Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-05 17:57:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1255: Modified UrlUtils. Full request URL for redirects uses the requestURI (which is encoded). The URL for path comparsions is built using the servletpath, as before.

Browse Source
This commit is contained in:
Luke Taylor
2009-10-02 17:29:43 +00:00
parent df9e2eac9e
commit 073198886d
6 changed files with 61 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/src/main/java/org/springframework/security/web/savedrequest/DefaultSavedRequest.java
+1 -2
View File
@@ -234,8 +234,7 @@ public class DefaultSavedRequest implements SavedRequest {
* @return the full URL of this request
*/
public String getRedirectUrl() {
return UrlUtils.buildFullRequestUrl(scheme, serverName, serverPort, contextPath, servletPath, requestURI,
pathInfo, queryString);
return UrlUtils.buildFullRequestUrl(scheme, serverName, serverPort, requestURI, queryString);
}
public Collection<String> getHeaderNames() {
web/src/main/java/org/springframework/security/web/util/UrlUtils.java
+39 -24
View File
@@ -29,8 +29,8 @@ public final class UrlUtils {
//~ Methods ========================================================================================================
public static String buildFullRequestUrl(HttpServletRequest r) {
return buildFullRequestUrl(r.getScheme(), r.getServerName(), r.getServerPort(), r.getContextPath(),
r.getServletPath(), r.getRequestURI(), r.getPathInfo(), r.getQueryString());
return buildFullRequestUrl(r.getScheme(), r.getServerName(), r.getServerPort(), r.getRequestURI(),
r.getQueryString());
}
/**
@@ -39,29 +39,53 @@ public final class UrlUtils {
* Note that the server port will not be shown if it is the default server port for HTTP or HTTPS
* (80 and 443 respectively).
*
* @return the full URL
* @return the full URL, suitable for redirects (not decoded).
*/
public static String buildFullRequestUrl(String scheme, String serverName, int serverPort, String contextPath,
String servletPath, String requestURI, String pathInfo, String queryString) {
public static String buildFullRequestUrl(String scheme, String serverName, int serverPort, String requestURI,
String queryString) {
boolean includePort = true;
scheme = scheme.toLowerCase();
if ("http".equals(scheme.toLowerCase()) && (serverPort == 80)) {
includePort = false;
StringBuilder url = new StringBuilder();
url.append(scheme).append("://").append(serverName);
// Only add port if not default
if ("http".equals(scheme)) {
if (serverPort != 80) {
url.append(":").append(serverPort);
}
} else if ("https".equals(scheme)) {
if (serverPort != 443) {
url.append(":").append(serverPort);
}
}
if ("https".equals(scheme.toLowerCase()) && (serverPort == 443)) {
includePort = false;
// Use the requestURI as it is encoded (RFC 3986) and hence suitable for redirects.
url.append(requestURI);
if (queryString != null) {
url.append("?").append(queryString);
}
return scheme + "://" + serverName + ((includePort) ? (":" + serverPort) : "") + contextPath
+ buildRequestUrl(servletPath, requestURI, contextPath, pathInfo, queryString);
return url.toString();
}
/**
* Obtains the web application-specific fragment of the request URL.
* <p>
* Under normal spec conditions,
* <pre>
* requestURI = contextPath + servletPath + pathInfo
* </pre>
*
* But the requestURI is not decoded, whereas the servletPath and pathInfo are (SEC-1255).
* This method is typically used to return a URL for matching against secured paths, hence the decoded form is
* used in preference to the requestURI for building the returned value. But this method may also be called using
* dummy request objects which just have the requestURI and contextPatth set, for example, so it will fall back to
* using those.
*
* @return the decoded URL, excluding any server name, context path or servlet path
*
* @return the URL, excluding any server name, context path or servlet path
*/
public static String buildRequestUrl(HttpServletRequest r) {
return buildRequestUrl(r.getServletPath(), r.getRequestURI(), r.getContextPath(), r.getPathInfo(),
@@ -70,18 +94,9 @@ public final class UrlUtils {
/**
* Obtains the web application-specific fragment of the URL.
* <p>
* Under normal spec conditions,
* <pre>
* requestURI = contextPath + servletPath + pathInfo
* </pre>
*
* But this method may also be called using dummy request objects which just have the requestURI and contextPath
* set, for example.
*
* @return the URL, excluding any server name, context path or servlet path
*/
public static String buildRequestUrl(String servletPath, String requestURI, String contextPath, String pathInfo,
private static String buildRequestUrl(String servletPath, String requestURI, String contextPath, String pathInfo,
String queryString) {
StringBuilder url = new StringBuilder();