Skip to content

Commit 7f482ed

Browse files
committed
Fix CookieRequestCache for URL encoded query parameters
Avoid populating the saved request parameters with encoded values. Since the query strings of the request and saved URL are compared and must be equal, we can just use the parameters from the incoming request. Closes gh-9203
1 parent 58e3235 commit 7f482ed

File tree

2 files changed

+19
-6
lines changed

2 files changed

+19
-6
lines changed

web/src/main/java/org/springframework/security/web/savedrequest/CookieRequestCache.java

-6
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@
1717
package org.springframework.security.web.savedrequest;
1818

1919
import java.util.Base64;
20-
import java.util.HashMap;
2120

2221
import javax.servlet.http.Cookie;
2322
import javax.servlet.http.HttpServletRequest;
@@ -79,11 +78,6 @@ public SavedRequest getRequest(HttpServletRequest request, HttpServletResponse r
7978
DefaultSavedRequest.Builder builder = new DefaultSavedRequest.Builder();
8079
int port = getPort(uriComponents);
8180
MultiValueMap<String, String> queryParams = uriComponents.getQueryParams();
82-
if (!queryParams.isEmpty()) {
83-
HashMap<String, String[]> parameters = new HashMap<>(queryParams.size());
84-
queryParams.forEach((key, value) -> parameters.put(key, value.toArray(new String[] {})));
85-
builder.setParameters(parameters);
86-
}
8781
return builder.setScheme(uriComponents.getScheme()).setServerName(uriComponents.getHost())
8882
.setRequestURI(uriComponents.getPath()).setQueryString(uriComponents.getQuery()).setServerPort(port)
8983
.setMethod(request.getMethod()).build();

web/src/test/java/org/springframework/security/web/savedrequest/CookieRequestCacheTests.java

+19
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,25 @@ public void requestWhenDoesNotMatchSavedRequestThenDoesNotClearCookie() {
153153
assertThat(expiredCookie).isNull();
154154
}
155155

156+
@Test
157+
public void matchingRequestWhenUrlEncodedQueryParametersThenDoesNotDuplicate() {
158+
CookieRequestCache cookieRequestCache = new CookieRequestCache();
159+
MockHttpServletRequest request = new MockHttpServletRequest();
160+
request.setServerPort(443);
161+
request.setSecure(true);
162+
request.setScheme("https");
163+
request.setServerName("abc.com");
164+
request.setRequestURI("/destination");
165+
request.setQueryString("goto=https%3A%2F%2Fstart.spring.io");
166+
request.setParameter("goto", "https://start.spring.io");
167+
String redirectUrl = "https://abc.com/destination?goto=https%3A%2F%2Fstart.spring.io";
168+
request.setCookies(new Cookie(DEFAULT_COOKIE_NAME, encodeCookie(redirectUrl)));
169+
MockHttpServletResponse response = new MockHttpServletResponse();
170+
final HttpServletRequest matchingRequest = cookieRequestCache.getMatchingRequest(request, response);
171+
assertThat(matchingRequest).isNotNull();
172+
assertThat(matchingRequest.getParameterValues("goto")).containsExactly("https://start.spring.io");
173+
}
174+
156175
@Test
157176
public void removeRequestWhenInvokedThenSetsAnExpiredCookieOnResponse() {
158177
CookieRequestCache cookieRequestCache = new CookieRequestCache();

0 commit comments

Comments
 (0)