Skip to content

S
spring-cloud-netflix
Commit ea1a4c5a by Jacques-Etienne Beaudet
Options

Sensitive headers set in PreDecorationFilter no longer override previously set ignored headers.

Removed the case sensitiveness when the sensitive headers are set. Fixes https://github.com/spring-cloud/spring-cloud-netflix/issues/1003
parent 88864153
Showing with 65 additions and 10 deletions
spring-cloud-netflix-core/src/main/java/org/springframework/cloud/netflix/zuul/ZuulProxyConfiguration.java
......@@ -85,10 +85,12 @@ public class ZuulProxyConfiguration extends ZuulConfiguration {
// pre filters
@Bean
public PreDecorationFilter preDecorationFilter(RouteLocator routeLocator) {
public PreDecorationFilter preDecorationFilter(RouteLocator routeLocator,
ProxyRequestHelper proxyRequestHelper) {
return new PreDecorationFilter(routeLocator,
this.server.getServletPrefix(),
this.zuulProperties);
this.zuulProperties,
proxyRequestHelper);
}
// route filters
......
spring-cloud-netflix-core/src/main/java/org/springframework/cloud/netflix/zuul/filters/pre/PreDecorationFilter.java
......@@ -43,13 +43,17 @@ public class PreDecorationFilter extends ZuulFilter {
private ZuulProperties properties;
private UrlPathHelper urlPathHelper = new UrlPathHelper();
private ProxyRequestHelper proxyRequestHelper;
public PreDecorationFilter(RouteLocator routeLocator,
String dispatcherServletPath, ZuulProperties properties) {
String dispatcherServletPath, ZuulProperties properties,
ProxyRequestHelper proxyRequestHelper) {
this.routeLocator = routeLocator;
this.properties = properties;
this.urlPathHelper.setRemoveSemicolonContent(properties.isRemoveSemicolonContent());
this.dispatcherServletPath = dispatcherServletPath;
this.proxyRequestHelper = proxyRequestHelper;
}
@Override
......@@ -81,9 +85,9 @@ public class PreDecorationFilter extends ZuulFilter {
ctx.put("requestURI", route.getPath());
ctx.put("proxy", route.getId());
if (route.getSensitiveHeaders().isEmpty()) {
ctx.put(ProxyRequestHelper.IGNORED_HEADERS, this.properties.getSensitiveHeaders());
proxyRequestHelper.addIgnoredHeaders(this.properties.getSensitiveHeaders().toArray(new String[0]));
} else {
ctx.put(ProxyRequestHelper.IGNORED_HEADERS, route.getSensitiveHeaders());
proxyRequestHelper.addIgnoredHeaders(route.getSensitiveHeaders().toArray(new String[0]));
}
if (route.getRetryable() != null) {
......
spring-cloud-netflix-core/src/test/java/org/springframework/cloud/netflix/zuul/filters/pre/PreDecorationFilterTests.java
......@@ -16,7 +16,9 @@
package org.springframework.cloud.netflix.zuul.filters.pre;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
......@@ -53,6 +55,8 @@ public class PreDecorationFilterTests {
private DiscoveryClientRouteLocator routeLocator;
private MockHttpServletRequest request = new MockHttpServletRequest();
private ProxyRequestHelper proxyRequestHelper = new ProxyRequestHelper();
@Before
public void init() {
......@@ -60,7 +64,7 @@ public class PreDecorationFilterTests {
this.properties = new ZuulProperties();
this.routeLocator = new DiscoveryClientRouteLocator("/", this.discovery,
this.properties);
this.filter = new PreDecorationFilter(this.routeLocator, "/", this.properties);
this.filter = new PreDecorationFilter(this.routeLocator, "/", this.properties, proxyRequestHelper);
RequestContext ctx = RequestContext.getCurrentContext();
ctx.clear();
ctx.setRequest(this.request);
......@@ -81,7 +85,7 @@ public class PreDecorationFilterTests {
@Test
public void skippedIfForwardToSet() throws Exception {
RequestContext.getCurrentContext().set("forward.to", "mycontext");
RequestContext.getCurrentContext().set("forward.to", "myconteext");
assertEquals(false, this.filter.shouldFilter());
}
......@@ -189,7 +193,7 @@ public class PreDecorationFilterTests {
new ZuulRoute("foo", "/foo/**", null, "forward:/foo", true, null, null));
this.filter = new PreDecorationFilter(this.routeLocator,
"/special", this.properties);
"/special", this.properties, proxyRequestHelper);
this.request.setRequestURI("/api/bar/1");
......@@ -233,7 +237,7 @@ public class PreDecorationFilterTests {
this.routeLocator.addRoute(
new ZuulRoute("foo", "/foo/**", null, "forward:/foo", true, null, null));
this.filter = new PreDecorationFilter(this.routeLocator,
"/special", this.properties);
"/special", this.properties, proxyRequestHelper);
this.filter.run();
......@@ -258,7 +262,7 @@ public class PreDecorationFilterTests {
new ZuulRoute("foo", "/foo/**", null, "forward:/foo", true, null, null));
this.filter = new PreDecorationFilter(this.routeLocator,
"/special", this.properties);
"/special", this.properties, proxyRequestHelper);
this.filter.run();
......@@ -296,6 +300,51 @@ public class PreDecorationFilterTests {
assertTrue("sensitiveHeaders is wrong", sensitiveHeaders.containsAll(Collections.singletonList("x-bar")));
assertFalse("sensitiveHeaders is wrong", sensitiveHeaders.contains("Cookie"));
}
@Test
public void sensitiveHeadersCaseInsensitive() throws Exception {
this.properties.setPrefix("/api");
this.properties.setStripPrefix(true);
this.properties.setSensitiveHeaders(Collections.singleton("X-bAr"));
this.request.setRequestURI("/api/foo/1");
this.routeLocator.addRoute("/foo/**", "foo");
this.filter.run();
RequestContext ctx = RequestContext.getCurrentContext();
@SuppressWarnings("unchecked")
Set<String> sensitiveHeaders = (Set<String>) ctx.get(ProxyRequestHelper.IGNORED_HEADERS);
assertTrue("sensitiveHeaders is wrong", sensitiveHeaders.containsAll(Collections.singletonList("x-bar")));
}
@Test
public void sensitiveHeadersOverrideCaseInsensitive() throws Exception {
this.properties.setPrefix("/api");
this.properties.setStripPrefix(true);
this.properties.setSensitiveHeaders(Collections.singleton("X-bAr"));
this.request.setRequestURI("/api/foo/1");
ZuulRoute route = new ZuulRoute("/foo/**", "foo");
route.setSensitiveHeaders(Collections.singleton("X-Foo"));
this.routeLocator.addRoute(route);
this.filter.run();
RequestContext ctx = RequestContext.getCurrentContext();
@SuppressWarnings("unchecked")
Set<String> sensitiveHeaders = (Set<String>) ctx.get(ProxyRequestHelper.IGNORED_HEADERS);
assertTrue("sensitiveHeaders is wrong", sensitiveHeaders.containsAll(Collections.singletonList("x-foo")));
}
@Test
public void ignoredHeadersAlreadySetInRequestContextDontGetOverridden() throws Exception {
this.properties.setPrefix("/api");
this.properties.setStripPrefix(true);
this.properties.setSensitiveHeaders(Collections.singleton("x-bar"));
this.request.setRequestURI("/api/foo/1");
this.routeLocator.addRoute("/foo/**", "foo");
RequestContext ctx = RequestContext.getCurrentContext();
ctx.set(ProxyRequestHelper.IGNORED_HEADERS, new HashSet<>(Arrays.asList("x-foo")));
this.filter.run();
@SuppressWarnings("unchecked")
Set<String> sensitiveHeaders = (Set<String>) ctx.get(ProxyRequestHelper.IGNORED_HEADERS);
assertTrue("sensitiveHeaders is wrong", sensitiveHeaders.containsAll(Arrays.asList("x-bar","x-foo")));
}
private Object getHeader(List<Pair<String, String>> headers, String key) {
String value = null;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment