Browse Source
This commit applies the following changes: * Added local Content-Security-Policy with script-src nonce directive * Removed form-redirect.js and associated changes * Renamed to FormPostRedirectStrategy * Removed HtmlUtils usage * Moved to same package as DefaultRedirectStrategypull/16531/head
Steve Riesenberg
11 months ago
12 changed files with 147 additions and 260 deletions
@ -0,0 +1,116 @@
@@ -0,0 +1,116 @@
|
||||
/* |
||||
* Copyright 2002-2025 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web; |
||||
|
||||
import java.io.IOException; |
||||
import java.util.Base64; |
||||
import java.util.List; |
||||
import java.util.Map.Entry; |
||||
|
||||
import jakarta.servlet.http.HttpServletRequest; |
||||
import jakarta.servlet.http.HttpServletResponse; |
||||
|
||||
import org.springframework.http.HttpStatus; |
||||
import org.springframework.http.MediaType; |
||||
import org.springframework.security.crypto.keygen.Base64StringKeyGenerator; |
||||
import org.springframework.security.crypto.keygen.StringKeyGenerator; |
||||
import org.springframework.web.util.HtmlUtils; |
||||
import org.springframework.web.util.UriComponentsBuilder; |
||||
|
||||
/** |
||||
* Redirect using an auto-submitting HTML form using the POST method. All query params |
||||
* provided in the URL are changed to inputs in the form so they are submitted as POST |
||||
* data instead of query string data. |
||||
* |
||||
* @author Craig Andrews |
||||
* @author Steve Riesenberg |
||||
* @since 6.5 |
||||
*/ |
||||
public final class FormPostRedirectStrategy implements RedirectStrategy { |
||||
|
||||
private static final String CONTENT_SECURITY_POLICY_HEADER = "Content-Security-Policy"; |
||||
|
||||
private static final String REDIRECT_PAGE_TEMPLATE = """ |
||||
<!DOCTYPE html> |
||||
<html lang="en"> |
||||
<head> |
||||
<meta charset="utf-8"> |
||||
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> |
||||
<meta name="description" content=""> |
||||
<meta name="author" content=""> |
||||
<title>Redirect</title> |
||||
</head> |
||||
<body> |
||||
<form id="redirect-form" method="POST" action="{{action}}"> |
||||
{{params}} |
||||
<noscript> |
||||
<p>JavaScript is not enabled for this page.</p> |
||||
<button type="submit">Click to continue</button> |
||||
</noscript> |
||||
</form> |
||||
<script nonce="{{nonce}}"> |
||||
document.getElementById("redirect-form").submit(); |
||||
</script> |
||||
</body> |
||||
</html> |
||||
"""; |
||||
|
||||
private static final String HIDDEN_INPUT_TEMPLATE = """ |
||||
<input name="{{name}}" type="hidden" value="{{value}}" /> |
||||
"""; |
||||
|
||||
private static final StringKeyGenerator DEFAULT_NONCE_GENERATOR = new Base64StringKeyGenerator( |
||||
Base64.getUrlEncoder().withoutPadding(), 96); |
||||
|
||||
@Override |
||||
public void sendRedirect(final HttpServletRequest request, final HttpServletResponse response, final String url) |
||||
throws IOException { |
||||
final UriComponentsBuilder uriComponentsBuilder = UriComponentsBuilder.fromUriString(url); |
||||
|
||||
final StringBuilder hiddenInputsHtmlBuilder = new StringBuilder(); |
||||
for (final Entry<String, List<String>> entry : uriComponentsBuilder.build().getQueryParams().entrySet()) { |
||||
final String name = entry.getKey(); |
||||
for (final String value : entry.getValue()) { |
||||
// @formatter:off
|
||||
final String hiddenInput = HIDDEN_INPUT_TEMPLATE |
||||
.replace("{{name}}", HtmlUtils.htmlEscape(name)) |
||||
.replace("{{value}}", HtmlUtils.htmlEscape(value)); |
||||
// @formatter:on
|
