svn commit: r1500082 - in /struts/struts2/branches/STRUTS_2_3_15_X/apps/showcase/src: main/java/org/apache/struts2/showcase/filedownload/ test/java/org/apache/struts2/showcase/filedownload/

[rg...@apache.org]

Author: rgielen
Date: Fri Jul  5 17:44:09 2013
New Revision: 1500082

URL: http://svn.apache.org/r1500082
Log:
WW-4136 - Demonstrate proper input sanitizing for file download showcase example
- added demo code to prevent input paths containing "WEB-INF"

Added:
    struts/struts2/branches/STRUTS_2_3_15_X/apps/showcase/src/test/java/org/apache/struts2/showcase/filedownload/
    struts/struts2/branches/STRUTS_2_3_15_X/apps/showcase/src/test/java/org/apache/struts2/showcase/filedownload/FileDownloadActionTest.java
Modified:
    struts/struts2/branches/STRUTS_2_3_15_X/apps/showcase/src/main/java/org/apache/struts2/showcase/filedownload/FileDownloadAction.java

Modified: struts/struts2/branches/STRUTS_2_3_15_X/apps/showcase/src/main/java/org/apache/struts2/showcase/filedownload/FileDownloadAction.java
URL: http://svn.apache.org/viewvc/struts/struts2/branches/STRUTS_2_3_15_X/apps/showcase/src/main/java/org/apache/struts2/showcase/filedownload/FileDownloadAction.java?rev=1500082&r1=1500081&r2=1500082&view=diff
==============================================================================
--- struts/struts2/branches/STRUTS_2_3_15_X/apps/showcase/src/main/java/org/apache/struts2/showcase/filedownload/FileDownloadAction.java (original)
+++ struts/struts2/branches/STRUTS_2_3_15_X/apps/showcase/src/main/java/org/apache/struts2/showcase/filedownload/FileDownloadAction.java Fri Jul  5 17:44:09 2013
@@ -39,7 +39,23 @@ public class FileDownloadAction implemen
 	}
 
 	public void setInputPath(String value) {
-		inputPath = value;
+		inputPath = sanitizeInputPath(value);
+	}
+
+	/**
+	 * As the user modifiable parameter inputPath will be used to access server side resources, we want the path to be
+	 * sanitized - in this case it is demonstrated to disallow inputPath parameter values containing "WEB-INF". Consider to
+	 * use even stricter rules in production environments.
+	 *
+	 * @param value the raw parameter input value to sanitize
+	 *
+	 * @return the sanitized value; <tt>null</tt> if value contains an invalid path segment like WEB-INF
+	 */
+	String sanitizeInputPath( String value ) {
+		if (value != null && value.toUpperCase().contains("WEB-INF")) {
+			return null;
+		}
+		return value;
 	}
 
 	public InputStream getInputStream() throws Exception {

Added: struts/struts2/branches/STRUTS_2_3_15_X/apps/showcase/src/test/java/org/apache/struts2/showcase/filedownload/FileDownloadActionTest.java
URL: http://svn.apache.org/viewvc/struts/struts2/branches/STRUTS_2_3_15_X/apps/showcase/src/test/java/org/apache/struts2/showcase/filedownload/FileDownloadActionTest.java?rev=1500082&view=auto
==============================================================================
--- struts/struts2/branches/STRUTS_2_3_15_X/apps/showcase/src/test/java/org/apache/struts2/showcase/filedownload/FileDownloadActionTest.java (added)
+++ struts/struts2/branches/STRUTS_2_3_15_X/apps/showcase/src/test/java/org/apache/struts2/showcase/filedownload/FileDownloadActionTest.java Fri Jul  5 17:44:09 2013
@@ -0,0 +1,42 @@
+package org.apache.struts2.showcase.filedownload;
+
+import org.junit.Before;
+import org.junit.Test;
+
+import static junit.framework.Assert.assertEquals;
+import static junit.framework.Assert.assertNull;
+
+public class FileDownloadActionTest {
+
+	private FileDownloadAction fileDownloadAction;
+
+	@Before
+	public void setUp() {
+	    this.fileDownloadAction = new FileDownloadAction();
+	}
+
+	@Test
+	public void testSanitizeInputPathShouldAllowSimpleParameter() throws Exception {
+		assertEquals("foo", fileDownloadAction.sanitizeInputPath("foo"));
+	}
+
+	@Test
+	public void testSanitizeInputPathShouldReturnNullForNullInput() throws Exception {
+		assertNull(fileDownloadAction.sanitizeInputPath(null));
+	}
+
+	@Test
+	public void testSanitizeInputPathShouldReturnNullForLeadingWebInf() throws Exception {
+		assertNull(fileDownloadAction.sanitizeInputPath("WEB-INF/foo"));
+	}
+
+	@Test
+	public void testSanitizeInputPathShouldReturnNullForNonLeadingWebInf() throws Exception {
+		assertNull(fileDownloadAction.sanitizeInputPath("./WEB-INF/foo"));
+	}
+
+	@Test
+	public void testSanitizeInputPathShouldReturnNullForNonUppercaseWebInf() throws Exception {
+		assertNull(fileDownloadAction.sanitizeInputPath("./wEB-Inf/foo"));
+	}
+}