root
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity

Fix NPE in IpAddressMatcher 

Closes gh-15527

(cherry picked from commit 52de894c3c)
This commit is contained in:
Steve Riesenberg 2024-11-14 16:32:04 -06:00
parent f197f21054
commit 554df6fab6
No known key found for this signature in database
GPG Key ID: 3D0169B18AB8F0A9
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
web/src/main/java/org/springframework/security/web/util/matcher/IpAddressMatcher.java
View File

@ -71,6 +71,11 @@ public final class IpAddressMatcher implements RequestMatcher {
}
public boolean matches(String address) {
// Do not match null or blank address
if (!StringUtils.hasText(address)) {
return false;
}
assertNotHostName(address);
InetAddress remoteAddress = parseAddress(address);
if (!this.requiredAddress.getClass().equals(remoteAddress.getClass())) {

15
web/src/test/java/org/springframework/security/web/util/matcher/IpAddressMatcherTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2019 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -126,4 +126,17 @@ public class IpAddressMatcherTests {
.withMessage("ipAddress 123.156.7.18.org doesn't look like an IP Address. Is it a host name?");
}
// gh-15527
@Test
public void matchesWhenIpAddressIsLoopbackAndAddressIsNullThenFalse() {
IpAddressMatcher ipAddressMatcher = new IpAddressMatcher("127.0.0.1");
assertThat(ipAddressMatcher.matches((String) null)).isFalse();
}
// gh-15527
@Test
public void matchesWhenAddressIsNullThenFalse() {
assertThat(this.v4matcher.matches((String) null)).isFalse();
}
}