jdaugherty commented on PR #15967:
URL: https://github.com/apache/grails-core/pull/15967#issuecomment-5816450865
@matrei thanks, both behaviour findings reproduced on embedded Tomcat and
are fixed in 8da7b05c58.
1. `isSecure` no longer touches the request URL. It applies the forwarded
headers to the request's scheme alone, so `/p|x` with `relaxedPathChars` and
HSTS enabled returns 200 with HSTS (when forwarded as https) instead of 500.
Added a spec over `|`, `{}`, `[]`, `^` and `` ` `` paths, plus one pinning that
a container scheme of `https` still counts when `isSecure()` is false.
2. Writer output is now counted in encoded bytes: exactly for UTF-8 and
single-byte encodings, and at `maxBytesPerChar` for any other. The Tomcat spec
has a `setBufferSize(32768)` + 400 × `'日' * 50` row, and unit specs cover 2-,
3- and 4-byte UTF-8 through `write(String)`, `write(char[])` and `write(int)`,
`Shift_JIS`, and a multi-byte body reaching `Content-Length`. The enlarged
buffer also carried over to a request on a *new* connection in my run, not only
the same keep-alive one, since Tomcat recycles the processor along with its
buffer. Byte counting covers that too, because the wrapper reads the real
buffer size. The Javadoc now describes the trade-off you pointed out: for a
large multi-byte body, Grails can fire before Spring Security's
character-counting wrapper. The Spring Security ordering section of
`security.adoc` says so as well.
3. The PR description still needs rewriting; that is not part of this push.
4. The upgrade note is now its own section, 73 (appended rather than
renumbered, because the guide cross-references sections by number, e.g.
"section 53").
5. Reworded: `defaults` doesn't apply to explicitly configured headers; an
explicit header is sent if it is enabled and has a value; `enabled: false` is
never sent; CSP and HSTS need `enabled: true` as well as a value.
6. Character-encoding claim corrected in all three places (Grails' own
filter at -180 runs inside; only the forwarded-header filter, and
`ErrorPageFilter` in a WAR, are outside). `REVERSE_PROXY_REQUEST_HEADERS` is
package-private and the spec lists the headers literally. The Tomcat spec uses
`@TempDir` and now checks the exact value of all four headers, with a
`referrerPolicy` column for the `/println` row. I kept its own client rather
than `HttpClientSupport` for now, because the new multi-byte row compares the
raw byte length.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
