spring-cloud / spring-cloud/spring-cloud-gateway
Malformed Forwarded header causes a null pointer exception
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 4.9k
- Forks
- 3.5k
- Avg merge
- 20h 57m
- Merged PRs (30d)
- 8
Description
Describe the bug
Sending any 'Forwarded' header without the 'for' element causes a NullPointerException in the ForwardedHeadersFilter
Sample
Any request with the 'Forwarded' header set to any of these examples will break:
Forwarded: brian
Forwarded: 1.1.1.1
Forwarded: host=1.1.1.1
Adding
;for=anything
does not.
Example:
Forwarded: brian;for=anything
It seems that the Forwarded header parsing is not safe, and has not been since the Trusted Proxies support was added.
Stack trace:
java.lang.NullPointerException: Cannot invoke "java.lang.CharSequence.length()" because "this.text" is null
at java.base/java.util.regex.Matcher.getTextLength(Matcher.java:1808)
Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException:
Error has been observed at the following site(s):
*__checkpoint ⇢ AuthorizationWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ ExceptionTranslationWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ LogoutWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ ServerRequestCacheWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ SecurityContextServerWebExchangeWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ AuthenticationWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ ReactorContextWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ HttpHeaderWriterWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ ServerWebExchangeReactorContextWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ org.springframework.security.web.server.WebFilterChainProxy [DefaultWebFilterChain]
*__checkpoint ⇢ HTTP GET "/path/to/resource/malformed/forwardedHeader" [ExceptionHandlingWebHandler]
Original Stack Trace:
at java.base/java.util.regex.Matcher.getTextLength(Matcher.java:1808)
at java.base/java.util.regex.Matcher.reset(Matcher.java:461)
at java.base/java.util.regex.Matcher.(Matcher.java:256)
at java.base/java.util.regex.Pattern.matcher(Pattern.java:1180)
at org.springframework.cloud.gateway.filter.headers.TrustedProxies.lambda$from$0(TrustedProxies.java:52)
at org.springframework.cloud.gateway.filter.headers.ForwardedHeadersFilter.filter(ForwardedHeadersFilter.java:159)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with TrustedProxies.from at TrustedProxies.java:52 and the call from ForwardedHeadersFilter.filter at ForwardedHeadersFilter.java:159. Reproduce the three malformed Forwarded header examples and verify that each is handled without a NullPointerException while headers containing a for element continue to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100