Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

185 more restrictive api for string arguments #327

Merged
merged 5 commits into from
Jul 15, 2024
Merged

185 more restrictive api for string arguments #327

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
495b2f2
Renamed Classes: Corrected imports by renaming class files to fit co…
forkimenjeckayang Jul 1, 2024
941e9a3
Renamed Classes: Corrected imports by renaming class files to fit co…
forkimenjeckayang Jul 1, 2024
bebbee8
Modified file in datasafe-rest-impl to enhance security with the REST…
forkimenjeckayang Jul 1, 2024
47c5307
Renamed Classes: returned defaults to changes made in class names
forkimenjeckayang Jul 1, 2024
ca6d4b1
Removed TODO comment
forkimenjeckayang Jul 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion ...t-impl/src/main/java/de/adorsys/datasafe/rest/impl/controller/AuthenticateController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;
Expand All @@ -31,7 +32,7 @@ public class AuthenticateController {
private final AuthenticationManager authenticationManager;

@PostMapping(SecurityConstants.AUTH_LOGIN_URL)
public void authenticate(@RequestBody UserDTO credentialsDTO, HttpServletResponse response) {
public void authenticate(@RequestBody @Validated UserDTO credentialsDTO, HttpServletResponse response) {
String username = credentialsDTO.getUserName();
String password = credentialsDTO.getPassword();
UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username, password);
Expand Down
46 changes: 35 additions & 11 deletions ...-rest-impl/src/main/java/de/adorsys/datasafe/rest/impl/controller/DocumentController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@
import de.adorsys.datasafe.types.api.resource.PrivateResource;
import de.adorsys.datasafe.types.api.resource.StorageIdentifier;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.NotNull;
import lombok.RequiredArgsConstructor;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
Expand Down Expand Up @@ -49,11 +51,16 @@ public class DocumentController {
*/
@SneakyThrows
@GetMapping(value = "/document/{*path}", produces = APPLICATION_OCTET_STREAM_VALUE)
public void readDocument(@RequestHeader String user,
@RequestHeader String password,
public void readDocument(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@RequestHeader(defaultValue = StorageIdentifier.DEFAULT_ID) String storageId,
@PathVariable String path,
@PathVariable @NotBlank String path,
HttpServletResponse response) {
// Validate and sanitize path
if (path.contains("..")) {
throw new IllegalArgumentException("Invalid path");
}

UserIDAuth userIDAuth = new UserIDAuth(new UserID(user), ReadKeyPasswordHelper.getForString(password));
ReadRequest<UserIDAuth, PrivateResource> request =
ReadRequest.forPrivate(userIDAuth, new StorageIdentifier(storageId), path);
Expand All @@ -72,11 +79,16 @@ public void readDocument(@RequestHeader String user,
*/
@SneakyThrows
@PutMapping(value = "/document/{*path}", consumes = MULTIPART_FORM_DATA_VALUE)
public void writeDocument(@RequestHeader String user,
@RequestHeader String password,
public void writeDocument(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@RequestHeader(defaultValue = StorageIdentifier.DEFAULT_ID) String storageId,
@PathVariable String path,
@RequestParam("file") MultipartFile file) {
@RequestParam("file") @NotNull MultipartFile file) {
// Validate and sanitize path
if (path.contains("..")) {
throw new IllegalArgumentException("Invalid path");
}

UserIDAuth userIDAuth = new UserIDAuth(new UserID(user), ReadKeyPasswordHelper.getForString(password));
WriteRequest<UserIDAuth, PrivateResource> request =
WriteRequest.forPrivate(userIDAuth, new StorageIdentifier(storageId), path);
Expand All @@ -91,14 +103,20 @@ public void writeDocument(@RequestHeader String user,
* lists files in user's private space.
*/
@GetMapping("/documents/{*path}")
public List<String> listDocuments(@RequestHeader String user,
@RequestHeader String password,
public List<String> listDocuments(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@RequestHeader(defaultValue = StorageIdentifier.DEFAULT_ID) String storageId,
@PathVariable(required = false) String path) {
UserIDAuth userIDAuth = new UserIDAuth(new UserID(user), ReadKeyPasswordHelper.getForString(password));
path = Optional.ofNullable(path)
.map(it -> it.replaceAll("^\\.$", ""))
.orElse("./");

