Package org.apache.catalina.filters

Class CsrfPreventionFilter.CsrfResponseWrapper

java.lang.Object

jakarta.servlet.ServletResponseWrapper

jakarta.servlet.http.HttpServletResponseWrapper

org.apache.catalina.filters.CsrfPreventionFilter.CsrfResponseWrapper

All Implemented Interfaces:

HttpServletResponse, ServletResponse

Enclosing class:

CsrfPreventionFilter

protected static class CsrfPreventionFilter.CsrfResponseWrapper
extends HttpServletResponseWrapper

Wrapper for HttpServletResponse that adds CSRF nonces to encoded URLs.

Field Summary

Fields inherited from interface jakarta.servlet.http.HttpServletResponse

SC_ACCEPTED, SC_BAD_GATEWAY, SC_BAD_REQUEST, SC_CONFLICT, SC_CONTINUE, SC_CREATED, SC_EXPECTATION_FAILED, SC_FORBIDDEN, SC_FOUND, SC_GATEWAY_TIMEOUT, SC_GONE, SC_HTTP_VERSION_NOT_SUPPORTED, SC_INTERNAL_SERVER_ERROR, SC_LENGTH_REQUIRED, SC_METHOD_NOT_ALLOWED, SC_MOVED_PERMANENTLY, SC_MOVED_TEMPORARILY, SC_MULTIPLE_CHOICES, SC_NO_CONTENT, SC_NON_AUTHORITATIVE_INFORMATION, SC_NOT_ACCEPTABLE, SC_NOT_FOUND, SC_NOT_IMPLEMENTED, SC_NOT_MODIFIED, SC_OK, SC_PARTIAL_CONTENT, SC_PAYMENT_REQUIRED, SC_PRECONDITION_FAILED, SC_PROXY_AUTHENTICATION_REQUIRED, SC_REQUEST_ENTITY_TOO_LARGE, SC_REQUEST_TIMEOUT, SC_REQUEST_URI_TOO_LONG, SC_REQUESTED_RANGE_NOT_SATISFIABLE, SC_RESET_CONTENT, SC_SEE_OTHER, SC_SERVICE_UNAVAILABLE, SC_SWITCHING_PROTOCOLS, SC_TEMPORARY_REDIRECT, SC_UNAUTHORIZED, SC_UNSUPPORTED_MEDIA_TYPE, SC_USE_PROXY

Constructor Summary

Constructors

Constructor	Description
CsrfResponseWrapper(HttpServletRequest request, HttpServletResponse response, java.lang.String nonceRequestParameterName, java.lang.String nonce, java.util.Collection<java.util.function.Predicate<java.lang.String>> noNoncePatterns)	Construct a new CsrfResponseWrapper.

Method Summary

Modifier and Type	Method	Description
java.lang.String	encodeRedirectURL(java.lang.String url)	The default behavior of this method is to return encodeRedirectURL(String url) on the wrapped response object.
java.lang.String	encodeURL(java.lang.String url)	The default behavior of this method is to call encodeURL(String url) on the wrapped response object.
static java.lang.String	removeQueryParameters(java.lang.String url, java.lang.String parameterName)	Removes zero or more query parameters from a URL.

Methods inherited from class jakarta.servlet.http.HttpServletResponseWrapper

addCookie, addDateHeader, addHeader, addIntHeader, containsHeader, getHeader, getHeaderNames, getHeaders, getStatus, getTrailerFields, sendError, sendError, sendRedirect, setDateHeader, setHeader, setIntHeader, setStatus, setTrailerFields

Methods inherited from class jakarta.servlet.ServletResponseWrapper

flushBuffer, getBufferSize, getCharacterEncoding, getContentType, getLocale, getOutputStream, getResponse, getWriter, isCommitted, isWrapperFor, isWrapperFor, reset, resetBuffer, setBufferSize, setCharacterEncoding, setContentLength, setContentLengthLong, setContentType, setLocale, setResponse

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface jakarta.servlet.ServletResponse

flushBuffer, getBufferSize, getCharacterEncoding, getContentType, getLocale, getOutputStream, getWriter, isCommitted, reset, resetBuffer, setBufferSize, setCharacterEncoding, setContentLength, setContentLengthLong, setContentType, setLocale

Constructor Detail

CsrfResponseWrapper

public CsrfResponseWrapper(HttpServletRequest request,
                           HttpServletResponse response,
                           java.lang.String nonceRequestParameterName,
                           java.lang.String nonce,
                           java.util.Collection<java.util.function.Predicate<java.lang.String>> noNoncePatterns)

Construct a new CsrfResponseWrapper.

Parameters:

request - The associated request

response - The wrapped response

nonceRequestParameterName - The name of the nonce request parameter

nonce - The current nonce value

noNoncePatterns - The patterns for URLs that should not have nonces added

Method Detail

encodeRedirectURL

public java.lang.String encodeRedirectURL(java.lang.String url)

Description copied from class: jakarta.servlet.http.HttpServletResponseWrapper

The default behavior of this method is to return encodeRedirectURL(String url) on the wrapped response object.

Specified by:

encodeRedirectURL in interface HttpServletResponse

Overrides:

encodeRedirectURL in class HttpServletResponseWrapper

Parameters:

url - the url to be encoded.

Returns:

the encoded URL if encoding is needed; the unchanged URL otherwise.

See Also:

HttpServletResponse.sendRedirect(java.lang.String)

encodeURL

public java.lang.String encodeURL(java.lang.String url)

Description copied from class: jakarta.servlet.http.HttpServletResponseWrapper

The default behavior of this method is to call encodeURL(String url) on the wrapped response object.

Specified by:

encodeURL in interface HttpServletResponse

Overrides:

encodeURL in class HttpServletResponseWrapper

Parameters:

url - the url to be encoded.

Returns:

the encoded URL if encoding is needed; the unchanged URL otherwise.

removeQueryParameters

public static java.lang.String removeQueryParameters(java.lang.String url,
                                                     java.lang.String parameterName)

Removes zero or more query parameters from a URL. All instances of the query parameter and any associated values will be removed.

Parameters:

url - The URL whose query parameters should be removed.

parameterName - The name of the parameter to remove.

Returns:

The URL without any instances of the query parameter parameterName present.