This is an automated email from the ASF dual-hosted git repository. lprimak pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/shiro.git
commit da4419ee5a638a793a20d11e19f5aa93883f58be Author: lprimak <[email protected]> AuthorDate: Wed Aug 19 19:48:37 2026 -0500 bugfix: added formDataKey= in resubmit check --- .../main/java/org/apache/shiro/ee/filters/FormResubmitSupport.java | 3 ++- .../main/java/org/apache/shiro/ee/filters/FormResubmitValidator.java | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupport.java b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupport.java index 20e8b6108..7edbb7b20 100644 --- a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupport.java +++ b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupport.java @@ -109,6 +109,7 @@ public class FormResubmitSupport { static final String FORM_RESUBMIT_WHITELIST = "org.apache.shiro.form-resubmit-whitelist"; static final String FORM_RESUBMIT_BLACKLIST = "org.apache.shiro.form-resubmit-blacklist"; static final String FORM_DATA_CACHE = "org.apache.shiro.form-data-cache"; + static final String FORM_DATA_KEY_PREFIX = "formDataKey="; // encoded view state private static final String FACES_VIEW_STATE = "jakarta.faces.ViewState"; private static final String FACES_VIEW_STATE_EQUALS = FACES_VIEW_STATE + "="; @@ -742,7 +743,7 @@ public class FormResubmitSupport { contextPath, FORM_RESUBMIT_CHECK_SERVLET_PATH))) .timeout(Duration.ofSeconds(3)).header(CONTENT_TYPE, "text/plain") .POST(HttpRequest.BodyPublishers.ofString(rememberMeManager.getCipherService() - .encrypt(savedFormDataKey.getBytes(StandardCharsets.UTF_8), + .encrypt((FORM_DATA_KEY_PREFIX + savedFormDataKey).getBytes(StandardCharsets.UTF_8), rememberMeManager.getEncryptionCipherKey()).toBase64())).build(); var response = client.send(request, HttpResponse.BodyHandlers.ofString()); diff --git a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitValidator.java b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitValidator.java index 72ec2f547..07cade479 100644 --- a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitValidator.java +++ b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitValidator.java @@ -31,6 +31,7 @@ import java.util.UUID; import java.util.stream.Collectors; import static org.apache.shiro.SecurityUtils.getSecurityManager; import static org.apache.shiro.ee.filters.FormResubmitSupport.FORM_DATA_CACHE; +import static org.apache.shiro.ee.filters.FormResubmitSupport.FORM_DATA_KEY_PREFIX; import static org.apache.shiro.ee.filters.FormResubmitSupport.decrypt; import static org.apache.shiro.ee.filters.FormResubmitSupport.getRememberMeManager; import static org.apache.shiro.web.filter.authc.NoAccessFilter.FORM_RESUBMIT_CHECK_SERVLET_PATH; @@ -45,7 +46,8 @@ public class FormResubmitValidator extends HttpServlet { response.setStatus(HttpServletResponse.SC_BAD_REQUEST); } else { try { - String formDataKey = decrypt(request.getReader().lines().collect(Collectors.joining()), rememberMeManager); + String formDataKey = decrypt(request.getReader().lines().collect(Collectors.joining()), rememberMeManager) + .substring(FORM_DATA_KEY_PREFIX.length()); var cache = getSecurityManager(DefaultSecurityManager.class) .getCacheManager().getCache(FORM_DATA_CACHE); Optional.ofNullable(cache.get(UUID.fromString(formDataKey))).orElseThrow(IllegalCallerException::new);
