Skip to content

Commit

Permalink
ShenYu Admin Cluster #5448
Browse files Browse the repository at this point in the history
  • Loading branch information
Aias00 committed Apr 24, 2024
1 parent 757620e commit 443eafa
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 14 deletions.
8 changes: 0 additions & 8 deletions shenyu-admin/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -298,14 +298,6 @@
<version>${project.version}</version>
</dependency>
<!-- shenyu-admin-listener end-->

<!-- esapi start -->
<dependency>
<groupId>org.owasp.esapi</groupId>
<artifactId>esapi</artifactId>
<version>2.5.3.1</version>
</dependency>
<!-- esapi end -->

</dependencies>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -130,24 +130,20 @@ private void forwardRequest(final HttpServletRequest request, final HttpServletR
private void copyHeaders(final HttpServletRequest request, final HttpHeaders headers) {
Collections.list(request.getHeaderNames())
.forEach(headerName -> {
headers.add(headerName, sanitizeHeaderValue(request.getHeader(headerName)));
headers.add(headerName, request.getHeader(headerName).replace("\r", "").replace("\n", ""));
});
}

private void copyHeaders(final HttpHeaders sourceHeaders, final HttpServletResponse response) {
sourceHeaders.forEach((headerName, headerValues) -> {
if (!response.containsHeader(headerName)) {
headerValues.forEach(headerValue -> {
response.addHeader(headerName, sanitizeHeaderValue(headerValue));
response.addHeader(headerName, headerValue.replace("\r", "").replace("\n", ""));

Check warning

Code scanning / CodeQL

HTTP response splitting Medium

This header depends on a
user-provided value
, which may cause a response-splitting vulnerability.

Check warning

Code scanning / CodeQL

HTTP response splitting Medium

This header depends on a
user-provided value
, which may cause a response-splitting vulnerability.
});
}
});
}

private static String sanitizeHeaderValue(final String headerValue) {
return headerValue.replace("\r", "").replace("\n", "");
}

private byte[] getBody(final HttpServletRequest request) throws IOException {
InputStream is = request.getInputStream();
ByteArrayOutputStream baos = new ByteArrayOutputStream();
Expand Down

0 comments on commit 443eafa

Please sign in to comment.