-
Notifications
You must be signed in to change notification settings - Fork 101
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Smruti Prakash Sahoo <[email protected]>
- Loading branch information
1 parent
c273f19
commit 6ba3bf6
Showing
7 changed files
with
162 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
113 changes: 113 additions & 0 deletions
113
rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/Sw360XSSRequestWrapper.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| /* | ||
| SPDX-FileCopyrightText: © 2024 Siemens AG | ||
| SPDX-License-Identifier: EPL-2.0 | ||
| */ | ||
| package org.eclipse.sw360.rest.common; | ||
|
|
||
| import com.fasterxml.jackson.databind.JsonNode; | ||
| import com.fasterxml.jackson.databind.ObjectMapper; | ||
| import com.fasterxml.jackson.databind.node.ArrayNode; | ||
| import com.fasterxml.jackson.databind.node.JsonNodeFactory; | ||
| import com.fasterxml.jackson.databind.node.ObjectNode; | ||
| import jakarta.servlet.ReadListener; | ||
| import jakarta.servlet.ServletInputStream; | ||
| import jakarta.servlet.http.HttpServletRequest; | ||
| import jakarta.servlet.http.HttpServletRequestWrapper; | ||
|
|
||
| import java.io.ByteArrayInputStream; | ||
| import java.io.IOException; | ||
|
|
||
| /** | ||
| * This class is used to sanitize the input from the user to prevent XSS attacks. | ||
| * | ||
| * @author [email protected] | ||
| */ | ||
| public class Sw360XSSRequestWrapper extends HttpServletRequestWrapper { | ||
|
|
||
| public Sw360XSSRequestWrapper(HttpServletRequest request) { | ||
| super(request); | ||
| } | ||
|
|
||
| @Override | ||
| public ServletInputStream getInputStream() throws IOException { | ||
| ServletInputStream originalInputStream = super.getInputStream(); | ||
| String requestBody = new String(originalInputStream.readAllBytes()); | ||
|
|
||
| JsonNode requestBodyJSON = sanitizeInput(new ObjectMapper().readTree(requestBody)); | ||
| String sanitizedBody = requestBodyJSON.toString(); | ||
| return new ServletInputStream() { | ||
| private final ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream( | ||
| sanitizedBody.getBytes() | ||
| ); | ||
|
|
||
| @Override | ||
| public int read() throws IOException { | ||
| return byteArrayInputStream.read(); | ||
| } | ||
|
|
||
| @Override | ||
| public boolean isFinished() { | ||
| return byteArrayInputStream.available() == 0; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean isReady() { | ||
| return true; | ||
| } | ||
|
|
||
| @Override | ||
| public void setReadListener(ReadListener readListener) { | ||
| } | ||
| }; | ||
| } | ||
|
|
||
| @Override | ||
| public String[] getParameterValues(String parameter) { | ||
| String[] values = super.getParameterValues(parameter); | ||
| if (values == null) { | ||
| return null; | ||
| } | ||
| int count = values.length; | ||
| String[] encodedValues = new String[count]; | ||
| for (int i = 0; i < count; i++) { | ||
| encodedValues[i] = stripXSS(values[i]); | ||
| } | ||
| return encodedValues; | ||
| } | ||
|
|
||
| @Override | ||
| public String getParameter(String parameter) { | ||
| String value = super.getParameter(parameter); | ||
| return stripXSS(value); | ||
| } | ||
|
|
||
| @Override | ||
| public String getHeader(String name) { | ||
| String value = super.getHeader(name); | ||
| return stripXSS(value); | ||
| } | ||
|
|
||
| private String stripXSS(String value) { | ||
| return org.owasp.encoder.Encode.forHtml(value); | ||
|
|
||
| } | ||
|
|
||
| private JsonNode sanitizeInput(JsonNode input) { | ||
| if (input.isTextual()) { | ||
| return JsonNodeFactory.instance.textNode(stripXSS(input.asText())); | ||
| } else if (input.isArray()) { | ||
| ArrayNode arrayNode = JsonNodeFactory.instance.arrayNode(); | ||
| for (JsonNode element : input) { | ||
| arrayNode.add(sanitizeInput(element)); | ||
| } | ||
| return arrayNode; | ||
| } else if (input.isObject()) { | ||
| ObjectNode objectNode = JsonNodeFactory.instance.objectNode(); | ||
| input.fields().forEachRemaining(entry -> objectNode.set(entry.getKey(), sanitizeInput(entry.getValue()))); | ||
| return objectNode; | ||
| } else { | ||
| return input; | ||
| } | ||
| } | ||
|
|
||
| } |
35 changes: 35 additions & 0 deletions
35
rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/Sw360XssFilter.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| /* | ||
| SPDX-FileCopyrightText: © 2024 Siemens AG | ||
| SPDX-License-Identifier: EPL-2.0 | ||
| */ | ||
| package org.eclipse.sw360.rest.common; | ||
|
|
||
|
|
||
| import jakarta.servlet.*; | ||
| import jakarta.servlet.http.HttpServletRequest; | ||
| import org.springframework.context.annotation.Configuration; | ||
| import org.springframework.core.Ordered; | ||
| import org.springframework.core.annotation.Order; | ||
|
|
||
| import java.io.IOException; | ||
|
|
||
| /** | ||
| * This filter is used to sanitize the input from the user to prevent XSS attacks. | ||
| * @author [email protected] | ||
| */ | ||
| @Configuration | ||
| @Order(Ordered.HIGHEST_PRECEDENCE) | ||
| public class Sw360XssFilter implements Filter { | ||
|
|
||
| /** | ||
| * @param servletRequest | ||
| * @param servletResponse | ||
| * @param filterChain | ||
| * @throws IOException | ||
| * @throws ServletException | ||
| */ | ||
| @Override | ||
| public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { | ||
| filterChain.doFilter(new Sw360XSSRequestWrapper((HttpServletRequest) servletRequest), servletResponse); | ||
| } | ||
| } |