Skip to content

Commit

Permalink
fix #2489 add time validation
Browse files Browse the repository at this point in the history
  • Loading branch information
@marevol
marevol committed Oct 8, 2020
1 parent ad83edf commit 5f02aa3
Show file tree
Hide file tree
Showing 2 changed files with 60 additions and 17 deletions.
24 changes: 24 additions & 0 deletions src/main/java/org/codelibs/fess/helper/RoleQueryHelper.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,8 @@ public class RoleQueryHelper {

protected boolean encryptedCookieValue = true;

protected long maxAge = 30 * 60 * 1000L; // msec

protected Map<String, String> cookieNameMap;

protected final List<String> defaultRoleList = new ArrayList<>();
Expand Down Expand Up @@ -237,6 +239,20 @@ protected void parseRoleSet(final String value, final boolean encrypted, final S

if (valueSeparator.length() > 0) {
final String[] values = rolesStr.split(valueSeparator);
if (maxAge > 0) {
try {
final long time = getCurrentTime() - Long.parseLong(values[0]);
if (time > maxAge || time < 0) {
if (logger.isDebugEnabled()) {
logger.debug("role info is expired: {} > {}", time, maxAge);
}
return;
}
} catch (NumberFormatException e) {
logger.warn("Invalid role infor: {}", rolesStr, e);
return;
}
}
if (values.length > 1) {
final String[] roles = values[1].split(roleSeparator);
for (final String role : roles) {
Expand All @@ -255,6 +271,10 @@ protected void parseRoleSet(final String value, final boolean encrypted, final S
}
}

protected long getCurrentTime() {
return ComponentUtil.getSystemHelper().getCurrentTimeAsLong();
}

public void addCookieNameMapping(final String cookieName, final String roleName) {
if (cookieNameMap == null) {
cookieNameMap = new HashMap<>();
Expand Down Expand Up @@ -298,4 +318,8 @@ public void setEncryptedCookieValue(final boolean encryptedCookieValue) {
this.encryptedCookieValue = encryptedCookieValue;
}

public void setMaxAge(long maxAge) {
this.maxAge = maxAge;
}

}
53 changes: 36 additions & 17 deletions src/test/java/org/codelibs/fess/helper/RoleQueryHelperTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
import org.codelibs.core.crypto.CachedCipher;
import org.codelibs.core.exception.IllegalBlockSizeRuntimeException;
import org.codelibs.fess.unit.UnitFessTestCase;
import org.codelibs.fess.util.ComponentUtil;

public class RoleQueryHelperTest extends UnitFessTestCase {
public CachedCipher cipher;
Expand Down Expand Up @@ -60,7 +61,11 @@ private Set<String> decodedRoleList(final RoleQueryHelper roleQueryHelperImpl, f
}

public void test_buildByParameter() {
final RoleQueryHelper roleQueryHelperImpl = new RoleQueryHelper();
final RoleQueryHelper roleQueryHelperImpl = new RoleQueryHelper() {
protected long getCurrentTime() {
return System.currentTimeMillis();
}
};

Set<String> roleSet;

Expand All @@ -74,7 +79,7 @@ public void test_buildByParameter() {
assertEquals(0, roleSet.size());

roleQueryHelperImpl.encryptedParameterValue = false;
getMockRequest().setParameter("fess1", "xxx\nrole1,role2,role3");
getMockRequest().setParameter("fess1", System.currentTimeMillis() + "\nrole1,role2,role3");
roleSet = buildByParameter(roleQueryHelperImpl, getMockRequest());
assertEquals(3, roleSet.size());
assertTrue(roleSet.contains("role1"));
Expand All @@ -85,7 +90,7 @@ public void test_buildByParameter() {

roleQueryHelperImpl.cipher = cipher;
roleQueryHelperImpl.encryptedParameterValue = true;
getMockRequest().setParameter("fess2", cipher.encryptoText("xxx\nrole1,role2,role3"));
getMockRequest().setParameter("fess2", cipher.encryptoText(System.currentTimeMillis() + "\nrole1,role2,role3"));
roleSet = buildByParameter(roleQueryHelperImpl, getMockRequest());
assertEquals(3, roleSet.size());
assertTrue(roleSet.contains("role1"));
Expand Down Expand Up @@ -116,7 +121,11 @@ public void test_buildByParameter() {
}

public void test_buildByHeader() {
final RoleQueryHelper roleQueryHelperImpl = new RoleQueryHelper();
final RoleQueryHelper roleQueryHelperImpl = new RoleQueryHelper() {
protected long getCurrentTime() {
return System.currentTimeMillis();
}
};

Set<String> roleSet;

