root
/
spring-framework
mirror of https://github.com/spring-projects/spring-framework.git
1
0
Fork 0
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Fix failing tests 

This commit ensures that if an Origin is returned as it was provided,
possibly with a trailing slash.

See gh-26892
This commit is contained in:
Rossen Stoyanchev 2021-05-10 14:15:16 +01:00
parent dc4e053d59
commit aa51ed1940
3 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java
View File

@ -549,31 +549,31 @@ public class CorsConfiguration {
/** /**
* Check the origin of the request against the configured allowed origins. * Check the origin of the request against the configured allowed origins.
* @param requestOrigin the origin to check * @param origin the origin to check
* @return the origin to use for the response, or {@code null} which * @return the origin to use for the response, or {@code null} which
* means the request origin is not allowed * means the request origin is not allowed
*/ */
@Nullable @Nullable
public String checkOrigin(@Nullable String requestOrigin) { public String checkOrigin(@Nullable String origin) {
if (!StringUtils.hasText(requestOrigin)) { if (!StringUtils.hasText(origin)) {
return null; return null;
} }
requestOrigin = trimTrailingSlash(requestOrigin); String originToCheck = trimTrailingSlash(origin);
if (!ObjectUtils.isEmpty(this.allowedOrigins)) { if (!ObjectUtils.isEmpty(this.allowedOrigins)) {
if (this.allowedOrigins.contains(ALL)) { if (this.allowedOrigins.contains(ALL)) {
validateAllowCredentials(); validateAllowCredentials();
return ALL; return ALL;
} }
for (String allowedOrigin : this.allowedOrigins) { for (String allowedOrigin : this.allowedOrigins) {
if (requestOrigin.equalsIgnoreCase(allowedOrigin)) { if (originToCheck.equalsIgnoreCase(allowedOrigin)) {
return requestOrigin; return origin;
} }
} }
} }
if (!ObjectUtils.isEmpty(this.allowedOriginPatterns)) { if (!ObjectUtils.isEmpty(this.allowedOriginPatterns)) {
for (OriginPattern p : this.allowedOriginPatterns) { for (OriginPattern p : this.allowedOriginPatterns) {
if (p.getDeclaredPattern().equals(ALL) || p.getPattern().matcher(requestOrigin).matches()) { if (p.getDeclaredPattern().equals(ALL) || p.getPattern().matcher(originToCheck).matches()) {
return requestOrigin; return origin;
} }
} }
} }

4
spring-web/src/test/java/org/springframework/web/cors/CorsConfigurationTests.java
View File

@ -294,12 +294,12 @@ public class CorsConfigurationTests {
// specific origin matches Origin header with or without trailing "/" // specific origin matches Origin header with or without trailing "/"
config.setAllowedOrigins(Collections.singletonList("https://domain.com")); config.setAllowedOrigins(Collections.singletonList("https://domain.com"));
assertThat(config.checkOrigin("https://domain.com")).isEqualTo("https://domain.com"); assertThat(config.checkOrigin("https://domain.com")).isEqualTo("https://domain.com");
assertThat(config.checkOrigin("https://domain.com/")).isEqualTo("https://domain.com"); assertThat(config.checkOrigin("https://domain.com/")).isEqualTo("https://domain.com/");
// specific origin with trailing "/" matches Origin header with or without trailing "/" // specific origin with trailing "/" matches Origin header with or without trailing "/"
config.setAllowedOrigins(Collections.singletonList("https://domain.com/")); config.setAllowedOrigins(Collections.singletonList("https://domain.com/"));
assertThat(config.checkOrigin("https://domain.com")).isEqualTo("https://domain.com"); assertThat(config.checkOrigin("https://domain.com")).isEqualTo("https://domain.com");
assertThat(config.checkOrigin("https://domain.com/")).isEqualTo("https://domain.com"); assertThat(config.checkOrigin("https://domain.com/")).isEqualTo("https://domain.com/");
config.setAllowCredentials(false); config.setAllowCredentials(false);
assertThat(config.checkOrigin("https://domain.com")).isEqualTo("https://domain.com"); assertThat(config.checkOrigin("https://domain.com")).isEqualTo("https://domain.com");

4
spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/CrossOriginTests.java
View File

@ -284,7 +284,7 @@ class CrossOriginTests {
CorsConfiguration config = getCorsConfiguration(chain, false); CorsConfiguration config = getCorsConfiguration(chain, false);
assertThat(config).isNotNull(); assertThat(config).isNotNull();
assertThat(config.getAllowedMethods()).containsExactly("GET"); assertThat(config.getAllowedMethods()).containsExactly("GET");
assertThat(config.getAllowedOrigins()).containsExactly("http://www.foo.example/"); assertThat(config.getAllowedOrigins()).containsExactly("http://www.foo.example");
assertThat(config.getAllowCredentials()).isTrue(); assertThat(config.getAllowCredentials()).isTrue();
} }
@ -297,7 +297,7 @@ class CrossOriginTests {
CorsConfiguration config = getCorsConfiguration(chain, false); CorsConfiguration config = getCorsConfiguration(chain, false);
assertThat(config).isNotNull(); assertThat(config).isNotNull();
assertThat(config.getAllowedMethods()).containsExactly("GET"); assertThat(config.getAllowedMethods()).containsExactly("GET");
assertThat(config.getAllowedOrigins()).containsExactly("http://www.foo.example/"); assertThat(config.getAllowedOrigins()).containsExactly("http://www.foo.example");
assertThat(config.getAllowCredentials()).isTrue(); assertThat(config.getAllowCredentials()).isTrue();
} }