Skip to content

Commit a7bf8f7

Browse files
jgrandjajgrandja
committed
Require Locale argument for toLower/toUpperCase usage
1 parent 451fbf0 commit a7bf8f7

File tree

23 files changed

+94
-50
lines changed

23 files changed

+94
-50
lines changed

‎cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
import java.util.ArrayList;
2020
import java.util.List;
21+
import java.util.Locale;
2122

2223
import org.jasig.cas.client.validation.Assertion;
2324

@@ -73,7 +74,8 @@ protected UserDetails loadUserDetails(final Assertion assertion) {
7374
}
7475

7576
private SimpleGrantedAuthority createSimpleGrantedAuthority(Object o) {
76-
return new SimpleGrantedAuthority(this.convertToUpperCase ? o.toString().toUpperCase() : o.toString());
77+
return new SimpleGrantedAuthority(
78+
this.convertToUpperCase ? o.toString().toUpperCase(Locale.ROOT) : o.toString());
7779
}
7880

7981
/**

‎config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@
1818

1919
import java.util.ArrayList;
2020
import java.util.List;
21+
import java.util.Locale;
2122

2223
import javax.servlet.ServletRequest;
2324

@@ -301,7 +302,7 @@ void setCsrfIgnoreRequestMatchers(List<BeanDefinition> requestMatchers) {
301302

302303
// Needed to account for placeholders
303304
static String createPath(String path, boolean lowerCase) {
304-
return lowerCase ? path.toLowerCase() : path;
305+
return lowerCase ? path.toLowerCase(Locale.ENGLISH) : path;
305306
}
306307

307308
BeanMetadataElement getSecurityContextHolderStrategyForAuthenticationFilters() {

‎core/src/main/java/org/springframework/security/core/authority/mapping/SimpleAttributes2GrantedAuthoritiesMapper.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2016 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -79,10 +79,10 @@ public List<GrantedAuthority> getGrantedAuthorities(Collection<String> attribute
7979
*/
8080
private GrantedAuthority getGrantedAuthority(String attribute) {
8181
if (isConvertAttributeToLowerCase()) {
82-
attribute = attribute.toLowerCase(Locale.getDefault());
82+
attribute = attribute.toLowerCase(Locale.ROOT);
8383
}
8484
else if (isConvertAttributeToUpperCase()) {
85-
attribute = attribute.toUpperCase(Locale.getDefault());
85+
attribute = attribute.toUpperCase(Locale.ROOT);
8686
}
8787
if (isAddPrefixIfAlreadyExisting() || !attribute.startsWith(getAttributePrefix())) {
8888
return new SimpleGrantedAuthority(getAttributePrefix() + attribute);

‎core/src/main/java/org/springframework/security/core/authority/mapping/SimpleAuthorityMapper.java

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2016 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@
1818

1919
import java.util.Collection;
2020
import java.util.HashSet;
21+
import java.util.Locale;
2122
import java.util.Set;
2223

2324
import org.springframework.beans.factory.InitializingBean;
@@ -71,10 +72,10 @@ public Set<GrantedAuthority> mapAuthorities(Collection<? extends GrantedAuthorit
7172

7273
private GrantedAuthority mapAuthority(String name) {
7374
if (this.convertToUpperCase) {
74-
name = name.toUpperCase();
75+
name = name.toUpperCase(Locale.ROOT);
7576
}
7677
else if (this.convertToLowerCase) {
77-
name = name.toLowerCase();
78+
name = name.toLowerCase(Locale.ROOT);
7879
}
7980
if (this.prefix.length() > 0 && !name.startsWith(this.prefix)) {
8081
name = this.prefix + name;

‎core/src/main/java/org/springframework/security/core/userdetails/MapReactiveUserDetailsService.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2017 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@
1818

1919
import java.util.Arrays;
2020
import java.util.Collection;
21+
import java.util.Locale;
2122
import java.util.Map;
2223
import java.util.concurrent.ConcurrentHashMap;
2324

@@ -91,7 +92,7 @@ private UserDetails withNewPassword(UserDetails userDetails, String newPassword)
9192
}
9293

