OnCommittedResponseWrapper fails on static resources served by Tomcat 8.5

[danielwegener]

Component: spring-security-web-5.1.3.RELEASE.jar (also with latest 5.1.6)

TL;DR: Filters relying on OnCommittedResponseWrapper do not work when a response length is announced with ServletResponse.setContentLengthLong before it is written.

Hey guys. I've noticed, that my HeaderWriters are not triggered for responses served by Tomcats 8.5's default servlet. I've found that the OnCommittedResponseWrapper.onResponseCommitted is never triggered. Debugging through the filter chain I've noticed that tomcats org.apache.catalina.servlets.DefaultServlet uses ServletResponse.setContentLengthLong (see https://github.com/apache/tomcat/blob/8.5.45/java/org/apache/catalina/servlets/DefaultServlet.java#L1063) instead of ServletResponse.setContentLength, which is not covered by OnCommittedResponseWrapper (see

spring-security/web/src/main/java/org/springframework/security/web/util/OnCommittedResponseWrapper.java

Line 67 in f3cdd44

public void setContentLength(int len) {

). Is there any reason why this method is not covered by committed-detection or is it simply an overlooked method during migration to servlet 3.1?

Keep up the good work!

[danielwegener]

Confirmed. I've stopped with the debugger at https://github.com/apache/tomcat/blob/8.5.45/java/org/apache/catalina/servlets/DefaultServlet.java#L1063
and manually executed a response.setContentLength((int)length) which caused the HeaderWriter to write it's headers before commit as expected. Not the kind of proof I prefer, but I could not track down the actual commit change in the connector.Response.

To give some context: In my spring-mvc web-app, I let tomcat serve static resources (from web-fragment jar dependencies from classpath:META-INF/resources) using the containers default Servlet. I'd love to use spring security to add security relevant headers - especially CSP headers for html-files. I think a workaround would be to let spring handle static resources (which probably also is what spring boot is doing as a default).

[rwinch]

@danielwegener Thanks for the report. Can you please put together a minimal sample to reproduce the issue?

[danielwegener]

Here comes the reproducer (sort of, not necessarily tomcat specific): https://gist.github.com/danielwegener/6fe53c3f4625c1761de4507a3dbefe2b
Note that the underscores in filenames are directory separators.

When calling GET http://localhost:8080/test.html (served by tomcats DefaultServlet, important: call it without a cached version!) or GET http://localhost:8080/resourcelike/sucks you won't see any CSP response header.

[rwinch]

Thanks @danielwegener! Can you please turn that into a sample application that I can run rather than a gist?