[I] WebSocket: Request wrappers break the Servlet header contract (case-sensitive lookup, single-use enumerations) [wicket]

["guidecom-ze (via GitHub)" <gi...@apache.org>]

guidecom-ze opened a new issue, #1688:
URL: https://github.com/apache/wicket/issues/1688

   **Issue**
   `ServletRequestCopy` is used as an `HttpServletRequest` after the WebSocket handshake (`AbstractWebSocketProcessor` / `IWebSocketConnectionFilter`, and later frames via `WebSocketSettings.newWebSocketRequest`). It does not honour the Servlet spec for headers: names must be looked up case-insensitively, 'getHeaders' must return an empty Enumeration when absent, and repeated reads must return the same values.
   
   `ServletRequestCopy` currently:
   
   - Looks up with `headers.get(name)`, so "Origin" misses "origin" (HTTP/2 and many proxies send lowercase names).
   - Stores the original request's live Enumeration in a `HashMap` keyed by the original name.
   - Lets `getHeader` consume the enumeration via `nextElement()`, so a second call returns `null`.
   - `getLocales()` has the same single-use enumeration problem. 
   
   `JavaxUpgradeHttpRequest` has the same case-sensitive map and can return `null` from getHeaders / getHeaderNames.
   
   **Reproduction**
   ```java
   MockHttpServletRequest original = new MockHttpServletRequest();
   original.addHeader("user-agent", "TestAgent/1.0");
   ServletRequestCopy copy = new ServletRequestCopy(original);
   assertEquals("TestAgent/1.0", copy.getHeader("User-Agent")); // fails: case
   assertEquals("TestAgent/1.0", copy.getHeader("User-Agent")); // fails: consumed
   assertTrue(copy.getHeaders("User-Agent").hasMoreElements());
   assertTrue(copy.getHeaders("User-Agent").hasMoreElements()); // fails: spent / null
   ```
   
   **Proposed fix**
   In `ServletRequestCopy` and `JavaxUpgradeHttpRequest`, store `Map<String, List<String>>` (e.g. `TreeMap` with `String.CASE_INSENSITIVE_ORDER`), materialise values at copy time, return a fresh enumeration from `getHeaders` (never null), and copy `getLocales()` the same way.
   Fixing the copy itself covers both the processor and newWebSocketRequest. 
   
   Happy to send a PR once this issue is accepted.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@wicket.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] WebSocket: Request wrappers break the Servlet header contract (case-sensitive lookup, single-use enumerations) [wicket]

["reiern70 (via GitHub)" <gi...@apache.org>]

reiern70 closed issue #1688: WebSocket: Request wrappers break the Servlet header contract (case-sensitive lookup, single-use enumerations)
URL: https://github.com/apache/wicket/issues/1688


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@wicket.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org