(streampipes) branch 2971-e-mail-tokens-contain-characters-not-allowed-in-urls updated: fix(#2971): Improve token generation and URL-enode tokens

[riemer]

This is an automated email from the ASF dual-hosted git repository.

riemer pushed a commit to branch 
2971-e-mail-tokens-contain-characters-not-allowed-in-urls
in repository https://gitbox.apache.org/repos/asf/streampipes.git


The following commit(s) were added to 
refs/heads/2971-e-mail-tokens-contain-characters-not-allowed-in-urls by this 
push:
     new 68601aa22c fix(#2971): Improve token generation and URL-enode tokens
68601aa22c is described below

commit 68601aa22c53db30ffdb63c433e8901a6514d547
Author: Dominik Riemer <dominik.rie...@gmail.com>
AuthorDate: Fri Jun 28 15:07:27 2024 +0200

    fix(#2971): Improve token generation and URL-enode tokens
---
 .../streampipes/mail/template/AbstractMailTemplate.java      |  7 +++++++
 .../mail/template/AccountActiviationMailTemplate.java        |  2 +-
 .../mail/template/PasswordRecoveryMailTemplate.java          |  2 +-
 .../user/management/util/SecureStringGenerator.java          | 12 ++++++++++++
 4 files changed, 21 insertions(+), 2 deletions(-)

diff --git 
a/streampipes-mail/src/main/java/org/apache/streampipes/mail/template/AbstractMailTemplate.java
 
b/streampipes-mail/src/main/java/org/apache/streampipes/mail/template/AbstractMailTemplate.java
index d9f58e00f7..1b7d140952 100644
--- 
a/streampipes-mail/src/main/java/org/apache/streampipes/mail/template/AbstractMailTemplate.java
+++ 
b/streampipes-mail/src/main/java/org/apache/streampipes/mail/template/AbstractMailTemplate.java
@@ -23,7 +23,10 @@ import org.apache.streampipes.mail.template.part.BaseUrlPart;
 import org.apache.streampipes.mail.template.part.LogoPart;
 import org.apache.streampipes.storage.management.StorageDispatcher;
 
+import com.google.common.base.Charsets;
+
 import java.io.IOException;
+import java.net.URLEncoder;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -58,4 +61,8 @@ public abstract class AbstractMailTemplate {
     configureTemplate(builder);
     return builder.generateHtmlTemplate();
   }
+
+  protected String encodeUrlPart(String content) {
+    return URLEncoder.encode(content, Charsets.UTF_8);
+  }
 }
diff --git 
a/streampipes-mail/src/main/java/org/apache/streampipes/mail/template/AccountActiviationMailTemplate.java
 
b/streampipes-mail/src/main/java/org/apache/streampipes/mail/template/AccountActiviationMailTemplate.java
index c9c204559e..945b9fb174 100644
--- 
a/streampipes-mail/src/main/java/org/apache/streampipes/mail/template/AccountActiviationMailTemplate.java
+++ 
b/streampipes-mail/src/main/java/org/apache/streampipes/mail/template/AccountActiviationMailTemplate.java
@@ -60,6 +60,6 @@ public class AccountActiviationMailTemplate extends 
AbstractMailTemplate {
   }
 
   private String makeLink() {
-    return new LinkPart("/#/activate-account?activationCode=" + 
this.activationCode).generate();
+    return new LinkPart("/#/activate-account?activationCode=" + 
encodeUrlPart(this.activationCode)).generate();
   }
 }
diff --git 
a/streampipes-mail/src/main/java/org/apache/streampipes/mail/template/PasswordRecoveryMailTemplate.java
 
b/streampipes-mail/src/main/java/org/apache/streampipes/mail/template/PasswordRecoveryMailTemplate.java
index da1d0aa093..190cced8d1 100644
--- 
a/streampipes-mail/src/main/java/org/apache/streampipes/mail/template/PasswordRecoveryMailTemplate.java
+++ 
b/streampipes-mail/src/main/java/org/apache/streampipes/mail/template/PasswordRecoveryMailTemplate.java
@@ -60,6 +60,6 @@ public class PasswordRecoveryMailTemplate extends 
AbstractMailTemplate {
   }
 
   private String makeLink() {
-    return new LinkPart("/#/set-new-password?recoveryCode=" + 
this.recoveryCode).generate();
+    return new LinkPart("/#/set-new-password?recoveryCode=" + 
encodeUrlPart(this.recoveryCode)).generate();
   }
 }
diff --git 
a/streampipes-user-management/src/main/java/org/apache/streampipes/user/management/util/SecureStringGenerator.java
 
b/streampipes-user-management/src/main/java/org/apache/streampipes/user/management/util/SecureStringGenerator.java
index 046f0da2b0..313e694f50 100644
--- 
a/streampipes-user-management/src/main/java/org/apache/streampipes/user/management/util/SecureStringGenerator.java
+++ 
b/streampipes-user-management/src/main/java/org/apache/streampipes/user/management/util/SecureStringGenerator.java
@@ -18,16 +18,28 @@
 
 package org.apache.streampipes.user.management.util;
 
+import org.apache.commons.text.CharacterPredicate;
 import org.apache.commons.text.RandomStringGenerator;
 
 import java.security.SecureRandom;
 
 public class SecureStringGenerator {
   public String generateSecureString(int length) {
+    // filter for characters allowed in URLs
+    CharacterPredicate includeChars = ch -> (
+        (ch >= 'a' && ch <= 'z')
+            || (ch >= 'A' && ch <= 'Z')
+            || (ch >= '0' && ch <= '9')
+            || ch == '-' || ch == '_' || ch == '.'
+            || ch == '!' || ch == '*' || ch == '(' || ch == ')'
+            || ch == ':' || ch == '@' || ch == '='
+            || ch == '+' || ch == '$' || ch == ','
+    );
     // allowing all ASCII-characters from decimal id 33 to 125
     // see https://www.cs.cmu.edu/~pattis/15-1XX/common/handouts/ascii.html 
for full list
     var pwdGenerator = new RandomStringGenerator.Builder().usingRandom(new 
SecureRandom()::nextInt)
         .withinRange(33, 125)
+        .filteredBy(includeChars)
         .build();
     return pwdGenerator.generate(length);
   }