From c40e9f437fd293f08c308f9430a34f2cfa38029a Mon Sep 17 00:00:00 2001 From: Andy Wilkinson Date: Mon, 20 Feb 2023 16:32:30 +0000 Subject: [PATCH] Upgrade to Undertow 2.3.4.Final Closes gh-34304 --- .../autoconfigure/web/ServerProperties.java | 22 ++++++++++++++++++- .../UndertowWebServerFactoryCustomizer.java | 12 ++++++++-- ...dertowWebServerFactoryCustomizerTests.java | 9 +++++++- .../spring-boot-dependencies/build.gradle | 2 +- 4 files changed, 40 insertions(+), 5 deletions(-) diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java index ead6a72a47b..201d516c50b 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java @@ -1534,10 +1534,19 @@ public class ServerProperties { * Whether the server should decode percent encoded slash characters. Enabling * encoded slashes can have security implications due to different servers * interpreting the slash differently. Only enable this if you have a legacy - * application that requires it. + * application that requires it. Has no effect when server.undertow.decode-slash + * is set. */ private boolean allowEncodedSlash = false; + /** + * Whether encoded slash characters (%2F) should be decoded. Decoding can cause + * security problems if a front-end proxy does not perform the same decoding. Only + * enable this if you have a legacy application that requires it. When set, + * server.undertow.allow-encoded-slash has no effect. + */ + private Boolean decodeSlash; + /** * Whether the URL should be decoded. When disabled, percent-encoded characters in * the URL will be left as-is. @@ -1631,14 +1640,25 @@ public class ServerProperties { this.maxCookies = maxCookies; } + @DeprecatedConfigurationProperty(replacement = "server.undertow.decode-slash") + @Deprecated(forRemoval = true, since = "3.0.3") public boolean isAllowEncodedSlash() { return this.allowEncodedSlash; } + @Deprecated(forRemoval = true, since = "3.0.3") public void setAllowEncodedSlash(boolean allowEncodedSlash) { this.allowEncodedSlash = allowEncodedSlash; } + public Boolean getDecodeSlash() { + return this.decodeSlash; + } + + public void setDecodeSlash(Boolean decodeSlash) { + this.decodeSlash = decodeSlash; + } + public boolean isDecodeUrl() { return this.decodeUrl; } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/UndertowWebServerFactoryCustomizer.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/UndertowWebServerFactoryCustomizer.java index 4a07c8e1cf9..aaeacf0b11f 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/UndertowWebServerFactoryCustomizer.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/UndertowWebServerFactoryCustomizer.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2022 the original author or authors. + * Copyright 2012-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -98,7 +98,7 @@ public class UndertowWebServerFactoryCustomizer map.from(properties::getMaxParameters).to(serverOptions.option(UndertowOptions.MAX_PARAMETERS)); map.from(properties::getMaxHeaders).to(serverOptions.option(UndertowOptions.MAX_HEADERS)); map.from(properties::getMaxCookies).to(serverOptions.option(UndertowOptions.MAX_COOKIES)); - map.from(properties::isAllowEncodedSlash).to(serverOptions.option(UndertowOptions.ALLOW_ENCODED_SLASH)); + mapSlashProperties(properties, serverOptions); map.from(properties::isDecodeUrl).to(serverOptions.option(UndertowOptions.DECODE_URL)); map.from(properties::getUrlCharset).as(Charset::name).to(serverOptions.option(UndertowOptions.URL_CHARSET)); map.from(properties::isAlwaysSetKeepAlive).to(serverOptions.option(UndertowOptions.ALWAYS_SET_KEEP_ALIVE)); @@ -109,6 +109,14 @@ public class UndertowWebServerFactoryCustomizer map.from(properties.getOptions()::getSocket).to(socketOptions.forEach(socketOptions::option)); } + @SuppressWarnings({ "deprecation", "removal" }) + private void mapSlashProperties(Undertow properties, ServerOptions serverOptions) { + PropertyMapper map = PropertyMapper.get().alwaysApplyingWhenNonNull(); + map.from(properties::isAllowEncodedSlash).to(serverOptions.option(UndertowOptions.ALLOW_ENCODED_SLASH)); + map.from(properties::getDecodeSlash).to(serverOptions.option(UndertowOptions.DECODE_SLASH)); + + } + private boolean isPositive(Number value) { return value.longValue() > 0; } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/UndertowWebServerFactoryCustomizerTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/UndertowWebServerFactoryCustomizerTests.java index 53fec27b8d6..464dd440ed8 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/UndertowWebServerFactoryCustomizerTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/UndertowWebServerFactoryCustomizerTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2012-2022 the original author or authors. + * Copyright 2012-2023 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -150,11 +150,18 @@ class UndertowWebServerFactoryCustomizerTests { } @Test + @Deprecated(forRemoval = true, since = "3.0.3") void allowEncodedSlashes() { bind("server.undertow.allow-encoded-slash=true"); assertThat(boundServerOption(UndertowOptions.ALLOW_ENCODED_SLASH)).isTrue(); } + @Test + void enableSlashDecoding() { + bind("server.undertow.decode-slash=true"); + assertThat(boundServerOption(UndertowOptions.DECODE_SLASH)).isTrue(); + } + @Test void disableUrlDecoding() { bind("server.undertow.decode-url=false"); diff --git a/spring-boot-project/spring-boot-dependencies/build.gradle b/spring-boot-project/spring-boot-dependencies/build.gradle index 4437a740885..e0a9534988b 100644 --- a/spring-boot-project/spring-boot-dependencies/build.gradle +++ b/spring-boot-project/spring-boot-dependencies/build.gradle @@ -1489,7 +1489,7 @@ bom { ] } } - library("Undertow", "2.3.3.Final") { + library("Undertow", "2.3.4.Final") { group("io.undertow") { modules = [ "undertow-core",