||||
hiddenInputsHtmlBuilder.append(hiddenInput.trim()); |
||||
} |
||||
} |
||||
|
||||
// Create the script-src policy directive for the Content-Security-Policy header
|
||||
final String nonce = DEFAULT_NONCE_GENERATOR.generateKey(); |
||||
final String policyDirective = "script-src 'nonce-%s'".formatted(nonce); |
||||
|
||||
// @formatter:off
|
||||
final String html = REDIRECT_PAGE_TEMPLATE |
||||
// Clear the query string as we don't want that to be part of the form action URL
|
||||
.replace("{{action}}", HtmlUtils.htmlEscape(uriComponentsBuilder.query(null).build().toUriString())) |
||||
.replace("{{params}}", hiddenInputsHtmlBuilder.toString()) |
||||
.replace("{{nonce}}", HtmlUtils.htmlEscape(nonce)); |
||||
// @formatter:on
|
||||
|
||||
response.setStatus(HttpStatus.OK.value()); |
||||
response.setContentType(MediaType.TEXT_HTML_VALUE); |
||||
response.setHeader(CONTENT_SECURITY_POLICY_HEADER, policyDirective); |
||||
response.getWriter().write(html); |
||||
response.getWriter().flush(); |
||||
} |
||||
|
||||
} |
||||
@ -1,95 +0,0 @@
@@ -1,95 +0,0 @@
|
||||
/* |
||||
* Copyright 2002-2023 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.server.ui; |
||||
|
||||
import java.io.IOException; |
||||
import java.util.List; |
||||
import java.util.Map.Entry; |
||||
|
||||
import jakarta.servlet.http.HttpServletRequest; |
||||
import jakarta.servlet.http.HttpServletResponse; |
||||
|
||||
import org.springframework.http.HttpStatus; |
||||
import org.springframework.http.MediaType; |
||||
import org.springframework.security.web.RedirectStrategy; |
||||
import org.springframework.web.util.UriComponentsBuilder; |
||||
|
||||
/** |
||||
* Redirect using an autosubmitting HTML form using the POST method. All query params |
||||
* provided in the URL are changed to inputs in the form so they are submitted as POST |
||||
* data instead of query string data. |
||||
*/ |
||||
/* default */ class FormRedirectStrategy implements RedirectStrategy { |
||||
|
||||
private static final String REDIRECT_PAGE_TEMPLATE = """ |
||||
<!DOCTYPE html> |
||||
<html lang="en"> |
||||
<head> |
||||
<meta charset="utf-8"> |
||||
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> |
||||
<meta name="description" content=""> |
||||
<meta name="author" content=""> |
||||
<title>Redirect</title> |
||||
<link href="{{contextPath}}/default-ui.css" rel="stylesheet" /> |
||||
</head> |
||||
<body> |
||||
<div class="content"> |
||||
<form id="redirectForm" class="redirect-form" method="POST" action="{{action}}"> |
||||
{{params}} |
||||
<button class="primary" type="submit">Click to Continue</button> |
||||
</form> |
||||
</div> |
||||
<script src="{{contextPath}}/form-redirect.js"></script> |
||||
</body> |
||||
</html> |
||||
"""; |
||||
|
||||
private static final String HIDDEN_INPUT_TEMPLATE = """ |
||||
<input name="{{name}}" type="hidden" value="{{value}}" /> |
||||
"""; |
||||
|
||||
@Override |
||||
public void sendRedirect(final HttpServletRequest request, final HttpServletResponse response, final String url) |
||||
throws IOException { |
||||
final UriComponentsBuilder uriComponentsBuilder = UriComponentsBuilder.fromUriString(url); |
||||
|
||||
final StringBuilder hiddenInputsHtmlBuilder = new StringBuilder(); |
||||
// inputs
|
||||
for (final Entry<String, List<String>> entry : uriComponentsBuilder.build().getQueryParams().entrySet()) { |
||||
final String name = entry.getKey(); |
||||
for (final String value : entry.getValue()) { |
||||
hiddenInputsHtmlBuilder.append(HtmlTemplates.fromTemplate(HIDDEN_INPUT_TEMPLATE) |
