ServletWebRequest.isEtagNotModified does not support commas and spaces in client ETags [SPR-14216]

[spring-projects-issues]

Sebastiaan van Erk opened SPR-14216 and commented

The problem is in isEtagNotModified(String etag):

String[] clientEtags = StringUtils.delimitedListToStringArray(ifNoneMatch, ",", " ");

The client ETags are taken from the ifNoneMatch header and are ETags separated by commas. However the ETags themselves are opaque (double)quoted strings: they may contain commas and/or spaces (and even "). The code above does not take this into account and splits ETags in half if they contain a comma and removes any spaces they may contain.

A workaround is to make sure generated ETags don't have commas or spaces in them (I used the @Version column which is a Date as the ETag where toString() by default generates a space, but I could format it as an ISO8601 timestamp, which contains no spaces or commas).

---

Affects: 4.2.5

Issue Links:

• Consistent handling of multi-valued headers in HttpHeaders [SPR-14223] #18797 Consistent handling of multi-valued headers in HttpHeaders
• Behavior of checkNotModified(String etag, long lastModifiedTimestamp) does not match HTTP recommendations [SPR-14224] #18798 Behavior of checkNotModified(String etag, long lastModifiedTimestamp) does not match HTTP recommendations

Referenced from: commits 29da44c

[spring-projects-issues]

Sebastiaan van Erk commented

I just noticed that HttpHeaders has a similar flaw:

	public List<String> getIfNoneMatch() {
		return getFirstValueAsList(IF_NONE_MATCH);
	}

	protected List<String> getFirstValueAsList(String header) {
		List<String> result = new ArrayList<String>();
		String value = getFirst(header);
		if (value != null) {
			String[] tokens = value.split(",\\s*");
			for (String token : tokens) {
				result.add(token);
			}
		}
		return result;
	}

It also does not properly parse the ETags and splits on arbitrary commas (even ones contained inside the ETag).