fix: detect Flow PUSH requests as internal framework requests

HandlerHelper is currently not considering Flow PUSH requests (/VAADIN/push) as internal, preventing VaadinWebSecurity to ignore CSRF checks. The issues happen only for ping requests; the connection request is not affected because it is a GET request. Fixes #19075
vaadin · Apr 3, 2024 · 06f4b1d · 06f4b1d
1 parent cc01569
commit 06f4b1d
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 4 deletions.
diff --git a/flow-server/src/main/java/com/vaadin/flow/server/HandlerHelper.java b/flow-server/src/main/java/com/vaadin/flow/server/HandlerHelper.java
@@ -199,6 +199,10 @@ private static boolean isFrameworkInternalRequest(String servletMappingPath,
                 requestedPathWithoutServletMapping.get(),
                 requestTypeParameter)) {
             return true;
+        } else if (RequestType.PUSH.getIdentifier().equals(requestTypeParameter)
+                && "VAADIN/push"
+                        .equals(requestedPathWithoutServletMapping.get())) {
+            return true;
         } else if (isUploadRequest(requestedPathWithoutServletMapping.get())) {
             return true;
         } else if (isHillaPush(requestedPathWithoutServletMapping.get())) {

diff --git a/flow-server/src/test/java/com/vaadin/flow/server/HandlerHelperTest.java b/flow-server/src/test/java/com/vaadin/flow/server/HandlerHelperTest.java
@@ -1,18 +1,18 @@
 package com.vaadin.flow.server;
 
+import jakarta.servlet.http.HttpServletRequest;
+
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.Optional;
 import java.util.Set;
 
-import jakarta.servlet.http.HttpServletRequest;
-
-import com.vaadin.flow.server.HandlerHelper.RequestType;
-
 import org.junit.Assert;
 import org.junit.Test;
 import org.mockito.Mockito;
 
+import com.vaadin.flow.server.HandlerHelper.RequestType;
+
 public class HandlerHelperTest {
 
     private HttpServletRequest createRequest(String pathInfo,
@@ -216,6 +216,24 @@ public void isFrameworkInternalRequest_hillaPushUrl() {
                 request.getHttpServletRequest()));
     }
 
+    @Test
+    public void isFrameworkInternalRequest_flowPushUrl() {
+        VaadinServletRequest request = createVaadinRequest("VAADIN/push", "",
+                RequestType.PUSH);
+
+        Assert.assertTrue(HandlerHelper.isFrameworkInternalRequest("/*",
+                request.getHttpServletRequest()));
+    }
+
+    @Test
+    public void isFrameworkInternalRequest_vaadinServletMapping_flowPushUrl() {
+        VaadinServletRequest request = createVaadinRequest("/VAADIN/push",
+                "/ui", RequestType.PUSH);
+
+        Assert.assertTrue(HandlerHelper.isFrameworkInternalRequest("/ui/*",
+                request.getHttpServletRequest()));
+    }
+
     @Test
     public void isFrameworkInternalRequest_fakeUploadUrl() {
         VaadinServletRequest request = createVaadinRequest(