@@ -0,0 +1,3294 @@
+/*%0A * =============================================================================%0A *%0A *   Copyright (c) 2011-2018, The THYMELEAF team (http://www.thymeleaf.org)%0A *%0A *   Licensed under the Apache License, Version 2.0 (the %22License%22);%0A *   you may not use this file except in compliance with the License.%0A *   You may obtain a copy of the License at%0A *%0A *       http://www.apache.org/licenses/LICENSE-2.0%0A *%0A *   Unless required by applicable law or agreed to in writing, software%0A *   distributed under the License is distributed on an %22AS IS%22 BASIS,%0A *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.%0A *   See the License for the specific language governing permissions and%0A *   limitations under the License.%0A *%0A * =============================================================================%0A */%0Apackage org.thymeleaf.standard.expression;%0A%0Aimport org.thymeleaf.exceptions.TemplateProcessingException;%0A%0Aimport jakarta.servlet.http.HttpServletRequest;%0Aimport jakarta.servlet.http.HttpServletRequestWrapper;%0Aimport java.util.Map;%0A%0A/**%0A * %3Cp%3E%0A *   Utility class that wraps %7B@link HttpServletRequest%7D objects in order to restrict access to%0A *   request parameters in specific restricted expression execution environments.%0A * %3C/p%3E%0A *%0A * @author Daniel Fern&aacute;ndez%0A *%0A * @since 3.0.9%0A *%0A */%0Apublic final class RestrictedJakartaRequestAccessUtils %7B%0A%0A%0A    public static Object wrapRequestObject(final Object obj) %7B%0A        if (obj == null %7C%7C !(obj instanceof HttpServletRequest)) %7B%0A            return obj;%0A        %7D%0A        return new RestrictedRequestWrapper((HttpServletRequest)obj);%0A    %7D%0A%0A%0A    private RestrictedJakartaRequestAccessUtils() %7B%0A        super();%0A    %7D%0A%0A%0A    /*%0A     * This internal class allows the wrapping of the request in RESTRICTED execution environments (like certain%0A     * attribute processors) so that no direct access is given to (non-validated) user input like request parameters.%0A     */%0A    private static class RestrictedRequestWrapper extends HttpServletRequestWrapper %7B%0A%0A        public RestrictedRequestWrapper(final HttpServletRequest request) %7B%0A            super(request);%0A        %7D%0A%0A        @Override%0A        public String getParameter(final String name) %7B%0A            throw createRestrictedParameterAccessException();%0A        %7D%0A%0A        @Override%0A        public Map getParameterMap() %7B%0A            throw createRestrictedParameterAccessException();%0A        %7D%0A%0A        @Override%0A        public String%5B%5D getParameterValues(final String name) %7B%0A            throw createRestrictedParameterAccessException();%0A        %7D%0A%0A        @Override%0A        public String getQueryString() %7B%0A            throw createRestrictedParameterAccessException();%0A        %7D%0A%0A        private static TemplateProcessingException createRestrictedParameterAccessException() %7B%0A            return new TemplateProcessingException(%0A                    %22Access to request parameters is forbidden in this context. Note some restrictions apply to %22 +%0A                    %22variable access. For example, direct access to request parameters is forbidden in preprocessing and %22 +%0A                    %22unescaped expressions, in TEXT template mode, in fragment insertion specifications and %22 +%0A                    %22in some specific attribute processors.%22);%0A        %7D%0A%0A    %7D%0A%0A%7D%0A

Add RestrictedJakartaRequestAccessUtils