From aac1ed6ee5132886e05c5f6c46713553342c818d Mon Sep 17 00:00:00 2001 From: Thom Hurks Date: Thu, 19 Jan 2023 11:47:37 +0100 Subject: [PATCH] Optimize CorsConfiguration::checkHeaders In the checkHeaders method, if allowedHeaders contains * the result size can be requestHeaders.size(), but if this is not the case then the result size can only be as big as the minimum value of requestHeaders.size() and allowedHeaders.size(). requestHeaders.size() can be potentially big (user input) and allowedHeaders.size() could be small, so this saves memory in that case. Closes gh-29853 --- .../java/org/springframework/web/cors/CorsConfiguration.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java b/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java index 46b145e7b2b..fe03d7ea14b 100644 --- a/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java +++ b/spring-web/src/main/java/org/springframework/web/cors/CorsConfiguration.java @@ -676,7 +676,8 @@ public class CorsConfiguration { } boolean allowAnyHeader = this.allowedHeaders.contains(ALL); - List result = new ArrayList<>(requestHeaders.size()); + int maxResultSize = allowAnyHeader ? requestHeaders.size() : Math.min(requestHeaders.size(), this.allowedHeaders.size()); + List result = new ArrayList<>(maxResultSize); for (String requestHeader : requestHeaders) { if (StringUtils.hasText(requestHeader)) { requestHeader = requestHeader.trim();