You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@qpid.apache.org by or...@apache.org on 2015/07/10 17:57:52 UTC
svn commit: r1690281 - in
/qpid/java/trunk/broker-plugins/management-http/src:
main/java/org/apache/qpid/server/management/plugin/
main/java/org/apache/qpid/server/management/plugin/servlet/rest/
test/java/org/apache/qpid/server/management/plugin/
Author: orudyy
Date: Fri Jul 10 15:57:51 2015
New Revision: 1690281
URL: http://svn.apache.org/r1690281
Log:
QPID-6636: Prevent possibility of malicious manipulation of the content-disposition header
Added:
qpid/java/trunk/broker-plugins/management-http/src/test/java/org/apache/qpid/server/management/plugin/HttpManagementUtilTest.java
Modified:
qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagementUtil.java
qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/RestServlet.java
Modified: qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagementUtil.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagementUtil.java?rev=1690281&r1=1690280&r2=1690281&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagementUtil.java (original)
+++ qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagementUtil.java Fri Jul 10 15:57:51 2015
@@ -243,4 +243,9 @@ public class HttpManagementUtil
}
return outputStream;
}
+
+ public static String ensureFilenameIsRfc2183(final String requestedFilename)
+ {
+ return requestedFilename.replaceAll("[\\P{InBasic_Latin}\\\\:/\\p{Cntrl}]", "");
+ }
}
Modified: qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/RestServlet.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/RestServlet.java?rev=1690281&r1=1690280&r2=1690281&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/RestServlet.java (original)
+++ qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/RestServlet.java Fri Jul 10 15:57:51 2015
@@ -16,6 +16,8 @@
*/
package org.apache.qpid.server.management.plugin.servlet.rest;
+import static org.apache.qpid.server.management.plugin.HttpManagementUtil.ensureFilenameIsRfc2183;
+
import java.io.IOException;
import java.lang.reflect.ParameterizedType;
import java.lang.reflect.Type;
@@ -1003,9 +1005,4 @@ public class RestServlet extends Abstrac
return Boolean.parseBoolean(request.getParameter(paramName));
}
- private String ensureFilenameIsRfc2183(final String requestedFilename)
- {
- return requestedFilename.replaceAll("[\\P{InBasic_Latin}\\\\:/]", "");
- }
-
}
Added: qpid/java/trunk/broker-plugins/management-http/src/test/java/org/apache/qpid/server/management/plugin/HttpManagementUtilTest.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/management-http/src/test/java/org/apache/qpid/server/management/plugin/HttpManagementUtilTest.java?rev=1690281&view=auto
==============================================================================
--- qpid/java/trunk/broker-plugins/management-http/src/test/java/org/apache/qpid/server/management/plugin/HttpManagementUtilTest.java (added)
+++ qpid/java/trunk/broker-plugins/management-http/src/test/java/org/apache/qpid/server/management/plugin/HttpManagementUtilTest.java Fri Jul 10 15:57:51 2015
@@ -0,0 +1,32 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+
+package org.apache.qpid.server.management.plugin;
+
+import org.apache.qpid.test.utils.QpidTestCase;
+
+public class HttpManagementUtilTest extends QpidTestCase
+{
+ public void testEnsureFilenameIsRfc2183()
+ {
+ assertEquals("Unexpected conversion", "aBC8-d.json", HttpManagementUtil.ensureFilenameIsRfc2183("aBC8-d.json\n\r\t:/\\"));
+ }
+}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org