mraible commented on code in PR #167:
URL: https://github.com/apache/roller/pull/167#discussion_r3891439019
##########
app/src/main/java/org/apache/roller/weblogger/ui/core/filters/ValidateSaltFilter.java:
##########
@@ -31,53 +28,35 @@
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
-import org.apache.commons.lang3.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
-import org.apache.roller.weblogger.config.WebloggerConfig;
-import org.apache.roller.weblogger.ui.rendering.util.cache.SaltCache;
-import org.apache.roller.weblogger.ui.core.RollerSession;
/**
* Filter checks all POST request for presence of valid salt value and rejects
those without
* a salt value or with a salt value not generated by this Roller instance.
*/
public class ValidateSaltFilter implements Filter {
private static final Log log = LogFactory.getLog(ValidateSaltFilter.class);
- private Set<String> ignored = Collections.emptySet();
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
HttpServletRequest httpReq = (HttpServletRequest) request;
- String requestURL = httpReq.getRequestURL().toString();
- String queryString = httpReq.getQueryString();
- if (queryString != null) {
- requestURL += "?" + queryString;
- }
-
- if ("POST".equals(httpReq.getMethod()) && !isIgnoredURL(requestURL)) {
- RollerSession rollerSession =
RollerSession.getRollerSession(httpReq);
- if (rollerSession != null) {
- String userId = rollerSession.getAuthenticatedUser() != null ?
rollerSession.getAuthenticatedUser().getId() : "";
-
- Object saltObject = httpReq.getAttribute("salt"); //
multi-form post case
- String salt = saltObject != null ? saltObject.toString() :
null;
- salt = salt != null ? salt : httpReq.getParameter("salt");
- SaltCache saltCache = SaltCache.getInstance();
- if (salt == null || !Objects.equals(saltCache.get(salt),
userId)) {
- if (log.isDebugEnabled()) {
- log.debug("Valid salt value not found on POST to URL :
" + httpReq.getServletPath());
- }
- throw new ServletException("Security Violation");
- }
+ if ("POST".equalsIgnoreCase(httpReq.getMethod())) {
+ if (SaltValidator.isMultipartFormPost(httpReq) &&
isStrutsAction(httpReq)) {
Review Comment:
Edge case: Struts only wraps requests whose full `Content-Type` matches its
`MULTIPART_FORM_DATA_REGEX` (boundary ≤ 70 chars, `boundary` before `charset`).
A multipart POST this check accepts but Struts doesn't wrap skips validation
here and then fails in the interceptor because `getParameter("salt")` is
`null`. Browsers never send those, so probably fine, just noting that deferring
on media type alone isn't quite the same decision Struts makes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