||||
.withValue("name", name) |
||||
.withValue("value", value) |
||||
.render()); |
||||
} |
||||
} |
||||
|
||||
final String html = HtmlTemplates.fromTemplate(REDIRECT_PAGE_TEMPLATE) |
||||
// clear the query string as we don't want that to be part of the form action
|
||||
// URL
|
||||
.withValue("action", uriComponentsBuilder.query(null).build().toUriString()) |
||||
.withRawHtml("params", hiddenInputsHtmlBuilder.toString()) |
||||
.withValue("contextPath", request.getContextPath()) |
||||
.render(); |
||||
response.setStatus(HttpStatus.OK.value()); |
||||
response.setContentType(MediaType.TEXT_HTML_VALUE); |
||||
response.getWriter().write(html); |
||||
response.getWriter().flush(); |
||||
} |
||||
|
||||
} |
||||
@ -1 +0,0 @@
@@ -1 +0,0 @@
|
||||
document.getElementById("redirectForm").submit(); |
||||
@ -1,77 +0,0 @@
@@ -1,77 +0,0 @@
|
||||
/* |
||||
* Copyright 2002-2024 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.server.ui; |
||||
|
||||
import java.nio.charset.StandardCharsets; |
||||
import java.util.List; |
||||
|
||||
import org.junit.jupiter.api.Test; |
||||
import reactor.core.publisher.Mono; |
||||
|
||||
import org.springframework.http.HttpStatus; |
||||
import org.springframework.http.MediaType; |
||||
import org.springframework.mock.http.server.reactive.MockServerHttpRequest; |
||||
import org.springframework.mock.web.server.MockServerWebExchange; |
||||
import org.springframework.web.server.WebFilterChain; |
||||
import org.springframework.web.server.WebHandler; |
||||
import org.springframework.web.server.handler.DefaultWebFilterChain; |
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat; |
||||
|
||||
/** |
||||
* @author Craig Andrews |
||||
* @since 6.4 |
||||
*/ |
||||
class DefaultResourcesFormRedirectJavascriptWebFilterTests { |
||||
|
||||
private final WebHandler notFoundHandler = (exchange) -> { |
||||
exchange.getResponse().setStatusCode(HttpStatus.NOT_FOUND); |
||||
return Mono.empty(); |
||||
}; |
||||
|
||||
private final DefaultResourcesWebFilter filter = DefaultResourcesWebFilter.formRedirectJavascript(); |
||||
|
||||
@Test |
||||
void filterWhenPathMatchesThenRenders() { |
||||
MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/form-redirect.js")); |
||||
WebFilterChain filterChain = new DefaultWebFilterChain(this.notFoundHandler, List.of(this.filter)); |
||||
|
||||
filterChain.filter(exchange).block(); |
||||
|
||||
assertThat(exchange.getResponse().getStatusCode()).isEqualTo(HttpStatus.OK); |
||||
assertThat(exchange.getResponse().getHeaders().getContentType()) |
||||
.isEqualTo(new MediaType("text", "javascript", StandardCharsets.UTF_8)); |
||||
assertThat(exchange.getResponse().getBodyAsString().block()).contains("document"); |
||||
} |
||||
|
||||
@Test |
||||
void filterWhenPathDoesNotMatchThenCallsThrough() { |
||||
MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/does-not-match")); |
||||
WebFilterChain filterChain = new DefaultWebFilterChain(this.notFoundHandler, List.of(this.filter)); |
||||
|
||||
filterChain.filter(exchange).block(); |
||||
|
||||
assertThat(exchange.getResponse().getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND); |
||||
} |
||||
|
||||
@Test |
||||
void toStringPrintsPathAndResource() { |
||||
assertThat(this.filter.toString()).isEqualTo( |
||||
"DefaultResourcesWebFilter{matcher=PathMatcherServerWebExchangeMatcher{pattern='/form-redirect.js', method=GET}, resource='org/springframework/security/form-redirect.js'}"); |
||||
} |
||||
|
||||
} |
||||
Loading…
Reference in new issue