base.jee.servlet.BaseServlet Maven / Gradle / Ivy

Go to download
/**
 * Creative commons Attribution-NonCommercial license.
 *
 * http://creativecommons.org/licenses/by-nc/2.5/au/deed.en_GB
 *
 * NO WARRANTY IS GIVEN OR IMPLIED, USE AT YOUR OWN RISK.
 */
package base.jee.servlet;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import base.jee.JeeBase;
import base.jee.api.API;
import base.jee.api.Settings;
import base.security.User;

import static base.jee.Constants.MAX_IP_ADDRESS_LENGTH;

public abstract class BaseServlet extends HttpServlet {

	private static final long serialVersionUID = 1L;

	protected Settings settings;
	protected JeeBase jee;
	protected API api;

	public BaseServlet(JeeBase jee) throws IOException {
		this.settings = jee.getSettings();
		this.jee = jee;
		this.api = jee.getAPI();
	}

	public final void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		response.setContentType("text/html; charset=UTF-8");
		response.setCharacterEncoding("UTF-8");

		String token = (String)request.getAttribute(jee.cookieName);
		if(token == null) {
			for (Cookie cookie : request.getCookies()) {
				if (cookie.getName().equalsIgnoreCase(jee.cookieName)) {
					token = cookie.getValue();
					break;
				}
			}
		}

		User u = jee.getAPI().getSession(token, getIp(request)).get(0);

		String queryString = request.getQueryString();

		if (queryString == null) {
			jee.log("DEBUG", "Accessing url: " + request.getRequestURI(), u);
		} else {
			jee.log("DEBUG", "Accessing url: " + request.getRequestURI() + "?" + queryString, u);
		}

		doGet(token, u, request, response);
	}

	public abstract void doGet(String token, User u, HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException;

	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
		doGet(request, response);
	}

	/**
	 * Trust the forwarded header only if the connection comes over internal network.
	 */
	public static String getIp(HttpServletRequest request) throws IOException {
		String ip = request.getRemoteAddr();
		if(ip.startsWith("10.") || ip.startsWith("172.") || ip.startsWith("192.168.") || ip.startsWith("127.") || ip.startsWith("0:0:0:0")) {
			if(request.getHeader("HTTP_X_FORWARDED_FOR") != null) {
				ip = request.getHeader("HTTP_X_FORWARDED_FOR");
			}
			if(request.getHeader("X-Forwarded-For") != null) {
				ip = request.getHeader("X-Forwarded-For");
			}
		}
		if(ip != null) {
			if(ip.length() > MAX_IP_ADDRESS_LENGTH * 5) {
				throw new IOException("Malformed client HTTP request header");
			}
			if(ip.trim().length() > MAX_IP_ADDRESS_LENGTH) {
				ip = ip.substring(0, MAX_IP_ADDRESS_LENGTH);
			}
		}
		return ip;
	}

}