Skip to content

Reject the NULL character in paths in StrictHttpFirewall #8703

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 18, 2020
Merged

Reject the NULL character in paths in StrictHttpFirewall #8703

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 26 additions & 1 deletion web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright 2012-2019 the original author or authors.
* Copyright 2012-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
Expand Down Expand Up @@ -64,6 +64,9 @@
* Rejects URLs that contain a backslash. See {@link #setAllowBackSlash(boolean)}
* </li>
* <li>
* Rejects URLs that contain a null character. See {@link #setAllowNull(boolean)}
* </li>
* <li>
* Rejects URLs that contain a URL encoded percent. See
* {@link #setAllowUrlEncodedPercent(boolean)}
* </li>
Expand Down Expand Up @@ -98,6 +101,8 @@ public class StrictHttpFirewall implements HttpFirewall {

private static final List<String> FORBIDDEN_BACKSLASH = Collections.unmodifiableList(Arrays.asList("\\", "%5c", "%5C"));

private static final List<String> FORBIDDEN_NULL = Collections.unmodifiableList(Arrays.asList("\0", "%00"));

private Set<String> encodedUrlBlocklist = new HashSet<>();

private Set<String> decodedUrlBlocklist = new HashSet<>();
Expand All @@ -111,6 +116,7 @@ public StrictHttpFirewall() {
urlBlocklistsAddAll(FORBIDDEN_FORWARDSLASH);
urlBlocklistsAddAll(FORBIDDEN_DOUBLE_FORWARDSLASH);
urlBlocklistsAddAll(FORBIDDEN_BACKSLASH);
urlBlocklistsAddAll(FORBIDDEN_NULL);

this.encodedUrlBlocklist.add(ENCODED_PERCENT);
this.encodedUrlBlocklist.addAll(FORBIDDEN_ENCODED_PERIOD);
Expand Down Expand Up @@ -281,6 +287,25 @@ public void setAllowBackSlash(boolean allowBackSlash) {
}
}

/**
* <p>
* Determines if a null "\0" or a URL encoded nul "%00" should be allowed in
* the path or not. The default is not to allow this behavior because it is a frequent
* source of security exploits.
* </p>
*
* @param allowNull a null "\0" or a URL encoded null "%00" be allowed
* in the path or not. Default is false
* @since 5.4
*/
public void setAllowNull(boolean allowNull) {
if (allowNull) {
urlBlocklistsRemoveAll(FORBIDDEN_NULL);
} else {
urlBlocklistsAddAll(FORBIDDEN_NULL);
}
}

/**
* <p>
* Determines if a percent "%" that is URL encoded "%25" should be allowed in the path
Expand Down
14 changes: 13 additions & 1 deletion web/src/test/java/org/springframework/security/web/firewall/StrictHttpFirewallTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* Copyright 2012-2019 the original author or authors.
* Copyright 2012-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
Expand Down Expand Up @@ -377,6 +377,18 @@ public void getFirewalledRequestWhenExceedsUpperboundAsciiThenException() {
this.firewall.getFirewalledRequest(this.request);
}

@Test(expected = RequestRejectedException.class)
public void getFirewalledRequestWhenContainsNullThenException() {
this.request.setRequestURI("/\0");
this.firewall.getFirewalledRequest(this.request);
}

@Test(expected = RequestRejectedException.class)
public void getFirewalledRequestWhenContainsEncodedNullThenException() {
this.request.setRequestURI("/something%00/");
this.firewall.getFirewalledRequest(this.request);
}

// --- from DefaultHttpFirewallTests ---

/**
Expand Down