github-advanced-security[bot] commented on code in PR #4512:
URL: https://github.com/apache/streampark/pull/4512#discussion_r3925199827
##########
streampark-common/src/main/java/org/apache/streampark/common/util/PathUtils.java:
##########
@@ -50,15 +50,11 @@
return Files.newInputStream(resolved); // NOSONAR javasecurity:S2083 -
path validated via Path.resolve above
}
- public static String readConfigFile(String filename) throws IOException {
- validateConfigFilename(filename);
- Path base = Paths.get("").toAbsolutePath().normalize();
- Path resolved = base.resolve(filename).normalize();
- if (!Paths.get(filename).isAbsolute() && !resolved.startsWith(base)) {
- throw new IOException("invalid file path: " + filename);
- }
- return Files.readString(resolved, StandardCharsets.UTF_8); // NOSONAR
javasecurity:S2083 - path validated via
- //
Path.resolve above
+ public static String readFileAsString(String filename) throws IOException {
+ Path resolved = resolvePath(filename);
+ // NOSONAR javasecurity:S2083 - path validated via
+ // Path.resolve above
+ return Files.readString(resolved, StandardCharsets.UTF_8);
Review Comment:
## SonarCloud / I/O function calls should not be vulnerable to path
injection attacks
<!--SONAR_ISSUE_KEY:AaBnhVIn6Nc6nUGafAdS-->Change this code to not construct
the path from user-controlled data. <p>See more on <a
href="https://sonarcloud.io/project/issues?id=apache_incubator-streampark&issues=AaBnhVIn6Nc6nUGafAdS&open=AaBnhVIn6Nc6nUGafAdS&pullRequest=4512";>SonarQube
Cloud</a></p>
[Show more
details](https://github.com/apache/streampark/security/code-scanning/279)
##########
streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/base/util/WebUtils.java:
##########
@@ -91,4 +134,99 @@
return getAppDir(PLUGINS);
}
+ /** Proxies a request and streams the upstream response to the servlet
response. */
+ public static void http(
+ String url,
+ HttpServletRequest request,
+ HttpServletResponse response) throws IOException {
+ Headers.Builder headersBuilder = new Headers.Builder();
+ Set<String> skippedHeaders =
+ skippedHeaders(request.getHeader("Connection"),
REQUEST_SKIP_HEADERS);
+ Enumeration<String> headerNames = request.getHeaderNames();
+ if (headerNames != null) {
+ while (headerNames.hasMoreElements()) {
+ String headerName = headerNames.nextElement();
+ String normalizedName = headerName.toLowerCase(Locale.ROOT);
+ if ("referer".equals(normalizedName)
+ || "origin".equals(normalizedName)
+ || "host".equals(normalizedName)
+ || skippedHeaders.contains(normalizedName)
+ || normalizedName.startsWith("access-control-")) {
+ continue;
+ }
+ Enumeration<String> values = request.getHeaders(headerName);
+ if (values == null) {
+ continue;
+ }
+ while (values.hasMoreElements()) {
+ String value = values.nextElement();
+ if (value != null) {
+ headersBuilder.add(headerName, value);
+ }
+ }
+ }
+ }
+
+ Request.Builder requestBuilder =
+ new Request.Builder().url(url).headers(headersBuilder.build());
Review Comment:
## SonarCloud / Server-side requests should not be vulnerable to forging
attacks
<!--SONAR_ISSUE_KEY:AaBnhUtL6Nc6nUGafAcJ-->Change this code to not construct
the URL from user-controlled data. <p>See more on <a
href="https://sonarcloud.io/project/issues?id=apache_incubator-streampark&issues=AaBnhUtL6Nc6nUGafAcJ&open=AaBnhUtL6Nc6nUGafAcJ&pullRequest=4512";>SonarQube
Cloud</a></p>
[Show more
details](https://github.com/apache/streampark/security/code-scanning/283)
##########
streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/base/util/WebUtils.java:
##########
@@ -91,4 +134,99 @@
return getAppDir(PLUGINS);
}
+ /** Proxies a request and streams the upstream response to the servlet
response. */
+ public static void http(
+ String url,
+ HttpServletRequest request,
+ HttpServletResponse response) throws IOException {
+ Headers.Builder headersBuilder = new Headers.Builder();
+ Set<String> skippedHeaders =
+ skippedHeaders(request.getHeader("Connection"),
REQUEST_SKIP_HEADERS);
+ Enumeration<String> headerNames = request.getHeaderNames();
+ if (headerNames != null) {
