Skip to content

Commit

Permalink
merge domain properties
Browse files Browse the repository at this point in the history
  • Loading branch information
@jrivard
jrivard committed Jul 1, 2023
1 parent a1a4fcd commit f66c306
Show file tree
Hide file tree
Showing 7 changed files with 54 additions and 45 deletions.
80 changes: 44 additions & 36 deletions server/src/main/java/password/pwm/http/PwmHttpRequestWrapper.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,11 @@

import com.google.gson.JsonParseException;
import password.pwm.AppProperty;
import password.pwm.DomainProperty;
import password.pwm.PwmConstants;
import password.pwm.bean.DomainID;
import password.pwm.config.AppConfig;
import password.pwm.config.DomainConfig;
import password.pwm.error.PwmError;
import password.pwm.error.PwmUnrecoverableException;
import password.pwm.util.PasswordData;
Expand Down Expand Up @@ -52,14 +54,13 @@
import java.util.Optional;
import java.util.Set;
import java.util.function.Supplier;
import java.util.stream.Collectors;

public class PwmHttpRequestWrapper
{
private static final PwmLogger LOGGER = PwmLogger.forClass( PwmHttpRequestWrapper.class );

private final HttpServletRequest httpServletRequest;
private final AppConfig appConfig;
private final DomainConfig domainConfig;

private static final Set<String> HTTP_PARAM_DEBUG_STRIP_VALUES = Set.of(
"password",
Expand All @@ -81,9 +82,11 @@ public enum Flag
}

public PwmHttpRequestWrapper( final HttpServletRequest request, final AppConfig appConfig )
throws PwmUnrecoverableException
{
this.httpServletRequest = request;
this.appConfig = appConfig;
final DomainID domainID = readDomainIdFromRequest( request );
this.domainConfig = appConfig.getDomainConfigs().get( domainID );
}

public HttpServletRequest getHttpServletRequest( )
Expand All @@ -107,7 +110,7 @@ public boolean isHtmlRequest( )
public String readRequestBodyAsString( )
throws IOException, PwmUnrecoverableException
{
final int maxChars = Integer.parseInt( appConfig.readAppProperty( AppProperty.HTTP_BODY_MAXREAD_LENGTH ) );
final int maxChars = Integer.parseInt( domainConfig.readAppProperty( AppProperty.HTTP_BODY_MAXREAD_LENGTH ) );
return readRequestBodyAsString( maxChars );
}

Expand All @@ -124,9 +127,9 @@ public Map<String, String> readBodyAsJsonStringMap( final Flag... flags )
final String bodyString = readRequestBodyAsString();
final Map<String, String> inputMap = JsonFactory.get().deserializeStringMap( bodyString );

final boolean trim = Boolean.parseBoolean( appConfig.readAppProperty( AppProperty.SECURITY_INPUT_TRIM ) );
final boolean passwordTrim = Boolean.parseBoolean( appConfig.readAppProperty( AppProperty.SECURITY_INPUT_PASSWORD_TRIM ) );
final int maxLength = Integer.parseInt( appConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final boolean trim = Boolean.parseBoolean( domainConfig.readAppProperty( AppProperty.SECURITY_INPUT_TRIM ) );
final boolean passwordTrim = Boolean.parseBoolean( domainConfig.readAppProperty( AppProperty.SECURITY_INPUT_PASSWORD_TRIM ) );
final int maxLength = Integer.parseInt( domainConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );

final Map<String, String> outputMap = new LinkedHashMap<>();
if ( inputMap != null )
Expand All @@ -140,11 +143,11 @@ public Map<String, String> readBodyAsJsonStringMap( final Flag... flags )
String value;
value = bypassInputValidation
? entry.getValue()
: Validator.sanitizeInputValue( appConfig, entry.getValue(), maxLength );
: Validator.sanitizeInputValue( domainConfig.getAppConfig(), entry.getValue(), maxLength );
value = passwordType && passwordTrim ? value.trim() : value;
value = !passwordType && trim ? value.trim() : value;

final String sanitizedName = Validator.sanitizeInputValue( appConfig, key, maxLength );
final String sanitizedName = Validator.sanitizeInputValue( domainConfig.getAppConfig(), key, maxLength );
outputMap.put( sanitizedName, value );
}
}
Expand All @@ -160,9 +163,9 @@ public Map<String, Object> readBodyAsJsonMap( final Flag... flags )
final String bodyString = readRequestBodyAsString();
final Map<String, Object> inputMap = JsonFactory.get().deserializeMap( bodyString, String.class, Object.class );

