spring/spring-cloud-netflix
1
0
Fork 0
mirror of https://github.com/spring-cloud/spring-cloud-netflix.git synced 2026-09-18 08:09:07 +00:00
Code Issues Projects Releases Wiki Activity

Add checking for "#". Add logging.

Browse Source
This commit is contained in:
Olga Maciaszek-Sharma
2021-01-19 10:43:14 +01:00
parent c2112ea340
commit 0232945aee
1 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spring-cloud-netflix-zuul/src/main/java/org/springframework/cloud/netflix/zuul/filters/pre/PreDecorationFilter.java
+16 -2
View File
@@ -224,10 +224,24 @@ public class PreDecorationFilter extends ZuulFilter {
return forwardURI;
}
private boolean insecurePath(String uri) {
return uri.contains("../");
private boolean insecurePath(String path) {
if (StringUtils.isEmpty(path)) {
return false;
}
boolean isInvalid = path.contains("..");
if (isInvalid && log.isWarnEnabled()) {
log.warn("Path contains \"..\"");
}
if (!isInvalid) {
isInvalid = path.contains("#");
if (isInvalid && log.isWarnEnabled()) {
log.warn("Path contains \"#\"");
}
}
return isInvalid;
}
private void addProxyHeaders(RequestContext ctx, Route route) {
HttpServletRequest request = ctx.getRequest();
String host = toHostHeader(request);