You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@fineract.apache.org by al...@apache.org on 2023/02/21 06:25:15 UTC
[fineract] branch 1.7.3 updated: FINERACT-1873: Template request fix for 1.7.x
This is an automated email from the ASF dual-hosted git repository.
aleks pushed a commit to branch 1.7.3
in repository https://gitbox.apache.org/repos/asf/fineract.git
The following commit(s) were added to refs/heads/1.7.3 by this push:
new 983066ba8 FINERACT-1873: Template request fix for 1.7.x
983066ba8 is described below
commit 983066ba8e146bf276897862e2630f7ca88527bd
Author: Aleks <al...@apache.org>
AuthorDate: Sun Feb 19 23:26:12 2023 +0100
FINERACT-1873: Template request fix for 1.7.x
---
.../core/config/FineractProperties.java | 11 ++++++
.../exception/TemplateForbiddenException.java | 28 +++++++++++++++
.../template/service/TemplateMergeService.java | 42 +++++++++++++++++-----
.../src/main/resources/application.properties | 3 ++
.../service/TemplateServiceStepDefinitions.java | 5 +--
5 files changed, 78 insertions(+), 11 deletions(-)
diff --git a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/FineractProperties.java b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/FineractProperties.java
index e36e7a107..f5c283fc3 100644
--- a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/FineractProperties.java
+++ b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/core/config/FineractProperties.java
@@ -19,6 +19,7 @@
package org.apache.fineract.infrastructure.core.config;
+import java.util.List;
import lombok.Getter;
import lombok.Setter;
import org.springframework.boot.context.properties.ConfigurationProperties;
@@ -34,6 +35,8 @@ public class FineractProperties {
private FineractModeProperties mode;
+ private FineractTemplateProperties template;
+
@Getter
@Setter
public static class FineractTenantProperties {
@@ -61,4 +64,12 @@ public class FineractProperties {
return readEnabled && !writeEnabled && !batchEnabled;
}
}
+
+ @Getter
+ @Setter
+ public static class FineractTemplateProperties {
+
+ private boolean regexWhitelistEnabled;
+ private List<String> regexWhitelist;
+ }
}
diff --git a/fineract-provider/src/main/java/org/apache/fineract/template/exception/TemplateForbiddenException.java b/fineract-provider/src/main/java/org/apache/fineract/template/exception/TemplateForbiddenException.java
new file mode 100644
index 000000000..c089b07f3
--- /dev/null
+++ b/fineract-provider/src/main/java/org/apache/fineract/template/exception/TemplateForbiddenException.java
@@ -0,0 +1,28 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.template.exception;
+
+import org.apache.fineract.infrastructure.core.exception.AbstractPlatformResourceNotFoundException;
+
+public class TemplateForbiddenException extends AbstractPlatformResourceNotFoundException {
+
+ public TemplateForbiddenException(final String url) {
+ super("error.msg.template.url.forbidden", "Template with url " + url + " not allowed");
+ }
+}
diff --git a/fineract-provider/src/main/java/org/apache/fineract/template/service/TemplateMergeService.java b/fineract-provider/src/main/java/org/apache/fineract/template/service/TemplateMergeService.java
index f24bd4ee5..2ba55899f 100644
--- a/fineract-provider/src/main/java/org/apache/fineract/template/service/TemplateMergeService.java
+++ b/fineract-provider/src/main/java/org/apache/fineract/template/service/TemplateMergeService.java
@@ -38,19 +38,23 @@ import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.util.HashMap;
import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.fineract.infrastructure.core.config.FineractProperties;
import org.apache.fineract.template.domain.Template;
import org.apache.fineract.template.domain.TemplateFunctions;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import org.apache.fineract.template.exception.TemplateForbiddenException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Service;
+@Slf4j
+@RequiredArgsConstructor
@Service
public class TemplateMergeService {
- private static final Logger LOG = LoggerFactory.getLogger(TemplateMergeService.class);