final boolean trim = Boolean.parseBoolean( appConfig.readAppProperty( AppProperty.SECURITY_INPUT_TRIM ) );
final boolean passwordTrim = Boolean.parseBoolean( appConfig.readAppProperty( AppProperty.SECURITY_INPUT_PASSWORD_TRIM ) );
final int maxLength = Integer.parseInt( appConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final boolean trim = Boolean.parseBoolean( domainConfig.readAppProperty( AppProperty.SECURITY_INPUT_TRIM ) );
final boolean passwordTrim = Boolean.parseBoolean( domainConfig.readAppProperty( AppProperty.SECURITY_INPUT_PASSWORD_TRIM ) );
final int maxLength = Integer.parseInt( domainConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );

final Map<String, Object> outputMap = new LinkedHashMap<>();
if ( inputMap != null )
Expand All @@ -178,7 +181,7 @@ public Map<String, Object> readBodyAsJsonMap( final Flag... flags )
{
String stringValue = bypassInputValidation
? ( String ) entry.getValue()
: Validator.sanitizeInputValue( appConfig, ( String ) entry.getValue(), maxLength );
: Validator.sanitizeInputValue( domainConfig.getAppConfig(), ( String ) entry.getValue(), maxLength );
stringValue = passwordType && passwordTrim ? stringValue.trim() : stringValue;
stringValue = !passwordType && trim ? stringValue.trim() : stringValue;
value = stringValue;
Expand All @@ -188,7 +191,7 @@ public Map<String, Object> readBodyAsJsonMap( final Flag... flags )
value = entry.getValue();
}

final String sanitizedName = Validator.sanitizeInputValue( appConfig, key, maxLength );
final String sanitizedName = Validator.sanitizeInputValue( domainConfig.getAppConfig(), key, maxLength );
outputMap.put( sanitizedName, value );
}
}
Expand All @@ -200,14 +203,14 @@ public Map<String, Object> readBodyAsJsonMap( final Flag... flags )
public Optional<PasswordData> readParameterAsPassword( final String name )
throws PwmUnrecoverableException
{
final int maxLength = Integer.parseInt( appConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final boolean trim = Boolean.parseBoolean( appConfig.readAppProperty( AppProperty.SECURITY_INPUT_PASSWORD_TRIM ) );
final int maxLength = Integer.parseInt( domainConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final boolean trim = Boolean.parseBoolean( domainConfig.readAppProperty( AppProperty.SECURITY_INPUT_PASSWORD_TRIM ) );

final String rawValue = httpServletRequest.getParameter( name );
if ( rawValue != null && !rawValue.isEmpty() )
{
final String decodedValue = decodeStringToDefaultCharSet( rawValue );
final String sanitizedValue = Validator.sanitizeInputValue( appConfig, decodedValue, maxLength );
final String sanitizedValue = Validator.sanitizeInputValue( domainConfig.getAppConfig(), decodedValue, maxLength );
if ( sanitizedValue != null )
{
final String trimmedVale = trim ? sanitizedValue.trim() : sanitizedValue;
Expand All @@ -232,7 +235,7 @@ public String readParameterAsString( final String name, final int maxLength, fin
public String readParameterAsString( final String name, final String valueIfNotPresent )
throws PwmUnrecoverableException
{
final int maxLength = Integer.parseInt( appConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final int maxLength = Integer.parseInt( domainConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final String returnValue = readParameterAsString( name, maxLength );
return returnValue == null || returnValue.isEmpty() ? valueIfNotPresent : returnValue;
}
Expand All @@ -246,7 +249,7 @@ public boolean hasParameter( final String name )
public String readParameterAsString( final String name, final Flag... flags )
throws PwmUnrecoverableException
{
final int maxLength = Integer.parseInt( appConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final int maxLength = Integer.parseInt( domainConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
return readParameterAsString( name, maxLength, flags );
}