9394
private String getKey(String username) {
94-
return username.toLowerCase();
95+
return username.toLowerCase(Locale.ROOT);
9596
}
9697

9798
}

‎core/src/main/java/org/springframework/security/core/userdetails/memory/UserAttributeEditor.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import java.beans.PropertyEditorSupport;
2020
import java.util.ArrayList;
2121
import java.util.List;
22+
import java.util.Locale;
2223

2324
import org.springframework.util.StringUtils;
2425

@@ -45,10 +46,10 @@ public void setAsText(String s) throws IllegalArgumentException {
4546
userAttrib.setPassword(currentToken);
4647
}
4748
else {
48-
if (currentToken.toLowerCase().equals("enabled")) {
49+
if (currentToken.toLowerCase(Locale.ENGLISH).equals("enabled")) {
4950
userAttrib.setEnabled(true);
5051
}
51-
else if (currentToken.toLowerCase().equals("disabled")) {
52+
else if (currentToken.toLowerCase(Locale.ENGLISH).equals("disabled")) {
5253
userAttrib.setEnabled(false);
5354
}
5455
else {

‎core/src/main/java/org/springframework/security/provisioning/InMemoryUserDetailsManager.java

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@
1919
import java.util.Collection;
2020
import java.util.Enumeration;
2121
import java.util.HashMap;
22+
import java.util.Locale;
2223
import java.util.Map;
2324
import java.util.Properties;
2425

@@ -96,23 +97,23 @@ private User createUserDetails(String name, UserAttribute attr) {
9697
@Override
9798
public void createUser(UserDetails user) {
9899
Assert.isTrue(!userExists(user.getUsername()), "user should not exist");
99-
this.users.put(user.getUsername().toLowerCase(), new MutableUser(user));
100+
this.users.put(user.getUsername().toLowerCase(Locale.ROOT), new MutableUser(user));
100101
}
101102

102103
@Override
103104
public void deleteUser(String username) {
104-
this.users.remove(username.toLowerCase());
105+
this.users.remove(username.toLowerCase(Locale.ROOT));
105106
}
106107

107108
@Override
108109
public void updateUser(UserDetails user) {
109110
Assert.isTrue(userExists(user.getUsername()), "user should exist");
110-
this.users.put(user.getUsername().toLowerCase(), new MutableUser(user));
111+
this.users.put(user.getUsername().toLowerCase(Locale.ROOT), new MutableUser(user));
111112
}
112113

113114
@Override
114115
public boolean userExists(String username) {
115-
return this.users.containsKey(username.toLowerCase());
116+
return this.users.containsKey(username.toLowerCase(Locale.ROOT));
116117
}
117118

118119
@Override
@@ -143,14 +144,14 @@ public void changePassword(String oldPassword, String newPassword) {
143144
@Override
144145
public UserDetails updatePassword(UserDetails user, String newPassword) {
145146
String username = user.getUsername();
146-
MutableUserDetails mutableUser = this.users.get(username.toLowerCase());
147+
MutableUserDetails mutableUser = this.users.get(username.toLowerCase(Locale.ROOT));
147148
mutableUser.setPassword(newPassword);
148149
return mutableUser;
149150
}
150151

151152
@Override
152153
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
153-
UserDetails user = this.users.get(username.toLowerCase());
154+
UserDetails user = this.users.get(username.toLowerCase(Locale.ROOT));
154155
if (user == null) {
155156
throw new UsernameNotFoundException(username);
156157
}

‎crypto/src/main/java/org/springframework/security/crypto/password/LdapShaPasswordEncoder.java

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@
1818

1919
import java.security.MessageDigest;
2020
import java.util.Base64;
21+
import java.util.Locale;
2122

2223
import org.springframework.security.crypto.codec.Utf8;
2324
import org.springframework.security.crypto.keygen.BytesKeyGenerator;
@@ -50,11 +51,11 @@ public class LdapShaPasswordEncoder implements PasswordEncoder {
5051

5152
private static final String SSHA_PREFIX = "{SSHA}";
5253

53-
private static final String SSHA_PREFIX_LC = SSHA_PREFIX.toLowerCase();
54+
private static final String SSHA_PREFIX_LC = SSHA_PREFIX.toLowerCase(Locale.ENGLISH);
5455

