New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Skip Content-Disposition header when status != 2xx [SPR-13588] #18165

Closed
spring-issuemaster opened this Issue Oct 19, 2015 · 3 comments

Comments

Projects
None yet
2 participants
@spring-issuemaster
Copy link
Collaborator

spring-issuemaster commented Oct 19, 2015

Rossen Stoyanchev opened SPR-13588 and commented

The fix to protect against RFD exploits (#18124) introduced a "Content-Disposition:attachment;filename=f.txt" response header for @ResponseBody methods where the URL appears to have an extension that is neither whitelisted by default nor explicitly registered by the application.

The URL checked for extensions is always the original URL even in the case of a forwarded request. In the case of an ERROR dispatch, Servlet containers are expected to set up the same request attributes as for forwarded requests.

Since Spring Boot relies on ERROR dispatches, a request with an unknown extension that results in an error can be rendered with a Content-Disposition header. This doesn't appear to cause issues in the browser but we should explore whether we can drop the header in such cases.

Note this issue was originally reported under Spring Boot ticket #4220.


Affects: 3.2.15, 4.1.8, 4.2.2

Issue Links:

  • #18190 Skip Content-Disposition header when requestUri is the context and/or the servlet path ("is duplicated by")
  • #18164 Content-Disposition header causes download in browser for Spring Boot Actuator endpoints
  • #18124 Protect against RFD exploits

Referenced from: commits a879897, 050e79e

Backported to: 4.1.9, 3.2.16

@spring-issuemaster

This comment has been minimized.

Copy link
Collaborator Author

spring-issuemaster commented Oct 19, 2015

Rob Winch commented

I'm not sure this is the best idea since the error page might contain reflected input.

@spring-issuemaster

This comment has been minimized.

Copy link
Collaborator Author

spring-issuemaster commented Oct 19, 2015

Rossen Stoyanchev commented

I guess the question is whether the download behavior is different for status 4xx and 5xx. That includes the content types for which specific browsers may force a download (section 2.3.1 in the RFD paper) and/or the hyperlink "download" attribute. If an error status precludes a download, then presumably there is no need for a content-disposition header.

@spring-issuemaster

This comment has been minimized.

Copy link
Collaborator Author

spring-issuemaster commented Oct 26, 2015

Rossen Stoyanchev commented

Browsers I tested with (Firefox, Chrome, IE 7/8/9) don't seem to switch to download when status is 4xx or 5xx. In Firefox/Chrome the presence of a Content-Disposition header actually seems to be treated as an error. In Firefox it shows as 404 (this ticket looks relevant). Furthermore it doesn't make sense to have Content-Disposition with 3xx either so the final fix checks if response is in 2xx range.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment