reiern70 opened a new pull request, #1689: URL: https://github.com/apache/wicket/pull/1689
Closes #1688 `ServletRequestCopy` and `JavaxUpgradeHttpRequest`, the requests Wicket keeps for the life of a WebSocket connection, did not follow the Servlet rules for headers. Thanks @guidecom-ze for the report and the analysis. ### What was wrong - Lookups used the exact name the container reported, so a lowercase `origin` (HTTP/2, many proxies) was not found as `Origin`, and `WebSocketConnectionOriginFilter` rejected the connection. - `ServletRequestCopy` handed out the enumerations of the request it copied, which can be read once: a second `getHeader` returned the next value or `null`, a second `getHeaders` a spent enumeration. `getIntHeader` consumed them as well and threw a `NullPointerException` for an absent header. `getLocales` had the same problem. - `getHeaders` returned `null` for an absent header (and `JavaxUpgradeHttpRequest.getHeaderNames` when there were none). `ServletWebRequest.getHeaders` dereferences it, so `WebRequest#getHeaders` on a WebSocket request threw a `NullPointerException`. ### What it does now - Both classes copy the headers when they are created, into a map whose names compare case-insensitively, and return a fresh enumeration on every read, empty rather than `null`. - `ServletRequestCopy.getIntHeader` returns `-1` for an absent header, and the locales are copied up front. - A name the copied request reports in more than one case (Jetty does) is copied once, because that request's `getHeaders` already returns all of its values. `JavaxUpgradeHttpRequest` merges the values of handshake map keys that differ only in case. - `getHeaderNames` lists each name once, in case-insensitive alphabetical order. Only private fields change: no API change, nothing to migrate. ### Not in this PR - `ServletRequestCopy.getDateHeader` always returns 0. - `JavaxUpgradeHttpRequest.getLocale()` and `getLocales()` return `null`, and its `getIntHeader` and `getDateHeader` do not follow the Servlet rules for absent or malformed values. ### Backport Both files are identical on `wicket-10.x`, so the commit cherry-picks cleanly there; `wicket-9.x` would need adapting. Which lines it goes to is still open. ### Tests - `ServletRequestCopyTest` (wicket-native-websocket-core) and `JavaxUpgradeHttpRequestTest` (wicket-native-websocket-javax): 10 tests, all of which fail on master. One copies an upgrade request with a lowercase `origin` and runs it through `WebSocketConnectionOriginFilter`. - `mvn clean verify -Pjs-test` is green. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