5556
private static final String SHA_PREFIX = "{SHA}";
5657

57-
private static final String SHA_PREFIX_LC = SHA_PREFIX.toLowerCase();
58+
private static final String SHA_PREFIX_LC = SHA_PREFIX.toLowerCase(Locale.ENGLISH);
5859

5960
private BytesKeyGenerator saltGenerator;
6061

‎etc/checkstyle/checkstyle-suppressions.xml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,4 +56,8 @@
5656

5757
<!-- Lambdas that we can't replace with a method reference because a closure is required -->
5858
<suppress files="BearerTokenAuthenticationFilter\.java" checks="SpringLambda"/>
59+
60+
<!-- Ignore String.toUpperCase() and String.toLowerCase() checks in tests -->
61+
<suppress files="[\\/]src[\\/]test[\\/]" checks="RegexpSinglelineJava" id="toLowerCaseWithoutLocale"/>
62+
<suppress files="[\\/]src[\\/]test[\\/]" checks="RegexpSinglelineJava" id="toUpperCaseWithoutLocale"/>
5963
</suppressions>

‎etc/checkstyle/checkstyle.xml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,21 @@
2929
<property name="message" value="Please use assertThatExceptionOfType." />
3030
<property name="ignoreComments" value="true" />
3131
</module>
32+
<module name="com.puppycrawl.tools.checkstyle.checks.regexp.RegexpSinglelineJavaCheck">
33+
<property name="id" value="toLowerCaseWithoutLocale"/>
34+
<property name="format" value="\.toLowerCase\(\)"/>
35+
<property name="maximum" value="0"/>
36+
<property name="message"
37+
value="String.toLowerCase() should be String.toLowerCase(Locale.ROOT) or String.toLowerCase(Locale.ENGLISH)"/>
38+
<property name="ignoreComments" value="true"/>
39+
</module>
40+
<module name="com.puppycrawl.tools.checkstyle.checks.regexp.RegexpSinglelineJavaCheck">
41+
<property name="id" value="toUpperCaseWithoutLocale"/>
42+
<property name="format" value="\.toUpperCase\(\)"/>
43+
<property name="maximum" value="0"/>
44+
<property name="message"
45+
value="String.toUpperCase() should be String.toUpperCase(Locale.ROOT) or String.toUpperCase(Locale.ENGLISH)"/>
46+
<property name="ignoreComments" value="true"/>
47+
</module>
3248
</module>
3349
</module>

‎ldap/src/main/java/org/springframework/security/ldap/LdapEncoder.java

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2005-2010 the original author or authors.
2+
* Copyright 2005-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.ldap;
1818

19+
import java.util.Locale;
20+
1921
import org.springframework.ldap.BadLdapGrammarException;
2022

2123
/**
@@ -72,7 +74,7 @@ private LdapEncoder() {
7274
}
7375

7476
protected static String toTwoCharHex(char c) {
75-
String raw = Integer.toHexString(c).toUpperCase();
77+
String raw = Integer.toHexString(c).toUpperCase(Locale.ENGLISH);
7678
return (raw.length() > 1) ? raw : "0" + raw;
7779
}
7880

‎ldap/src/main/java/org/springframework/security/ldap/authentication/LdapEncoder.java

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2005-2010 the original author or authors.
2+
* Copyright 2005-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.ldap.authentication;
1818

19+
import java.util.Locale;
20+
1921
import org.springframework.ldap.BadLdapGrammarException;
2022

2123
/**
@@ -72,7 +74,7 @@ private LdapEncoder() {
7274
}
7375

7476
protected static String toTwoCharHex(char c) {
75-
String raw = Integer.toHexString(c).toUpperCase();
77+
String raw = Integer.toHexString(c).toUpperCase(Locale.ENGLISH);
7678
return (raw.length() > 1) ? raw : "0" + raw;
7779
}
7880

‎ldap/src/main/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProvider.java

