LocaleChangeInterceptor validates locale values in order to prevent XSS vulnerability (SPR-7779)

git-svn-id: https://src.springframework.org/svn/spring-framework/trunk@3924 50f2f4bb-b051-0410-bef5-90022cba6387

org.springframework.core/src/main/java/org/springframework/util/StringUtils.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2010 the original author or authors.
+ * Copyright 2002-2011 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -643,7 +643,7 @@ public abstract class StringUtils {
 	}
 
 	/**
-	 * Parse the given <code>localeString</code> into a {@link Locale}.
+	 * Parse the given <code>localeString</code> value into a {@link Locale}.
 	 * <p>This is the inverse operation of {@link Locale#toString Locale's toString}.
 	 * @param localeString the locale string, following <code>Locale's</code>
 	 * <code>toString()</code> format ("en", "en_UK", etc);
@@ -651,6 +651,13 @@ public abstract class StringUtils {
 	 * @return a corresponding <code>Locale</code> instance
 	 */
 	public static Locale parseLocaleString(String localeString) {
+		for (int i = 0; i < localeString.length(); i++) {
+			char ch = localeString.charAt(i);
+			if (ch != '_' && !Character.isLetterOrDigit(ch)) {
+				throw new IllegalArgumentException(
+						"Locale value \"" + localeString + "\" contains invalid characters");
+			}
+		}
 		String[] parts = tokenizeToStringArray(localeString, "_ ", false, false);
 		String language = (parts.length > 0 ? parts[0] : "");
 		String country = (parts.length > 1 ? parts[1] : "");

org.springframework.core/src/test/java/org/springframework/util/StringUtilsTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2008 the original author or authors.
+ * Copyright 2002-2011 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -611,4 +611,17 @@ public class StringUtilsTests extends TestCase {
 		assertEquals("Multi-valued variant portion of the Locale not extracted correctly.", variant, locale.getVariant());
 	}
 
+	/**
+	 * <a href="http://opensource.atlassian.com/projects/spring/browse/SPR-7779">See SPR-7779</a>.
+	 */
+	public void testParseLocaleWithInvalidCharacters() {
+		try {
+			StringUtils.parseLocaleString("%0D%0AContent-length:30%0D%0A%0D%0A%3Cscript%3Ealert%28123%29%3C/script%3E");
+			fail("Should have thrown IllegalArgumentException");
+		}
+		catch (IllegalArgumentException ex) {
+			// expected
+		}
+	}
+
 }

org.springframework.web.servlet/src/main/java/org/springframework/web/servlet/i18n/LocaleChangeInterceptor.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2008 the original author or authors.
+ * Copyright 2002-2011 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,13 +16,11 @@
 
 package org.springframework.web.servlet.i18n;
 
-import java.util.Locale;
-
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.springframework.beans.propertyeditors.LocaleEditor;
+import org.springframework.util.StringUtils;
 import org.springframework.web.servlet.LocaleResolver;
 import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
 import org.springframework.web.servlet.support.RequestContextUtils;
@@ -72,9 +70,7 @@ public class LocaleChangeInterceptor extends HandlerInterceptorAdapter {
 			if (localeResolver == null) {
 				throw new IllegalStateException("No LocaleResolver found: not in a DispatcherServlet request?");
 			}
-			LocaleEditor localeEditor = new LocaleEditor();
+			localeResolver.setLocale(request, response, StringUtils.parseLocaleString(newLocale));
-			localeEditor.setAsText(newLocale);
-			localeResolver.setLocale(request, response, (Locale) localeEditor.getValue());
 		}
 		// Proceed in any case.
 		return true;