Expand All @@ -134,7 +143,7 @@ public void test_buildByHeader() {
assertEquals(0, roleSet.size());

roleQueryHelperImpl.encryptedHeaderValue = false;
getMockRequest().addHeader("fess1", "xxx\nrole1,role2,role3");
getMockRequest().addHeader("fess1", System.currentTimeMillis() + "\nrole1,role2,role3");
roleSet = buildByHeader(roleQueryHelperImpl, getMockRequest());
assertEquals(3, roleSet.size());
assertTrue(roleSet.contains("role1"));
Expand All @@ -145,7 +154,7 @@ public void test_buildByHeader() {

roleQueryHelperImpl.cipher = cipher;
roleQueryHelperImpl.encryptedHeaderValue = true;
getMockRequest().addHeader("fess2", cipher.encryptoText("xxx\nrole1,role2,role3"));
getMockRequest().addHeader("fess2", cipher.encryptoText(System.currentTimeMillis() + "\nrole1,role2,role3"));
roleSet = buildByHeader(roleQueryHelperImpl, getMockRequest());
assertEquals(3, roleSet.size());
assertTrue(roleSet.contains("role1"));
Expand Down Expand Up @@ -176,7 +185,11 @@ public void test_buildByHeader() {
}

public void test_buildByCookie() {
final RoleQueryHelper roleQueryHelperImpl = new RoleQueryHelper();
final RoleQueryHelper roleQueryHelperImpl = new RoleQueryHelper() {
protected long getCurrentTime() {
return System.currentTimeMillis();
}
};

Set<String> roleSet;
Cookie cookie;
Expand All @@ -199,7 +212,7 @@ public void test_buildByCookie() {
assertEquals(0, roleSet.size());

roleQueryHelperImpl.encryptedCookieValue = false;
cookie = new Cookie("fess1", "xxx\nrole1,role2,role3");
cookie = new Cookie("fess1", System.currentTimeMillis() + "\nrole1,role2,role3");
getMockRequest().addCookie(cookie);
roleSet = buildByCookie(roleQueryHelperImpl, getMockRequest());
assertEquals(3, roleSet.size());
Expand All @@ -211,7 +224,7 @@ public void test_buildByCookie() {

roleQueryHelperImpl.cipher = cipher;
roleQueryHelperImpl.encryptedCookieValue = true;
cookie = new Cookie("fess2", cipher.encryptoText("xxx\nrole1,role2,role3"));
cookie = new Cookie("fess2", cipher.encryptoText(System.currentTimeMillis() + "\nrole1,role2,role3"));
getMockRequest().addCookie(cookie);
roleSet = buildByCookie(roleQueryHelperImpl, getMockRequest());
assertEquals(3, roleSet.size());
Expand Down Expand Up @@ -247,8 +260,11 @@ public void test_buildByCookie() {
}

public void test_decodedRoleList() {

final RoleQueryHelper roleQueryHelperImpl = new RoleQueryHelper();
final RoleQueryHelper roleQueryHelperImpl = new RoleQueryHelper() {
protected long getCurrentTime() {
return System.currentTimeMillis();
}
};

Set<String> roleSet;
boolean encrypted;
Expand All @@ -270,13 +286,13 @@ public void test_decodedRoleList() {
assertEquals(0, roleSet.size());

encrypted = false;
value = "xxx\nrole1";
value = System.currentTimeMillis() + "\nrole1";
roleSet = decodedRoleList(roleQueryHelperImpl, value, encrypted);
assertEquals(1, roleSet.size());
assertTrue(roleSet.contains("role1"));

encrypted = false;
value = "xxx\nrole1,role2";
value = System.currentTimeMillis() + "\nrole1,role2";
roleSet = decodedRoleList(roleQueryHelperImpl, value, encrypted);
assertEquals(2, roleSet.size());
assertTrue(roleSet.contains("role1"));
Expand Down Expand Up @@ -312,8 +328,11 @@ public void test_decodedRoleList() {
}

public void test_decodedRoleList_withCipher() {

final RoleQueryHelper roleQueryHelperImpl = new RoleQueryHelper();
final RoleQueryHelper roleQueryHelperImpl = new RoleQueryHelper() {
protected long getCurrentTime() {
return System.currentTimeMillis();
}
};
roleQueryHelperImpl.cipher = cipher;

Set<String> roleSet;
Expand All @@ -336,13 +355,13 @@ public void test_decodedRoleList_withCipher() {
assertEquals(0, roleSet.size());

encrypted = true;
value = cipher.encryptoText("xxx\nrole1");
value = cipher.encryptoText(System.currentTimeMillis() + "\nrole1");
roleSet = decodedRoleList(roleQueryHelperImpl, value, encrypted);
assertEquals(1, roleSet.size());
assertTrue(roleSet.contains("role1"));

encrypted = true;
value = cipher.encryptoText("xxx\nrole1,role2");
value = cipher.encryptoText(System.currentTimeMillis() + "\nrole1,role2");
roleSet = decodedRoleList(roleQueryHelperImpl, value, encrypted);
assertEquals(2, roleSet.size());
assertTrue(roleSet.contains("role1"));
Expand Down

0 comments on commit 5f02aa3

Please sign in to comment.