You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@archiva.apache.org by ma...@apache.org on 2017/01/31 22:11:30 UTC
[2/2] archiva-redback-core git commit: Adding port check for Referer
header
Adding port check for Referer header
Project: http://git-wip-us.apache.org/repos/asf/archiva-redback-core/repo
Commit: http://git-wip-us.apache.org/repos/asf/archiva-redback-core/commit/e9bc4818
Tree: http://git-wip-us.apache.org/repos/asf/archiva-redback-core/tree/e9bc4818
Diff: http://git-wip-us.apache.org/repos/asf/archiva-redback-core/diff/e9bc4818
Branch: refs/heads/feature/header_check
Commit: e9bc4818844bf684e4fd16e3a5adc99fe9eb9f96
Parents: 95f1b3e
Author: Martin Stockhammer <ma...@apache.org>
Authored: Mon Jan 30 22:42:33 2017 +0100
Committer: Martin Stockhammer <ma...@apache.org>
Committed: Mon Jan 30 22:42:33 2017 +0100
----------------------------------------------------------------------
.../interceptors/RequestValidationInterceptor.java | 7 ++++++-
.../redback/rest/services/AbstractRestServicesTest.java | 10 +++++-----
2 files changed, 11 insertions(+), 6 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/archiva-redback-core/blob/e9bc4818/redback-integrations/redback-rest/redback-rest-services/src/main/java/org/apache/archiva/redback/rest/services/interceptors/RequestValidationInterceptor.java
----------------------------------------------------------------------
diff --git a/redback-integrations/redback-rest/redback-rest-services/src/main/java/org/apache/archiva/redback/rest/services/interceptors/RequestValidationInterceptor.java b/redback-integrations/redback-rest/redback-rest-services/src/main/java/org/apache/archiva/redback/rest/services/interceptors/RequestValidationInterceptor.java
index 4300baf..182d23a 100644
--- a/redback-integrations/redback-rest/redback-rest-services/src/main/java/org/apache/archiva/redback/rest/services/interceptors/RequestValidationInterceptor.java
+++ b/redback-integrations/redback-rest/redback-rest-services/src/main/java/org/apache/archiva/redback/rest/services/interceptors/RequestValidationInterceptor.java
@@ -161,6 +161,7 @@ public class RequestValidationInterceptor extends AbstractInterceptor implements
private boolean checkSourceRequestHeader(final URL targetUrl, final HttpServletRequest request) {
boolean headerFound=false;
String origin = request.getHeader(ORIGIN);
+ int targetPort = getPort(targetUrl);
if (origin!=null) {
try {
URL originUrl = new URL(origin);
@@ -175,7 +176,6 @@ public class RequestValidationInterceptor extends AbstractInterceptor implements
return false;
}
int originPort = getPort(originUrl);
- int targetPort = getPort(targetUrl);
if (targetPort != originPort) {
log.warn("Origin Header Port does not match originUrl={}, targetUrl={}",originUrl,targetUrl);
return false;
@@ -195,6 +195,11 @@ public class RequestValidationInterceptor extends AbstractInterceptor implements
log.warn("Referer Header Host does not match refererUrl={}, targetUrl={}",refererUrl,targetUrl);
return false;
}
+ int refererPort = getPort(refererUrl);
+ if (targetPort != refererPort) {
+ log.warn("Referer Header Port does not match refererUrl={}, targetUrl={}",refererUrl,targetUrl);
+ return false;
+ }
} catch (MalformedURLException ex) {
log.warn("Bad URL in Referer HTTP-Header: {}, Message: {}", referer, ex.getMessage());
return false;
http://git-wip-us.apache.org/repos/asf/archiva-redback-core/blob/e9bc4818/redback-integrations/redback-rest/redback-rest-services/src/test/java/org/apache/archiva/redback/rest/services/AbstractRestServicesTest.java
----------------------------------------------------------------------
diff --git a/redback-integrations/redback-rest/redback-rest-services/src/test/java/org/apache/archiva/redback/rest/services/AbstractRestServicesTest.java b/redback-integrations/redback-rest/redback-rest-services/src/test/java/org/apache/archiva/redback/rest/services/AbstractRestServicesTest.java
index 0cab072..4b565a2 100644
--- a/redback-integrations/redback-rest/redback-rest-services/src/test/java/org/apache/archiva/redback/rest/services/AbstractRestServicesTest.java
+++ b/redback-integrations/redback-rest/redback-rest-services/src/test/java/org/apache/archiva/redback/rest/services/AbstractRestServicesTest.java
@@ -158,6 +158,7 @@ public abstract class AbstractRestServicesTest
protected UserService getUserService()
{
+
return getUserService( null );
}
@@ -175,7 +176,7 @@ public abstract class AbstractRestServicesTest
{
WebClient.client( service ).header( "Authorization", authzHeader );
}
- WebClient.client(service).header("Referer","http://localhost");
+ WebClient.client(service).header("Referer","http://localhost:"+port);
WebClient.client( service ).accept( MediaType.APPLICATION_JSON_TYPE );
WebClient.client( service ).type( MediaType.APPLICATION_JSON_TYPE );
@@ -197,8 +198,7 @@ public abstract class AbstractRestServicesTest
{
WebClient.client( service ).header( "Authorization", authzHeader );
}
- WebClient.client( service ).header("Referer","http://localhost/");
-
+ WebClient.client(service).header("Referer","http://localhost:"+port);
WebClient.client( service ).accept( MediaType.APPLICATION_JSON_TYPE );
WebClient.client( service ).type( MediaType.APPLICATION_JSON_TYPE );
@@ -219,7 +219,7 @@ public abstract class AbstractRestServicesTest
{
WebClient.client( service ).header( "Authorization", authzHeader );
}
- WebClient.client( service ).header("Referer","http://localhost/");
+ WebClient.client(service).header("Referer","http://localhost:"+port);
WebClient.client( service ).accept( MediaType.APPLICATION_JSON_TYPE );
WebClient.client( service ).type( MediaType.APPLICATION_JSON_TYPE );
@@ -242,7 +242,7 @@ public abstract class AbstractRestServicesTest
{
WebClient.client( service ).header( "Authorization", authzHeader );
}
- WebClient.client( service ).header("Referer","http://localhost/");
+ WebClient.client(service).header("Referer","http://localhost:"+port);
WebClient.client( service ).accept( MediaType.APPLICATION_JSON_TYPE );
WebClient.client( service ).type( MediaType.APPLICATION_JSON_TYPE );