Expand Down Expand Up @@ -287,7 +290,7 @@ public List<String> readParameterAsStrings(
{
final boolean bypassInputValidation = flags != null && Arrays.asList( flags ).contains( Flag.BypassValidation );
final HttpServletRequest req = this.getHttpServletRequest();
final boolean trim = Boolean.parseBoolean( appConfig.readAppProperty( AppProperty.SECURITY_INPUT_TRIM ) );
final boolean trim = Boolean.parseBoolean( domainConfig.readAppProperty( AppProperty.SECURITY_INPUT_TRIM ) );
final String[] rawValues = req.getParameterValues( name );
if ( rawValues == null || rawValues.length == 0 )
{
Expand All @@ -300,7 +303,7 @@ public List<String> readParameterAsStrings(
final String decodedValue = decodeStringToDefaultCharSet( rawValue );
final String sanitizedValue = bypassInputValidation
? decodedValue
: Validator.sanitizeInputValue( appConfig, decodedValue, maxLength );
: Validator.sanitizeInputValue( domainConfig.getAppConfig(), decodedValue, maxLength );

if ( sanitizedValue.length() > 0 )
{
Expand Down Expand Up @@ -333,22 +336,22 @@ public String readHeaderValueAsString( final HttpHeader headerName )

public String readHeaderValueAsString( final String headerName )
{
final int maxChars = Integer.parseInt( appConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final int maxChars = Integer.parseInt( domainConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final HttpServletRequest req = this.getHttpServletRequest();
final String rawValue = req.getHeader( headerName );
final String sanitizedInputValue = Validator.sanitizeInputValue( appConfig, rawValue, maxChars );
return Validator.sanitizeHeaderValue( appConfig, sanitizedInputValue );
final String sanitizedInputValue = Validator.sanitizeInputValue( domainConfig.getAppConfig(), rawValue, maxChars );
return Validator.sanitizeHeaderValue( domainConfig.getAppConfig(), sanitizedInputValue );
}

public List<String> readHeaderValuesAsString( final String headerName )
{
final int maxChars = Integer.parseInt( appConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final int maxChars = Integer.parseInt( domainConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final List<String> valueList = new ArrayList<>();
for ( final Enumeration<String> headerValueEnum = this.getHttpServletRequest().getHeaders( headerName ); headerValueEnum.hasMoreElements(); )
{
final String headerValue = headerValueEnum.nextElement();
final String sanitizedInputValue = Validator.sanitizeInputValue( appConfig, headerValue, maxChars );
final String sanitizedHeaderValue = Validator.sanitizeHeaderValue( appConfig, sanitizedInputValue );
final String sanitizedInputValue = Validator.sanitizeInputValue( domainConfig.getAppConfig(), headerValue, maxChars );
final String sanitizedHeaderValue = Validator.sanitizeHeaderValue( domainConfig.getAppConfig(), sanitizedInputValue );
if ( sanitizedHeaderValue != null && !sanitizedHeaderValue.isEmpty() )
{
valueList.add( sanitizedHeaderValue );
Expand All @@ -374,20 +377,20 @@ public Map<String, List<String>> readHeaderValuesMap( )

public List<String> headerNames( )
{
final int maxChars = Integer.parseInt( appConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final int maxChars = Integer.parseInt( domainConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );

return CollectionUtil.iteratorToStream( getHttpServletRequest().getHeaderNames().asIterator() )
.map( s -> Validator.sanitizeInputValue( appConfig, s, maxChars ) )
.collect( Collectors.toUnmodifiableList() );
.map( s -> Validator.sanitizeInputValue( domainConfig.getAppConfig(), s, maxChars ) )
.toList();

}

public List<String> parameterNames( )
{
final int maxChars = Integer.parseInt( appConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final int maxChars = Integer.parseInt( domainConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );

return CollectionUtil.iteratorToStream( getHttpServletRequest().getParameterNames().asIterator() )
.map( s -> Validator.sanitizeInputValue( appConfig, s, maxChars ) )
.map( s -> Validator.sanitizeInputValue( domainConfig.getAppConfig(), s, maxChars ) )
.toList();

}
Expand All @@ -409,7 +412,7 @@ public Map<String, String> readParametersAsMap( )
public Map<String, List<String>> readMultiParametersAsMap( )
throws PwmUnrecoverableException
{
final int maxLength = Integer.parseInt( appConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );
final int maxLength = Integer.parseInt( domainConfig.readAppProperty( AppProperty.HTTP_PARAM_MAX_READ_LENGTH ) );

final List<String> parameterNames = parameterNames();

