Introduced protections against user-controlled internal request forwarding

pixeebot[bot] · web-flow · commit f7238cf18ed6 · 2025-02-19T03:09:07.000Z
diff --git a/flow-tests/vaadin-spring-tests/pom.xml b/flow-tests/vaadin-spring-tests/pom.xml
@@ -18,6 +18,7 @@
         <maven.deploy.skip>true</maven.deploy.skip>
         <component.version>24.3.13</component.version>
         <nimbus-jose-jwt.version>9.39.3</nimbus-jose-jwt.version>
+        <versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
     </properties>
 
     <dependencyManagement>
@@ -64,6 +65,11 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <dependency>
+                <groupId>io.github.pixee</groupId>
+                <artifactId>java-security-toolkit</artifactId>
+                <version>${versions.java-security-toolkit}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
diff --git a/flow-tests/vaadin-spring-tests/test-spring-security-flow-urlmapping/pom.xml b/flow-tests/vaadin-spring-tests/test-spring-security-flow-urlmapping/pom.xml
@@ -50,6 +50,10 @@
             <type>test-jar</type>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>io.github.pixee</groupId>
+            <artifactId>java-security-toolkit</artifactId>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/flow-tests/vaadin-spring-tests/test-spring-security-flow-urlmapping/src/main/java/com/vaadin/flow/spring/flowsecurityurlmapping/Application.java b/flow-tests/vaadin-spring-tests/test-spring-security-flow-urlmapping/src/main/java/com/vaadin/flow/spring/flowsecurityurlmapping/Application.java
@@ -1,5 +1,6 @@
 package com.vaadin.flow.spring.flowsecurityurlmapping;
 
+import static io.github.pixee.security.jakarta.PathValidator.validateDispatcherPath;
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
@@ -40,8 +41,8 @@ protected void doFilterInternal(HttpServletRequest request,
                             HttpServletResponse response,
                             FilterChain filterChain)
                             throws ServletException, IOException {
-                        request.getRequestDispatcher(request.getRequestURI()
-                                .substring(URL_MAPPING.length()))
+                        request.getRequestDispatcher(validateDispatcherPath(request.getRequestURI()
+                                .substring(URL_MAPPING.length())))
                                 .forward(request, response);
                     }
                 });
