Apache/struts
1
0
Fork 0
mirror of https://github.com/apache/struts.git synced 2026-08-06 23:27:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

WW-5276 Cleans up also wrapper request to avoid resource leak and potential DoS attack

Browse Source
This commit is contained in:
Lukasz Lenart
2023-01-22 11:04:58 +01:00
parent 46738c970e
commit 05d7196e6c
1 changed files with 38 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/org/apache/struts2/dispatcher/filter/StrutsPrepareAndExecuteFilter.java
+38 -21
View File
@@ -23,10 +23,10 @@ import org.apache.logging.log4j.Logger;
import org.apache.struts2.RequestUtils;
import org.apache.struts2.StrutsStatics;
import org.apache.struts2.dispatcher.Dispatcher;
import org.apache.struts2.dispatcher.mapper.ActionMapping;
import org.apache.struts2.dispatcher.ExecuteOperations;
import org.apache.struts2.dispatcher.InitOperations;
import org.apache.struts2.dispatcher.PrepareOperations;
import org.apache.struts2.dispatcher.mapper.ActionMapping;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
@@ -106,7 +106,7 @@ public class StrutsPrepareAndExecuteFilter implements StrutsStatics, Filter {
/**
* Callback for post initialization
*
* @param dispatcher the dispatcher
* @param dispatcher the dispatcher
* @param filterConfig the filter config
*/
protected void postInit(Dispatcher dispatcher, FilterConfig filterConfig) {
@@ -119,33 +119,50 @@ public class StrutsPrepareAndExecuteFilter implements StrutsStatics, Filter {
try {
String uri = RequestUtils.getUri(request);
if (excludedPatterns != null && prepare.isUrlExcluded(request, excludedPatterns)) {
LOG.trace("Request {} is excluded from handling by Struts, passing request to other filters", uri);
if (isRequestExcluded(request)) {
LOG.trace("Request: {} is excluded from handling by Struts, passing request to other filters", uri);
chain.doFilter(request, response);
} else {
LOG.trace("Checking if {} is a static resource", uri);
boolean handled = execute.executeStaticResourceRequest(request, response);
if (!handled) {
LOG.trace("Uri {} is not a static resource, assuming action", uri);
prepare.setEncodingAndLocale(request, response);
prepare.createActionContext(request, response);
prepare.assignDispatcherToThread();
HttpServletRequest wrappedRequest = prepare.wrapRequest(request);
ActionMapping mapping = prepare.findActionMapping(wrappedRequest, response, true);
if (mapping == null) {
LOG.trace("Cannot find mapping for {}, passing to other filters", uri);
chain.doFilter(request, response);
} else {
LOG.trace("Found mapping {} for {}", mapping, uri);
execute.executeAction(wrappedRequest, response, mapping);
}
}
tryHandleRequest(chain, request, response, uri);
}
} finally {
prepare.cleanupRequest(request);
}
}
private void tryHandleRequest(FilterChain chain, HttpServletRequest request, HttpServletResponse response, String uri) throws IOException, ServletException {
LOG.trace("Checking if: {} is a static resource", uri);
boolean handled = execute.executeStaticResourceRequest(request, response);
if (!handled) {
LOG.trace("Uri: {} is not a static resource, assuming action", uri);
handleRequest(chain, request, response, uri);
}
}
private void handleRequest(FilterChain chain, HttpServletRequest request, HttpServletResponse response, String uri) throws ServletException, IOException {
prepare.setEncodingAndLocale(request, response);
prepare.createActionContext(request, response);
prepare.assignDispatcherToThread();
HttpServletRequest wrappedRequest = prepare.wrapRequest(request);
try {
ActionMapping mapping = prepare.findActionMapping(wrappedRequest, response, true);
if (mapping == null) {
LOG.trace("Cannot find mapping for: {}, passing to other filters", uri);
chain.doFilter(request, response);
} else {
LOG.trace("Found mapping: {} for: {}", mapping, uri);
execute.executeAction(wrappedRequest, response, mapping);
}
} finally {
prepare.cleanupRequest(wrappedRequest);
}
}
private boolean isRequestExcluded(HttpServletRequest request) {
return excludedPatterns != null && prepare.isUrlExcluded(request, excludedPatterns);
}
public void destroy() {
prepare.cleanupDispatcher();
}