Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Upgrade 2x Apache httpcomponent libraries used from their old 4.x ver…
…ions to the latest 5.x versions. Required updating imports and rewriting a bit of code in the CssScanner class.
- Loading branch information
1 parent
1bae19f
commit b09b02f
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -43,12 +43,17 @@ | |
|
|
||
| import org.apache.batik.css.parser.ParseException; | ||
| import org.apache.batik.css.parser.Parser; | ||
| import org.apache.hc.core5.http.ClassicHttpResponse; | ||
| import org.apache.hc.core5.http.HttpEntity; | ||
| import org.apache.hc.core5.http.HttpStatus; | ||
| import org.apache.hc.client5.http.ClientProtocolException; | ||
| import org.apache.hc.client5.http.classic.HttpClient; | ||
| import org.apache.hc.client5.http.config.RequestConfig; | ||
| import org.apache.hc.client5.http.classic.methods.HttpGet; | ||
| import org.apache.hc.client5.http.impl.classic.HttpClientBuilder; | ||
| import org.apache.hc.core5.http.io.HttpClientResponseHandler; | ||
| import org.apache.hc.core5.http.io.entity.EntityUtils; | ||
| import org.apache.hc.core5.util.Timeout; | ||
| import org.owasp.validator.html.CleanResults; | ||
| import org.owasp.validator.html.InternalPolicy; | ||
| import org.owasp.validator.html.Policy; | ||
|
|
@@ -70,7 +75,7 @@ | |
| */ | ||
| public class CssScanner { | ||
|
|
||
| protected static final Timeout DEFAULT_TIMEOUT = Timeout.ofMilliseconds(1000); | ||
|
|
||
| private static final String CDATA = "^\\s*<!\\[CDATA\\[(.*)\\]\\]>\\s*$"; | ||
|
|
||
|
|
@@ -263,15 +268,14 @@ private void parseImportedStylesheets(LinkedList<URI> stylesheets, List<String> | |
|
|
||
| // Ensure that we have appropriate timeout values so we don't | ||
| // get DoSed waiting for returns | ||
| Timeout timeout = DEFAULT_TIMEOUT; | ||
| try { | ||
| timeout = Timeout.ofMilliseconds(Long.parseLong(policy.getDirective(Policy.CONNECTION_TIMEOUT))); | ||
| } catch (NumberFormatException nfe) { | ||
| } | ||
|
|
||
| RequestConfig requestConfig = RequestConfig.custom() | ||
| .setResponseTimeout(timeout) | ||
This comment has been minimized.
Sorry, something went wrong.
This comment has been minimized.
Sorry, something went wrong. 
davewichers
Author
Collaborator
|
||
| .setConnectionRequestTimeout(timeout) | ||
| .build(); | ||
|
|
||
|
|
@@ -302,13 +306,33 @@ private void parseImportedStylesheets(LinkedList<URI> stylesheets, List<String> | |
| continue; | ||
| } | ||
|
|
||
| // Pulled directly from: https://github.com/apache/httpcomponents-client/blob/5.1.x/httpclient5/src/test/java/org/apache/hc/client5/http/examples/ClientWithResponseHandler.java | ||
| // Create a custom response handler to read in the stylesheet | ||
| final HttpClientResponseHandler<String> responseHandler = new HttpClientResponseHandler<String>() { | ||
|
|
||
| @Override | ||
| public String handleResponse( | ||
| final ClassicHttpResponse response) throws IOException { | ||
| final int status = response.getCode(); | ||
| if (status >= HttpStatus.SC_SUCCESS && status < HttpStatus.SC_REDIRECTION) { | ||
| final HttpEntity entity = response.getEntity(); | ||
| try { | ||
| return entity != null ? EntityUtils.toString(entity) : null; | ||
| } catch (final ParseException | org.apache.hc.core5.http.ParseException ex) { | ||
| throw new ClientProtocolException(ex); | ||
| } | ||
| } else { | ||
| throw new ClientProtocolException("Unexpected response status: " + status); | ||
| } | ||
| } | ||
| }; | ||
|
|
||
| byte[] stylesheet = null; | ||
|
|
||
| try { | ||
| String responseBody = httpClient.execute(new HttpGet(stylesheetUri), responseHandler); | ||
| // pull down stylesheet, observing size limit | ||
| stylesheet = responseBody.getBytes(); | ||
| if (stylesheet != null && stylesheet.length > sizeLimit) { | ||
| errorMessages.add(ErrorMessageUtil.getMessage( | ||
| messages, | ||
|
|
@@ -323,8 +347,6 @@ private void parseImportedStylesheets(LinkedList<URI> stylesheets, List<String> | |
| messages, | ||
| ErrorMessageUtil.ERROR_CSS_IMPORT_FAILURE, | ||
| new Object[] { HTMLEntityEncoder.htmlEntityEncode(stylesheetUri.toString()) })); | ||
| } | ||
|
|
||
| if (stylesheet != null) { | ||
|
|
||
@davewichers only left response timeout because of the comment above?
setConnectTimeoutis still valid, from what I've seen in decompiled classes it is used as timeout when opening the socket to connect to target host. After it has a successful socket bind, it sets the response timeout and then performs the actual request. So in total it would be 2 seconds max if everything is that delayed. I can addsetConnectTimeoutback if it seems reasonable to you, next to the response timeout.