Suppress ArrayIndexOutOfBoundsException in XorCsrfTokenRequestAttribu…

…teHandler Closes gh-13310
spring-projects · Aug 7, 2023 · e21da06 · e21da06
1 parent 75e0068
commit e21da06
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/.../main/java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandler.java b/.../main/java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandler.java
@@ -97,7 +97,7 @@ private static String getTokenValue(String actualToken, String token) {
 		System.arraycopy(actualBytes, randomBytesSize, xoredCsrf, 0, tokenSize);
 
 		byte[] csrfBytes = xorCsrf(randomBytes, xoredCsrf);
-		return Utf8.decode(csrfBytes);
+		return (csrfBytes != null) ? Utf8.decode(csrfBytes) : null;
 	}
 
 	private static String createXoredCsrfToken(SecureRandom secureRandom, String token) {
@@ -114,6 +114,9 @@ private static String createXoredCsrfToken(SecureRandom secureRandom, String tok
 	}
 
 	private static byte[] xorCsrf(byte[] randomBytes, byte[] csrfBytes) {
+		if (csrfBytes.length < randomBytes.length) {
+			return null;
+		}
 		int len = Math.min(randomBytes.length, csrfBytes.length);
 		byte[] xoredCsrf = new byte[len];
 		System.arraycopy(csrfBytes, 0, xoredCsrf, 0, csrfBytes.length);

diff --git a/.../java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandlerTests.java b/.../java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandlerTests.java
@@ -208,6 +208,14 @@ public void resolveCsrfTokenValueWhenHeaderAndParameterSetThenHeaderIsPreferred(
 		assertThat(tokenValue).isEqualTo(this.token.getToken());
 	}
 
+	@Test
+	public void resolveCsrfTokenIsInvalidThenReturnsNull() {
+		this.request.setParameter(this.token.getParameterName(), XOR_CSRF_TOKEN_VALUE);
+		CsrfToken csrfToken = new DefaultCsrfToken("headerName", "paramName", "a");
+		String tokenValue = this.handler.resolveCsrfTokenValue(this.request, csrfToken);
+		assertThat(tokenValue).isNull();
+	}
+
 	private static Answer<Void> fillByteArray() {
 		return (invocation) -> {
 			byte[] bytes = invocation.getArgument(0);