Make vertical bar | configurable in StrictHttpFirewall

Summary

The implementation of StrictHttpFirewall should be extended with support for allowing the vertical bar |.

Actual Behavior

Currently the vertical bar cannot be whitelisted, and the firewall rejects the uri.

org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String "%7C"

Expected Behavior

Fine-grained configuration of the StrictHttpFirewall, adding the possibility to allow the vertical bar.

Alternatively the StrictHttpFirewall can be made more extendable by making urlBlacklistsAddAll and urlBlacklistsRemoveAll accessable.

Configuration

    @Bean
    public HttpFirewall allowUrlEncodedVerticalBarHttpFirewall() {
        StrictHttpFirewall firewall = new StrictHttpFirewall();
        firewall.setAllowVerticalBar(true);
        return firewall;
    }

Version

since 5.0.1

Sample

    private static final List<String> FORBIDDEN_VERTICALBAR = Collections.unmodifiableList(Arrays.asList("|", "%7c", "%7C"));

    /**
     * <p>
     * Determines if a vertical bar "|" or a URL vertical bar "%7C" should be allowed in
     * the path or not. The default is not to allow this behavior because it is a frequent
     * source of security exploits.
     * </p>
     * <p>
     * For example, due to ambiguities in the servlet specification a URL encoded period
     * might lead to bypassing security constraints through a directory traversal attack.
     * This is because the path is not parsed consistently which results  in different
     * values in {@code HttpServletRequest} path related values which allow bypassing
     * certain security constraints.
     * </p>
     *
     * @param allowVerticalBar a backslash "|" or a URL encoded backslash "%7C" be allowed
     *                         in the path or not. Default is false
     */
    public void setAllowVerticalBar(boolean allowVerticalBar) {
        if (allowVerticalBar) {
            urlBlacklistsRemoveAll(FORBIDDEN_VERTICALBAR);
        } else {
            urlBlacklistsAddAll(FORBIDDEN_VERTICALBAR);
        }
    }

Start at the StrictHttpFirewall entry point and inspect how its URL blacklists are maintained and checked. Compare the existing configuration methods with the requested setAllowVerticalBar behavior, then verify that vertical bars remain rejected by default and can be allowed when configured. The issue does not name a test file, so locate the firewall tests covering URL rejection and configuration.