+ while (headerNames.hasMoreElements()) {
+ String headerName = headerNames.nextElement();
+ String normalizedName = headerName.toLowerCase(Locale.ROOT);
+ if ("referer".equals(normalizedName)
+ || "origin".equals(normalizedName)
+ || "host".equals(normalizedName)
+ || skippedHeaders.contains(normalizedName)
+ || normalizedName.startsWith("access-control-")) {
+ continue;
+ }
+ Enumeration<String> values = request.getHeaders(headerName);
+ if (values == null) {
+ continue;
+ }
+ while (values.hasMoreElements()) {
+ String value = values.nextElement();
+ if (value != null) {
+ headersBuilder.add(headerName, value);
+ }
+ }
+ }
+ }
+
+ Request.Builder requestBuilder =
+ new Request.Builder().url(url).headers(headersBuilder.build());
Review Comment:
## SonarCloud / Server-side requests should not be vulnerable to traversing
attacks
<!--SONAR_ISSUE_KEY:AaBnhUtL6Nc6nUGafAcK-->Change this code to not construct
the URL's path from user-controlled data. <p>See more on <a
href="https://sonarcloud.io/project/issues?id=apache_incubator-streampark&issues=AaBnhUtL6Nc6nUGafAcK&open=AaBnhUtL6Nc6nUGafAcK&pullRequest=4512";>SonarQube
Cloud</a></p>
[Show more
details](https://github.com/apache/streampark/security/code-scanning/284)
##########
streampark-console/streampark-console-service/src/main/java/org/apache/streampark/console/base/util/WebUtils.java:
##########
@@ -91,4 +134,99 @@
return getAppDir(PLUGINS);
}
+ /** Proxies a request and streams the upstream response to the servlet
response. */
+ public static void http(
+ String url,
+ HttpServletRequest request,
+ HttpServletResponse response) throws IOException {
+ Headers.Builder headersBuilder = new Headers.Builder();
+ Set<String> skippedHeaders =
+ skippedHeaders(request.getHeader("Connection"),
REQUEST_SKIP_HEADERS);
+ Enumeration<String> headerNames = request.getHeaderNames();
+ if (headerNames != null) {
+ while (headerNames.hasMoreElements()) {
+ String headerName = headerNames.nextElement();
+ String normalizedName = headerName.toLowerCase(Locale.ROOT);
+ if ("referer".equals(normalizedName)
+ || "origin".equals(normalizedName)
+ || "host".equals(normalizedName)
+ || skippedHeaders.contains(normalizedName)
+ || normalizedName.startsWith("access-control-")) {
+ continue;
+ }
+ Enumeration<String> values = request.getHeaders(headerName);
+ if (values == null) {
+ continue;
+ }
+ while (values.hasMoreElements()) {
+ String value = values.nextElement();
+ if (value != null) {
+ headersBuilder.add(headerName, value);
+ }
+ }
+ }
+ }
+
+ Request.Builder requestBuilder =
+ new Request.Builder().url(url).headers(headersBuilder.build());
+ // OkHttp derives Host and Content-Length from the upstream URL and
replayable request body.
+ String method = request.getMethod();
+ if (HttpMethod.GET.matches(method) || HttpMethod.HEAD.matches(method))
{
+ requestBuilder.method(method, null);
+ } else {
+ byte[] content =
org.apache.commons.io.IOUtils.toByteArray(request.getInputStream());
+ MediaType contentType =
+ StringUtils.isNotBlank(request.getContentType())
+ ? MediaType.parse(request.getContentType())
+ : null;
+ requestBuilder.method(method, RequestBody.create(content,
contentType));
+ }
+
+ try (Response upstream = OkHttpUtils.call(requestBuilder.build())) {
+ writeProxyResponse(upstream, response);
+ }
+ }
+
+ private static void writeProxyResponse(
+ Response upstream,
HttpServletResponse downstream) throws IOException {
+ copyProxyResponseHeaders(upstream, downstream);
+ downstream.setStatus(upstream.code());
+ downstream.setHeader("Access-Control-Allow-Origin", "*");
Review Comment:
## SonarCloud / Cross-Origin Resource Sharing (CORS) policy should be
restricted to trusted origins
<!--SONAR_ISSUE_KEY:AaBnhUtL6Nc6nUGafAcI-->Make sure that enabling CORS is
safe here. <p>See more on <a
href="https://sonarcloud.io/project/issues?id=apache_incubator-streampark&issues=AaBnhUtL6Nc6nUGafAcI&open=AaBnhUtL6Nc6nUGafAcI&pullRequest=4512";>SonarQube
Cloud</a></p>
[Show more
details](https://github.com/apache/streampark/security/code-scanning/282)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
