Add methods to augment allowed headers and parameters in StrictHttpFi…

[baezzys]

This pull request introduces new constants in the StrictHttpFirewall class that allow for the augmentation of the sets of allowable header names, header values, parameter names, and parameter values.

This closes #13639

[jzheaux]

Thanks, @baezzys! There is an issue with having both set and add that I didn't see earlier, which is that it assumes that the application wants to do Predicate#and and not Predicate#or. It doesn't give the developer much more power.

Also, I think that addAllowHeaderValues makes it seem like you are listing additional ways that headers would be allowed, which is the opposite of the implementation.

Instead, please let's introduce public static defaults for each, like so:

public static final Predicate<String> ALLOWED_HEADER_NAMES = ...;

public static final Predicate<String> ALLOWED_HEADER_VALUES = ...;

public static final Predicate<String> ALLOWED_PARAMETER_NAMES = ...;

public static final Predicate<String> ALLOWED_PARAMETER_VALUES = ...;

So that an application can do:

firewall.setAllowedHeaderValues(ALLOWED_HEADER_VALUES.and((value) -> !value.contains("\t")))

[baezzys]

Thank you for the review, @jzheaux. However, since the setters are not static, would it be acceptable to change them to public instead of public static?

[jzheaux]

I think they should be static so that you don't need an instance of the firewall to refer to them.

[baezzys]

Thank you for the feedback, @jzheaux

I have updated the StrictHttpFirewall class to change the private Predicates for allowed header names, header values, parameter names, and parameter values to public static. Additionally, I have changed the corresponding setters.

Please review the changes and let me know if any further adjustments are needed.

[jzheaux]

Thanks, @baezzys! I've left some feedback inline.

[baezzys]

Hi @jzheaux, Sorry for the late response. I've made the changes based on your feedback. PTAL. Thanks!

[jzheaux]

Thank you, @baezzys, for the PR! This is now merged into main.