allow utf8 through spring security firewall

Author: cstarcher

src/main/java/org/tdl/vireo/config/AppWebSecurityConfig.java

@@ -2,10 +2,16 @@
 
 import static org.springframework.security.config.http.SessionCreationPolicy.STATELESS;
 
+import java.nio.charset.StandardCharsets;
+import java.util.regex.Pattern;
+
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.web.firewall.HttpFirewall;
+import org.springframework.security.web.firewall.StrictHttpFirewall;
 import org.tdl.vireo.auth.service.VireoUserDetailsService;
 import org.tdl.vireo.model.Role;
 import org.tdl.vireo.model.User;
@@ -18,6 +24,17 @@
 @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
 public class AppWebSecurityConfig extends AuthWebSecurityConfig<User, UserRepo, VireoUserDetailsService> {
 
+    @Bean
+    public HttpFirewall httpFirewall() {
+        StrictHttpFirewall firewall = new StrictHttpFirewall();
+        Pattern allowed = Pattern.compile("[\\p{IsAssigned}&&[^\\p{IsControl}]]*");
+        firewall.setAllowedHeaderValues(header -> {
+            String parsed = new String(header.getBytes(StandardCharsets.ISO_8859_1), StandardCharsets.UTF_8);
+            return allowed.matcher(parsed).matches();
+        });
+        return firewall;
+    }
+
     @Override
     protected void configure(HttpSecurity http) throws Exception {
         // @formatter:off