// Validate and sanitize path
if (path.contains("..")) {
throw new IllegalArgumentException("Invalid path");
}

try {
List<String> documentList = datasafeService.privateService().list(
ListRequest.forPrivate(userIDAuth, new StorageIdentifier(storageId), path))
Expand All @@ -115,10 +133,16 @@ public List<String> listDocuments(@RequestHeader String user,
* deletes files from user's private space.
*/
@DeleteMapping("/document/{*path}")
public void removeDocument(@RequestHeader String user,
@RequestHeader String password,
public void removeDocument(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@RequestHeader(defaultValue = StorageIdentifier.DEFAULT_ID) String storageId,
@PathVariable String path) {
@PathVariable @NotBlank String path) {

// Validate and sanitize path
if (path.contains("..")) {
throw new IllegalArgumentException("Invalid path");
}

UserIDAuth userIDAuth = new UserIDAuth(new UserID(user), ReadKeyPasswordHelper.getForString(password));
RemoveRequest<UserIDAuth, PrivateResource> request =
RemoveRequest.forPrivate(userIDAuth, new StorageIdentifier(storageId), path);
Expand Down
26 changes: 14 additions & 12 deletions ...afe-rest-impl/src/main/java/de/adorsys/datasafe/rest/impl/controller/InboxController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@
import de.adorsys.datasafe.types.api.resource.BasePrivateResource;
import de.adorsys.datasafe.types.api.resource.PrivateResource;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.NotNull;
import lombok.RequiredArgsConstructor;
import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j;
Expand Down Expand Up @@ -52,10 +54,10 @@ public class InboxController {
*/
@SneakyThrows
@PutMapping(value = "/inbox/document/{*path}", consumes = MULTIPART_FORM_DATA_VALUE)
public void writeToInbox(@RequestHeader String user,
@RequestHeader String password,
@RequestHeader Set<String> recipients,
@PathVariable String path,
public void writeToInbox(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@RequestHeader Set<@NotBlank String> recipients,
@PathVariable @NotBlank String path,
@RequestParam("file") MultipartFile file) {
UserIDAuth fromUser = new UserIDAuth(new UserID(user), ReadKeyPasswordHelper.getForString(password));
Set<UserID> toUsers = recipients.stream().map(UserID::new).collect(Collectors.toSet());
Expand All @@ -72,9 +74,9 @@ public void writeToInbox(@RequestHeader String user,
*/
@SneakyThrows
@GetMapping(value = "/inbox/document/{*path}", produces = APPLICATION_OCTET_STREAM_VALUE)
public void readFromInbox(@RequestHeader String user,
@RequestHeader String password,
@PathVariable String path,
public void readFromInbox(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@PathVariable @NotBlank String path,
HttpServletResponse response) {
path = path.replaceAll("^/", "");
UserIDAuth userIDAuth = new UserIDAuth(new UserID(user), ReadKeyPasswordHelper.getForString(password));
Expand All @@ -93,9 +95,9 @@ public void readFromInbox(@RequestHeader String user,
* Deletes file from users' INBOX.
*/
@DeleteMapping("/inbox/document/{*path}")
public void deleteFromInbox(@RequestHeader String user,
@RequestHeader String password,
@PathVariable String path) {
public void deleteFromInbox(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@PathVariable @NotBlank String path) {
path = path.replaceAll("^/", "");
UserIDAuth userIDAuth = new UserIDAuth(new UserID(user), ReadKeyPasswordHelper.getForString(password));
PrivateResource resource = BasePrivateResource.forPrivate(path);
Expand All @@ -108,8 +110,8 @@ public void deleteFromInbox(@RequestHeader String user,
* list files in users' INBOX.
*/
@GetMapping(value = "/inbox/documents/{*path}", produces = APPLICATION_JSON_VALUE)
public List<String> listInbox(@RequestHeader String user,
@RequestHeader String password,
public List<String> listInbox(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@PathVariable(required = false) String path) {
path = path.replaceAll("^/", "");
UserIDAuth userIDAuth = new UserIDAuth(new UserID(user), ReadKeyPasswordHelper.getForString(password));
Expand Down
35 changes: 18 additions & 17 deletions ...safe-rest-impl/src/main/java/de/adorsys/datasafe/rest/impl/controller/UserController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
import de.adorsys.datasafe.rest.impl.exceptions.UserExistsException;
import de.adorsys.datasafe.types.api.resource.StorageIdentifier;
import de.adorsys.datasafe.types.api.types.ReadKeyPassword;
import jakarta.validation.constraints.NotBlank;
import lombok.RequiredArgsConstructor;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.bind.annotation.DeleteMapping;
Expand Down Expand Up @@ -61,51 +62,51 @@ public void createUser(@Validated @RequestBody UserDTO userDTO) {
}

