You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@roller.apache.org by mb...@apache.org on 2021/09/13 02:12:12 UTC
[roller] 02/10: Context URL validation.
This is an automated email from the ASF dual-hosted git repository.
mbien pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/roller.git
commit 3b53a62195787c3b00cec86e5845959250aabc99
Author: Michael Bien <mb...@gmail.com>
AuthorDate: Mon Aug 23 03:11:31 2021 +0200
Context URL validation.
---
.../weblogger/ui/core/filters/InitFilter.java | 42 +++++++++++++---------
1 file changed, 25 insertions(+), 17 deletions(-)
diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/core/filters/InitFilter.java b/app/src/main/java/org/apache/roller/weblogger/ui/core/filters/InitFilter.java
index 7ab9fa0..554ccc6 100644
--- a/app/src/main/java/org/apache/roller/weblogger/ui/core/filters/InitFilter.java
+++ b/app/src/main/java/org/apache/roller/weblogger/ui/core/filters/InitFilter.java
@@ -30,6 +30,7 @@ import javax.servlet.http.HttpServletRequest;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
+import org.apache.commons.validator.routines.UrlValidator;
import org.apache.roller.weblogger.config.WebloggerRuntimeConfig;
/**
@@ -41,7 +42,7 @@ import org.apache.roller.weblogger.config.WebloggerRuntimeConfig;
*/
public class InitFilter implements Filter {
- private static Log log = LogFactory.getLog(InitFilter.class);
+ private static final Log log = LogFactory.getLog(InitFilter.class);
private boolean initialized = false;
@@ -53,22 +54,29 @@ public class InitFilter implements Filter {
// first request, lets do our initialization
HttpServletRequest request = (HttpServletRequest) req;
- // HttpServletResponse response = (HttpServletResponse) res;
-
- // determine absolute and relative url paths to the app
- String relPath = request.getContextPath();
- String absPath = this.getAbsoluteUrl(request);
-
- // set them in our config
- WebloggerRuntimeConfig.setAbsoluteContextURL(absPath);
- WebloggerRuntimeConfig.setRelativeContextURL(relPath);
-
- if (log.isDebugEnabled()) {
- log.debug("relPath = " + relPath);
- log.debug("absPath = " + absPath);
+
+ UrlValidator validator = new UrlValidator(
+ new String[]{"http", "https"},
+ UrlValidator.ALLOW_LOCAL_URLS); // for integration tests
+
+ if(validator.isValid(request.getRequestURL().toString())) {
+
+ // determine absolute and relative url paths to the app
+ String relPath = request.getContextPath();
+ String absPath = this.getAbsoluteUrl(request);
+
+ // set them in our config
+ WebloggerRuntimeConfig.setAbsoluteContextURL(absPath);
+ WebloggerRuntimeConfig.setRelativeContextURL(relPath);
+
+ if (log.isDebugEnabled()) {
+ log.debug("relPath = " + relPath);
+ log.debug("absPath = " + absPath);
+ }
+
+ this.initialized = true;
}
- this.initialized = true;
}
chain.doFilter(req, res);
@@ -90,9 +98,9 @@ public class InitFilter implements Filter {
protected static String getAbsoluteUrl(boolean secure, String serverName, String contextPath, String requestURI, String requestURL){
- String url = null;
+ String url;
- String fullUrl = null;
+ String fullUrl;
if (!secure) {
fullUrl = requestURL;