiesSet();
RootBeanDefinition adapterDef = new RootBeanDefinition(RequestMappingHandlerAdapter.class);
adapterDef.getPropertyValues().add("contentNegotiationManager", factoryBean.getObject());
wac.registerBeanDefinition("handlerAdapter", adapterDef);
}
}, TextRestController.class);
byte[] content = "body".getBytes(Charset.forName("ISO-8859-1"));
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/a4.css");
request.setContent(content);
MockHttpServletResponse response = new MockHttpServletResponse();
getServlet().service(request, response);
assertEquals(200, response.getStatus());
assertEquals("text/css", response.getContentType());
assertNull(response.getHeader("Content-Disposition"));
assertArrayEquals(content, response.getContentAsByteArray());
}
/* /*
* Controllers * Controllers
*/ */
@ -3187,6 +3213,11 @@ public class ServletAnnotationControllerHandlerMethodTests extends AbstractServl
public String a3(@RequestBody String body) throws IOException { public String a3(@RequestBody String body) throws IOException {
return body; return body;
} }
@RequestMapping(path = "/a4.css", method = RequestMethod.GET)
public String a4(@RequestBody String body) {
return body;
}
} }