@PostMapping("/password")
public void changePassword(@RequestHeader String user,
@RequestHeader String password,
public void changePassword(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@Validated @RequestBody NewPasswordDTO newPassword) {
ReadKeyPassword readKeyPassword = ReadKeyPasswordHelper.getForString(password);
UserIDAuth auth = new UserIDAuth(new UserID(user), readKeyPassword);
dataSafeService.userProfile().updateReadKeyPassword(auth, ReadKeyPasswordHelper.getForString(newPassword.getNewPassword()));
}

@GetMapping("/publicProfile")
public UserPublicProfileDTO getPublicProfile(@RequestHeader String user,
@RequestHeader String password) {
public UserPublicProfileDTO getPublicProfile(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password) {
ReadKeyPassword readKeyPassword = ReadKeyPasswordHelper.getForString(password);
UserIDAuth auth = new UserIDAuth(new UserID(user), readKeyPassword);
return UserPublicProfileDTO.from(dataSafeService.userProfile().publicProfile(auth.getUserID()));
}

@GetMapping("/privateProfile")
public UserPrivateProfileDTO getPrivateProfile(@RequestHeader String user,
@RequestHeader String password) {
public UserPrivateProfileDTO getPrivateProfile(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password) {
ReadKeyPassword readKeyPassword = ReadKeyPasswordHelper.getForString(password);
UserIDAuth auth = new UserIDAuth(new UserID(user), readKeyPassword);
return UserPrivateProfileDTO.from(dataSafeService.userProfile().privateProfile(auth));
}

@PostMapping("/publicProfile")
public void updatePublicProfile(@RequestHeader String user,
@RequestHeader String password,
public void updatePublicProfile(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@Validated @RequestBody UserPublicProfileDTO profileDto) {
ReadKeyPassword readKeyPassword = ReadKeyPasswordHelper.getForString(password);
UserIDAuth auth = new UserIDAuth(new UserID(user), readKeyPassword);
dataSafeService.userProfile().updatePublicProfile(auth, profileDto.toProfile());
}

@PostMapping("/privateProfile")
public void updatePrivateProfile(@RequestHeader String user,
@RequestHeader String password,
public void updatePrivateProfile(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@Validated @RequestBody UserPrivateProfileDTO profileDto) {
ReadKeyPassword readKeyPassword = ReadKeyPasswordHelper.getForString(password);
UserIDAuth auth = new UserIDAuth(new UserID(user), readKeyPassword);
dataSafeService.userProfile().updatePrivateProfile(auth, profileDto.toProfile());
}

@PostMapping("/storages")
public void addStorageCredentials(@RequestHeader String user,
@RequestHeader String password,
public void addStorageCredentials(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@Validated @RequestBody StorageCredsDTO creds) {
ReadKeyPassword readKeyPassword = ReadKeyPasswordHelper.getForString(password);
UserIDAuth auth = new UserIDAuth(new UserID(user), readKeyPassword);
Expand All @@ -117,9 +118,9 @@ public void addStorageCredentials(@RequestHeader String user,
}

@DeleteMapping("/storages")
public void removeStorageCredentials(@RequestHeader String user,
@RequestHeader String password,
@RequestHeader String storageId) {
public void removeStorageCredentials(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password,
@RequestHeader @NotBlank String storageId) {
ReadKeyPassword readKeyPassword = ReadKeyPasswordHelper.getForString(password);
UserIDAuth auth = new UserIDAuth(new UserID(user), readKeyPassword);
dataSafeService.userProfile().deregisterStorageCredentials(auth, new StorageIdentifier(storageId));
Expand All @@ -132,8 +133,8 @@ public void removeStorageCredentials(@RequestHeader String user,
* @param password user password.
*/
@DeleteMapping
public void deleteUser(@RequestHeader String user,
@RequestHeader String password) {
public void deleteUser(@RequestHeader @NotBlank String user,
@RequestHeader @NotBlank String password) {
UserIDAuth auth = new UserIDAuth(new UserID(user), ReadKeyPasswordHelper.getForString(password));
if (!dataSafeService.userProfile().userExists(auth.getUserID())) {
throw new UserDoesNotExistsException("user '" + auth.getUserID().getValue() + "' does not exists");
Expand Down
Loading
Loading