-
- // private final FromJsonHelper fromApiJsonHelper;
+ private final FineractProperties fineractProperties;
private Map<String, Object> scopes;
private String authToken;
@@ -92,7 +96,7 @@ public class TemplateMergeService {
try {
this.scopes.put(entry.getKey(), getMapFromUrl(url));
} catch (final IOException e) {
- LOG.error("getCompiledMapFromMappers() failed", e);
+ log.error("getCompiledMapFromMappers() failed", e);
}
}
}
@@ -114,6 +118,26 @@ public class TemplateMergeService {
}
private HttpURLConnection getConnection(final String url) {
+ if (fineractProperties.getTemplate() != null && fineractProperties.getTemplate().isRegexWhitelistEnabled()) {
+ boolean whitelisted = false;
+
+ if (fineractProperties.getTemplate().getRegexWhitelist() != null
+ && !fineractProperties.getTemplate().getRegexWhitelist().isEmpty()) {
+ for (String urlPattern : fineractProperties.getTemplate().getRegexWhitelist()) {
+ Pattern pattern = Pattern.compile(urlPattern);
+ Matcher matcher = pattern.matcher(url);
+ if (matcher.matches()) {
+ whitelisted = true;
+ break;
+ }
+ }
+ }
+
+ if (!whitelisted) {
+ throw new TemplateForbiddenException(url);
+ }
+ }
+
if (this.authToken == null) {
final String name = SecurityContextHolder.getContext().getAuthentication().getName();
final String password = SecurityContextHolder.getContext().getAuthentication().getCredentials().toString();
@@ -138,7 +162,7 @@ public class TemplateMergeService {
connection.setDoInput(true);
} catch (IOException | KeyManagementException | NoSuchAlgorithmException | KeyStoreException e) {
- LOG.error("getConnection() failed, return null", e);
+ log.error("getConnection() failed, return null", e);
}
return connection;
@@ -158,13 +182,13 @@ public class TemplateMergeService {
}
} catch (final IOException e) {
- LOG.error("getStringFromInputStream() failed", e);
+ log.error("getStringFromInputStream() failed", e);
} finally {
if (br != null) {
try {
br.close();
} catch (final IOException e) {
- LOG.error("Problem occurred in getStringFromInputStream function", e);
+ log.error("Problem occurred in getStringFromInputStream function", e);
}
}
}
diff --git a/fineract-provider/src/main/resources/application.properties b/fineract-provider/src/main/resources/application.properties
index 85e69dee5..e70a85fee 100644
--- a/fineract-provider/src/main/resources/application.properties
+++ b/fineract-provider/src/main/resources/application.properties
@@ -44,6 +44,9 @@ fineract.content.regex-whitelist=${FINERACT_CONTENT_REGEX_WHITELIST:.*\\.pdf$,.*
fineract.content.mime-whitelist-enabled=${FINERACT_CONTENT_MIME_WHITELIST_ENABLED:true}
fineract.content.mime-whitelist=${FINERACT_CONTENT_MIME_WHITELIST:application/pdf,application/msword,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.ms-excel,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,image/jpeg,image/png}
+fineract.template.regex-whitelist-enabled=${FINERACT_TEMPLATE_REGEX_WHITELIST_ENABLED:true}
+fineract.template.regex-whitelist=${FINERACT_TEMPLATE_REGEX_WHITELIST:}
+
management.health.jms.enabled=false
# FINERACT 1296
diff --git a/fineract-provider/src/test/java/org/apache/fineract/template/service/TemplateServiceStepDefinitions.java b/fineract-provider/src/test/java/org/apache/fineract/template/service/TemplateServiceStepDefinitions.java
index 0cf4fd147..0b1819d28 100644
--- a/fineract-provider/src/test/java/org/apache/fineract/template/service/TemplateServiceStepDefinitions.java
+++ b/fineract-provider/src/test/java/org/apache/fineract/template/service/TemplateServiceStepDefinitions.java
@@ -34,11 +34,12 @@ import java.util.Map;
import org.apache.commons.io.IOUtils;
import org.apache.fineract.template.domain.Template;
import org.apache.fineract.template.domain.TemplateMapper;
+import org.springframework.beans.factory.annotation.Autowired;
public class TemplateServiceStepDefinitions implements En {
- private TemplateMergeService tms = new TemplateMergeService();
-
+ @Autowired
+ private TemplateMergeService tms;
private String template;
private Map<String, Object> data;