org.apache.chemistry.opencmis.server.shared.CsrfManager Maven / Gradle / Ivy

Go to download
/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
package org.apache.chemistry.opencmis.server.shared;

import java.security.SecureRandom;

import javax.servlet.ServletConfig;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.apache.chemistry.opencmis.commons.exceptions.CmisPermissionDeniedException;

public class CsrfManager {

    public static final String CSRF_ATTR = "org.apache.chemistry.opencmis.csrftoken";

    private static final String CSRF_HEADER = "csrfHeader";
    private static final String CSRF_PARAMETER = "csrfParameter";
    private static final String FETCH_VALUE = "fetch";

    private static char[][] hexArrays = new char[][] { "0123456789ABCDEF".toCharArray(), //
            "0123456789abcdef".toCharArray(), //
            "ABCDEFGHIJKLMNOP".toCharArray(), //
            "abcdefghijklmnop".toCharArray() };

    private String csrfHeader;
    private String csrfParameter;

    private SecureRandom random = new SecureRandom();

    public CsrfManager(String csrfHeader, String csrfParameter) {
        if (csrfHeader != null) {
            this.csrfHeader = csrfHeader.trim();
            if (this.csrfHeader.length() == 0) {
                throw new IllegalArgumentException("Invalid CSRF header!");
            }
            if (csrfParameter != null) {
                this.csrfParameter = csrfParameter.trim();
                if (this.csrfParameter.length() == 0) {
                    throw new IllegalArgumentException("Invalid CSRF parameter!");
                }
            }
        }
    }

    public CsrfManager(ServletConfig config) throws ServletException {
        csrfHeader = config.getInitParameter(CSRF_HEADER);
        if (csrfHeader != null) {
            this.csrfHeader = csrfHeader.trim();
            if (this.csrfHeader.length() == 0) {
                throw new ServletException("Invalid CSRF header!");
            }

            // get parameter
            csrfParameter = config.getInitParameter(CSRF_PARAMETER);
            if (csrfParameter != null) {
                this.csrfParameter = csrfParameter.trim();
                if (this.csrfParameter.length() == 0) {
                    throw new ServletException("Invalid CSRF parameter!");
                }
            }
        }
    }

    public void check(HttpServletRequest req, HttpServletResponse resp, boolean isRepositoryInfoRequest,
            boolean isContentRequest) {
        if (csrfHeader == null) {
            // no CSRF protection
            return;
        }

        HttpSession httpSession = req.getSession(true);
        String token = (String) httpSession.getAttribute(CSRF_ATTR);
        String headerValue = req.getHeader(csrfHeader);

        // check parameter if the header is not set and this is a content
        // request
        if (headerValue == null || headerValue.isEmpty()) {
            if (isContentRequest && csrfParameter != null) {
                String paramValue = req.getParameter(csrfParameter);
                if (paramValue != null && paramValue.equals(token)) {
                    return;
                }
            }

            throw new CmisPermissionDeniedException("Invalid CSRF token!");
        }

        // check if a new token is requested
        if (isRepositoryInfoRequest && FETCH_VALUE.equals(headerValue) && token == null) {
            token = generateNewToken();
            httpSession.setAttribute(CSRF_ATTR, token);
            resp.addHeader(csrfHeader, token);
            return;
        }

        // check if there is a token
        if (token == null) {
            throw new CmisPermissionDeniedException("Invalid CSRF token!");
        }

        // finally, check the token
        if (!token.equals(headerValue)) {
            throw new CmisPermissionDeniedException("Invalid CSRF token!");
        }
    }

    private String generateNewToken() {
        byte[] tokenBytes = new byte[16];
        random.nextBytes(tokenBytes);

        int ary = random.nextInt(hexArrays.length);

        char[] token = new char[tokenBytes.length * 2];
        for (int i = 0; i < tokenBytes.length; i++) {
            int v = tokenBytes[i] & 0xFF;
            token[i * 2] = hexArrays[ary][v >>> 4];
            token[i * 2 + 1] = hexArrays[ary][v & 0x0F];
        }

        return new String(token);
    }
}