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2016 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -23,6 +23,7 @@
2323
import java.util.HashMap;
2424
import java.util.Hashtable;
2525
import java.util.List;
26+
import java.util.Locale;
2627
import java.util.Map;
2728
import java.util.regex.Matcher;
2829
import java.util.regex.Pattern;
@@ -144,9 +145,9 @@ public final class ActiveDirectoryLdapAuthenticationProvider extends AbstractLda
144145
*/
145146
public ActiveDirectoryLdapAuthenticationProvider(String domain, String url, String rootDn) {
146147
Assert.isTrue(StringUtils.hasText(url), "Url cannot be empty");
147-
this.domain = StringUtils.hasText(domain) ? domain.toLowerCase() : null;
148+
this.domain = StringUtils.hasText(domain) ? domain.toLowerCase(Locale.ROOT) : null;
148149
this.url = url;
149-
this.rootDn = StringUtils.hasText(rootDn) ? rootDn.toLowerCase() : null;
150+
this.rootDn = StringUtils.hasText(rootDn) ? rootDn.toLowerCase(Locale.ROOT) : null;
150151
}
151152

152153
/**
@@ -155,7 +156,7 @@ public ActiveDirectoryLdapAuthenticationProvider(String domain, String url, Stri
155156
*/
156157
public ActiveDirectoryLdapAuthenticationProvider(String domain, String url) {
157158
Assert.isTrue(StringUtils.hasText(url), "Url cannot be empty");
158-
this.domain = StringUtils.hasText(domain) ? domain.toLowerCase() : null;
159+
this.domain = StringUtils.hasText(domain) ? domain.toLowerCase(Locale.ROOT) : null;
159160
this.url = url;
160161
this.rootDn = (this.domain != null) ? rootDnFromDomain(this.domain) : null;
161162
}
@@ -364,7 +365,7 @@ private String rootDnFromDomain(String domain) {
364365
}
365366

366367
String createBindPrincipal(String username) {
367-
if (this.domain == null || username.toLowerCase().endsWith(this.domain)) {
368+
if (this.domain == null || username.toLowerCase(Locale.ROOT).endsWith(this.domain)) {
368369
return username;
369370
}
370371
return username + "@" + this.domain;

‎ldap/src/main/java/org/springframework/security/ldap/userdetails/DefaultLdapAuthoritiesPopulator.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import java.util.Collection;
2121
import java.util.HashSet;
2222
import java.util.List;
23+
import java.util.Locale;
2324
import java.util.Map;
2425
import java.util.Set;
2526
import java.util.function.Function;
@@ -179,7 +180,7 @@ else if (groupSearchBase.length() == 0) {
179180
return null;
180181
}
181182
if (this.convertToUpperCase) {
182-
role = role.toUpperCase();
183+
role = role.toUpperCase(Locale.ROOT);
183184
}
184185
return new SimpleGrantedAuthority(this.rolePrefix + role);
185186
};

‎ldap/src/main/java/org/springframework/security/ldap/userdetails/LdapUserDetailsManager.java

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -23,6 +23,7 @@
2323
import java.util.LinkedList;
2424
import java.util.List;
2525
import java.util.ListIterator;
26+
import java.util.Locale;
2627

2728
import javax.naming.Context;
2829
import javax.naming.NameNotFoundException;
@@ -124,7 +125,7 @@ public class LdapUserDetailsManager implements UserDetailsManager {
124125
NamingEnumeration<?> ne = roleAttr.getAll();
125126
Object group = ne.next();
126127
String role = group.toString();
127-
return new SimpleGrantedAuthority(this.rolePrefix + role.toUpperCase());
128+
return new SimpleGrantedAuthority(this.rolePrefix + role.toUpperCase(Locale.ROOT));
128129
};
129130

130131
private String[] attributesToRetrieve;
@@ -287,7 +288,7 @@ public boolean userExists(String username) {
287288
*/
288289
protected DistinguishedName buildGroupDn(String group) {
289290
DistinguishedName dn = new DistinguishedName(this.groupSearchBase);
290-
dn.add(this.groupRoleAttributeName, group.toLowerCase());
291+
dn.add(this.groupRoleAttributeName, group.toLowerCase(Locale.ROOT));
291292
return dn;
292293
}
293294

0 commit comments

Comments
 (0)