Repository navigation
Handle null name and value in SecurityWrapperResponse.setHeader - #924
Open
VolodymyrLinuxovich wants to merge 1 commit into
Open
VolodymyrLinuxovich wants to merge 1 commit into
VolodymyrLinuxovich wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #906
PR #907 fixed the NullPointerException in stripControls. But setHeader still did not follow the Servlet spec for null. A null value went to the validator with allowNull set to false. It failed and was logged as a security failure. The header was never removed. A null name was also sent to the validator and logged the same way.
Now a null name returns right away and does nothing. A null value skips the value check. The header name is still validated, and when it is valid the call goes through as setHeader(name, null). That removes the header. The Javadoc now says this.
I added two tests to SecurityWrapperResponseTest. They fail on develop and pass with the change. The rest of SecurityWrapperResponseTest, SecurityWrapperRequestTest and HTTPUtilitiesTest still pass. I ran them on JDK 17, which needs --add-opens java.base/java.lang=ALL-UNNAMED for PowerMock.