Expand All @@ -425,7 +428,7 @@ public Map<String, List<String>> readMultiParametersAsMap( )

public Optional<String> readCookie( final String cookieName )
{
final int maxChars = Integer.parseInt( appConfig.readAppProperty( AppProperty.HTTP_COOKIE_MAX_READ_LENGTH ) );
final int maxChars = Integer.parseInt( domainConfig.readDomainProperty( DomainProperty.HTTP_COOKIE_MAX_READ_LENGTH ) );
final Cookie[] cookies = this.getHttpServletRequest().getCookies();
if ( cookies != null )
{
Expand All @@ -437,7 +440,7 @@ public Optional<String> readCookie( final String cookieName )
try
{
final String decodedCookieValue = StringUtil.urlDecode( rawCookieValue );
return Optional.of( Validator.sanitizeInputValue( appConfig, decodedCookieValue, maxChars ) );
return Optional.of( Validator.sanitizeInputValue( domainConfig.getAppConfig(), decodedCookieValue, maxChars ) );
}
catch ( final IOException e )
{
Expand All @@ -464,7 +467,12 @@ public HttpMethod getMethod( )

public AppConfig getAppConfig( )
{
return appConfig;
return domainConfig.getAppConfig();
}

public DomainConfig getDomainConfig( )
{
return domainConfig;
}

public String getUrlWithoutQueryString( )
Expand Down
2 changes: 1 addition & 1 deletion server/src/main/java/password/pwm/http/PwmResponse.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -380,7 +380,7 @@ public void writeCookie(
else
{
value = StringUtil.urlEncode(
Validator.sanitizeHeaderValue( domainConfig, cookieValue )
Validator.sanitizeHeaderValue( domainConfig.getAppConfig(), cookieValue )
);
}
}
Expand Down
3 changes: 2 additions & 1 deletion server/src/main/java/password/pwm/http/filter/AbstractPwmFilter.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -78,11 +78,12 @@ public void doFilter(
try
{
pwmRequest = PwmRequest.forRequest( req, resp );
final PwmURL pwmURL = PwmURL.create( req );
}
catch ( final PwmException e )
{
LOGGER.error( pwmRequest, () -> "unexpected error processing filter chain: " + e.getMessage(), e );
resp.sendError( 500 );
return;
}

try
Expand Down
2 changes: 1 addition & 1 deletion server/src/main/java/password/pwm/http/filter/DomainInitFilter.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@ ProcessStatus initializeDomainIdInRequest(
return ProcessStatus.Continue;
}

private static Optional<DomainID> readDomainFromRequest( final PwmApplication pwmApplication, final HttpServletRequest req )
public static Optional<DomainID> readDomainFromRequest( final PwmApplication pwmApplication, final HttpServletRequest req )
{
final boolean pathMode = pwmApplication.getConfig().readSettingAsBoolean( PwmSetting.DOMAIN_DOMAIN_PATHS );
if ( pathMode )
Expand Down
5 changes: 2 additions & 3 deletions server/src/main/java/password/pwm/util/Validator.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@
import password.pwm.PwmConstants;
import password.pwm.bean.FormNonce;
import password.pwm.config.AppConfig;
import password.pwm.config.DomainConfig;
import password.pwm.config.PwmSetting;
import password.pwm.error.ErrorInformation;
import password.pwm.error.PwmError;
Expand Down Expand Up @@ -153,14 +152,14 @@ public static String sanitizeInputValue(
}


public static String sanitizeHeaderValue( final DomainConfig domainConfig, final String input )
public static String sanitizeHeaderValue( final AppConfig appConfig, final String input )
{
if ( input == null )
{
return null;
}

final String regexStripPatternStr = domainConfig.readAppProperty( AppProperty.SECURITY_HTTP_STRIP_HEADER_REGEX );
final String regexStripPatternStr = appConfig.readAppProperty( AppProperty.SECURITY_HTTP_STRIP_HEADER_REGEX );
if ( regexStripPatternStr != null && !regexStripPatternStr.isEmpty() )
{
final Pattern pattern = Pattern.compile( regexStripPatternStr );
Expand Down
1 change: 1 addition & 0 deletions server/src/main/java/password/pwm/ws/server/RestRequest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@ private RestRequest(
final SessionLabel sessionLabel,
final HttpServletRequest httpServletRequest
)
throws PwmUnrecoverableException
{
super( httpServletRequest, pwmDomain.getConfig().getAppConfig() );
this.pwmDomain = pwmDomain;
Expand Down
6 changes: 3 additions & 3 deletions webapp/src/main/webapp/WEB-INF/web.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -160,15 +160,15 @@
<filter-class>password.pwm.http.filter.DomainRouterFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>CookieUpdateFilter</filter-name>
<filter-name>DomainInitFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>DomainInitFilter</filter-name>
<filter-name>RequestInitializationFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>RequestInitializationFilter</filter-name>
<filter-name>CookieUpdateFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
Expand Down

0 comments on commit f66c306

Please sign in to comment.