Skip to content

Mutate breaks functionality of StrictFirewallHttpHeaders with recently modified HttpHeaders#writableHttpHeaders #16069

Closed
@MichalStehlikCz

Description

@MichalStehlikCz

Describe the bug
When request wrapped by StrictServerWebExchangeFirewall / StrictFirewallHttpRequest is mutated, header sanitization provided by StrictFirewallHttpHeaders is removed

This is due to fact that

  • HttpHeaders#writabeHttpHeaders implementation is weird, instead of retrieval and copying of header values, it unwraps inner-most multivalue map and uses it in new (mutable) HttpHeaders instance
  • mutated request uses these new HttpHeaders and does not invoke http headers from delegate

Expected behavior
Mutated request should be protected by StrictFirewallHttpHeaders sanitization.

Metadata

Metadata

Assignees

Labels

in: webAn issue in web modules (web, webmvc)type: bugA general bug

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions