archiva-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From marti...@apache.org
Subject [2/8] archiva-redback-core git commit: Adding port check for Referer header
Date Fri, 10 Mar 2017 22:51:08 GMT
Adding port check for Referer header


Project: http://git-wip-us.apache.org/repos/asf/archiva-redback-core/repo
Commit: http://git-wip-us.apache.org/repos/asf/archiva-redback-core/commit/e9bc4818
Tree: http://git-wip-us.apache.org/repos/asf/archiva-redback-core/tree/e9bc4818
Diff: http://git-wip-us.apache.org/repos/asf/archiva-redback-core/diff/e9bc4818

Branch: refs/heads/master
Commit: e9bc4818844bf684e4fd16e3a5adc99fe9eb9f96
Parents: 95f1b3e
Author: Martin Stockhammer <martin_s@apache.org>
Authored: Mon Jan 30 22:42:33 2017 +0100
Committer: Martin Stockhammer <martin_s@apache.org>
Committed: Mon Jan 30 22:42:33 2017 +0100

----------------------------------------------------------------------
 .../interceptors/RequestValidationInterceptor.java        |  7 ++++++-
 .../redback/rest/services/AbstractRestServicesTest.java   | 10 +++++-----
 2 files changed, 11 insertions(+), 6 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/archiva-redback-core/blob/e9bc4818/redback-integrations/redback-rest/redback-rest-services/src/main/java/org/apache/archiva/redback/rest/services/interceptors/RequestValidationInterceptor.java
----------------------------------------------------------------------
diff --git a/redback-integrations/redback-rest/redback-rest-services/src/main/java/org/apache/archiva/redback/rest/services/interceptors/RequestValidationInterceptor.java
b/redback-integrations/redback-rest/redback-rest-services/src/main/java/org/apache/archiva/redback/rest/services/interceptors/RequestValidationInterceptor.java
index 4300baf..182d23a 100644
--- a/redback-integrations/redback-rest/redback-rest-services/src/main/java/org/apache/archiva/redback/rest/services/interceptors/RequestValidationInterceptor.java
+++ b/redback-integrations/redback-rest/redback-rest-services/src/main/java/org/apache/archiva/redback/rest/services/interceptors/RequestValidationInterceptor.java
@@ -161,6 +161,7 @@ public class RequestValidationInterceptor extends AbstractInterceptor
implements
     private boolean checkSourceRequestHeader(final URL targetUrl, final HttpServletRequest
request) {
         boolean headerFound=false;
         String origin = request.getHeader(ORIGIN);
+        int targetPort = getPort(targetUrl);
         if (origin!=null) {
             try {
                 URL originUrl = new URL(origin);
@@ -175,7 +176,6 @@ public class RequestValidationInterceptor extends AbstractInterceptor
implements
                     return false;
                 }
                 int originPort = getPort(originUrl);
-                int targetPort = getPort(targetUrl);
                 if (targetPort != originPort) {
                     log.warn("Origin Header Port does not match originUrl={}, targetUrl={}",originUrl,targetUrl);
                     return false;
@@ -195,6 +195,11 @@ public class RequestValidationInterceptor extends AbstractInterceptor
implements
                     log.warn("Referer Header Host does not match refererUrl={}, targetUrl={}",refererUrl,targetUrl);
                     return false;
                 }
+                int refererPort = getPort(refererUrl);
+                if (targetPort != refererPort) {
+                    log.warn("Referer Header Port does not match refererUrl={}, targetUrl={}",refererUrl,targetUrl);
+                    return false;
+                }
             } catch (MalformedURLException ex) {
                 log.warn("Bad URL in Referer HTTP-Header: {}, Message: {}", referer, ex.getMessage());
                 return false;

http://git-wip-us.apache.org/repos/asf/archiva-redback-core/blob/e9bc4818/redback-integrations/redback-rest/redback-rest-services/src/test/java/org/apache/archiva/redback/rest/services/AbstractRestServicesTest.java
----------------------------------------------------------------------
diff --git a/redback-integrations/redback-rest/redback-rest-services/src/test/java/org/apache/archiva/redback/rest/services/AbstractRestServicesTest.java
b/redback-integrations/redback-rest/redback-rest-services/src/test/java/org/apache/archiva/redback/rest/services/AbstractRestServicesTest.java
index 0cab072..4b565a2 100644
--- a/redback-integrations/redback-rest/redback-rest-services/src/test/java/org/apache/archiva/redback/rest/services/AbstractRestServicesTest.java
+++ b/redback-integrations/redback-rest/redback-rest-services/src/test/java/org/apache/archiva/redback/rest/services/AbstractRestServicesTest.java
@@ -158,6 +158,7 @@ public abstract class AbstractRestServicesTest
 
     protected UserService getUserService()
     {
+
         return getUserService( null );
     }
 
@@ -175,7 +176,7 @@ public abstract class AbstractRestServicesTest
         {
             WebClient.client( service ).header( "Authorization", authzHeader );
         }
-        WebClient.client(service).header("Referer","http://localhost");
+        WebClient.client(service).header("Referer","http://localhost:"+port);
         WebClient.client( service ).accept( MediaType.APPLICATION_JSON_TYPE );
         WebClient.client( service ).type( MediaType.APPLICATION_JSON_TYPE );
 
@@ -197,8 +198,7 @@ public abstract class AbstractRestServicesTest
         {
             WebClient.client( service ).header( "Authorization", authzHeader );
         }
-        WebClient.client( service ).header("Referer","http://localhost/");
-
+        WebClient.client(service).header("Referer","http://localhost:"+port);
 
         WebClient.client( service ).accept( MediaType.APPLICATION_JSON_TYPE );
         WebClient.client( service ).type( MediaType.APPLICATION_JSON_TYPE );
@@ -219,7 +219,7 @@ public abstract class AbstractRestServicesTest
         {
             WebClient.client( service ).header( "Authorization", authzHeader );
         }
-        WebClient.client( service ).header("Referer","http://localhost/");
+        WebClient.client(service).header("Referer","http://localhost:"+port);
 
         WebClient.client( service ).accept( MediaType.APPLICATION_JSON_TYPE );
         WebClient.client( service ).type( MediaType.APPLICATION_JSON_TYPE );
@@ -242,7 +242,7 @@ public abstract class AbstractRestServicesTest
         {
             WebClient.client( service ).header( "Authorization", authzHeader );
         }
-        WebClient.client( service ).header("Referer","http://localhost/");
+        WebClient.client(service).header("Referer","http://localhost:"+port);
 
         WebClient.client( service ).accept( MediaType.APPLICATION_JSON_TYPE );
         WebClient.client( service ).type( MediaType.APPLICATION_JSON_TYPE );


Mime
View raw message