spring-cloud / spring-cloud/spring-cloud-gateway

Malformed Forwarded header causes a null pointer exception

Open
#3,832 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

waiting-for-triage
Dominant language
Java
Stars
4.9k
Forks
3.5k
Avg merge
20h 57m
Merged PRs (30d)
8

Description

Describe the bug
Sending any 'Forwarded' header without the 'for' element causes a NullPointerException in the ForwardedHeadersFilter

Sample
Any request with the 'Forwarded' header set to any of these examples will break:

Forwarded: brian
Forwarded: 1.1.1.1
Forwarded: host=1.1.1.1

Adding
;for=anything
does not.
Example:

Forwarded: brian;for=anything

It seems that the Forwarded header parsing is not safe, and has not been since the Trusted Proxies support was added.

Stack trace:

java.lang.NullPointerException: Cannot invoke "java.lang.CharSequence.length()" because "this.text" is null
at java.base/java.util.regex.Matcher.getTextLength(Matcher.java:1808)
Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException:
Error has been observed at the following site(s):
*__checkpoint ⇢ AuthorizationWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ ExceptionTranslationWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ LogoutWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ ServerRequestCacheWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ SecurityContextServerWebExchangeWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ AuthenticationWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ ReactorContextWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ HttpHeaderWriterWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ ServerWebExchangeReactorContextWebFilter [DefaultWebFilterChain]
*__checkpoint ⇢ org.springframework.security.web.server.WebFilterChainProxy [DefaultWebFilterChain]
*__checkpoint ⇢ HTTP GET "/path/to/resource/malformed/forwardedHeader" [ExceptionHandlingWebHandler]
Original Stack Trace:
at java.base/java.util.regex.Matcher.getTextLength(Matcher.java:1808)
at java.base/java.util.regex.Matcher.reset(Matcher.java:461)
at java.base/java.util.regex.Matcher.(Matcher.java:256)
at java.base/java.util.regex.Pattern.matcher(Pattern.java:1180)
at org.springframework.cloud.gateway.filter.headers.TrustedProxies.lambda$from$0(TrustedProxies.java:52)
at org.springframework.cloud.gateway.filter.headers.ForwardedHeadersFilter.filter(ForwardedHeadersFilter.java:159)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with TrustedProxies.from at TrustedProxies.java:52 and the call from ForwardedHeadersFilter.filter at ForwardedHeadersFilter.java:159. Reproduce the three malformed Forwarded header examples and verify that each is handled without a NullPointerException while headers containing a for element continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, spring-boot
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.