Skip to content

Commit dac97f1

Browse files
committed
Restrict HTTP methods on Reactive HiddenHttpMethodFilter
This commit restricts the allowed HTTP methods on HiddenHttpMethodFilter (Reactive variant) to the following: PUT, DELETE, PATCH. This filter is meant to be used to simulate those methods from HTML forms sent by browsers, so no other methods are allowed. Issue: SPR-16836 (Cherry-picked from a5cd01a)
1 parent f2694a8 commit dac97f1

File tree

2 files changed

+21
-3
lines changed

2 files changed

+21
-3
lines changed

spring-web/src/main/java/org/springframework/web/filter/reactive/HiddenHttpMethodFilter.java

+14-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2017 the original author or authors.
2+
* Copyright 2002-2018 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,9 @@
1616

1717
package org.springframework.web.filter.reactive;
1818

19+
import java.util.Arrays;
20+
import java.util.Collections;
21+
import java.util.List;
1922
import java.util.Locale;
2023

2124
import reactor.core.publisher.Mono;
@@ -45,6 +48,10 @@
4548
*/
4649
public class HiddenHttpMethodFilter implements WebFilter {
4750

51+
private static final List<HttpMethod> ALLOWED_METHODS =
52+
Collections.unmodifiableList(Arrays.asList(HttpMethod.PUT,
53+
HttpMethod.DELETE, HttpMethod.PATCH));
54+
4855
/** Default name of the form parameter with the HTTP method to use */
4956
public static final String DEFAULT_METHOD_PARAMETER_NAME = "_method";
5057

@@ -87,7 +94,12 @@ public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
8794
private ServerWebExchange mapExchange(ServerWebExchange exchange, String methodParamValue) {
8895
HttpMethod httpMethod = HttpMethod.resolve(methodParamValue.toUpperCase(Locale.ENGLISH));
8996
Assert.notNull(httpMethod, () -> "HttpMethod '" + methodParamValue + "' not supported");
90-
return exchange.mutate().request(builder -> builder.method(httpMethod)).build();
97+
if (ALLOWED_METHODS.contains(httpMethod)) {
98+
return exchange.mutate().request(builder -> builder.method(httpMethod)).build();
99+
}
100+
else {
101+
return exchange;
102+
}
91103
}
92104

93105
}

spring-web/src/test/java/org/springframework/web/filter/reactive/HiddenHttpMethodFilterTests.java

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2017 the original author or authors.
2+
* Copyright 2002-2018 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -52,6 +52,12 @@ public void filterWithParameter() {
5252
assertEquals(HttpMethod.DELETE, this.filterChain.getHttpMethod());
5353
}
5454

55+
@Test
56+
public void filterWithParameterMethodNotAllowed() {
57+
postForm("_method=TRACE").block(Duration.ZERO);
58+
assertEquals(HttpMethod.POST, this.filterChain.getHttpMethod());
59+
}
60+
5561
@Test
5662
public void filterWithNoParameter() {
5763
postForm("").block(Duration.ZERO);

0 commit comments

Comments
 (0)