Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: check connector urls and headers coming from config. #131

Merged
merged 1 commit into from
May 27, 2024
Merged

fix: check connector urls and headers coming from config. #131

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 28 additions & 4 deletions matchmaking/src/main/java/org/eclipse/tractusx/agents/AgentConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,11 @@ public class AgentConfig {

public static final String SERVICE_DENY_ASSET_PROPERTY = "cx.agent.service.asset.deny";
public static final String DEFAULT_SERVICE_DENY_ASSET_PATTERN = "^$";
public static final String SERVICE_ALLOW_CONNECTOR_PROPERTY = "cx.agent.service.connector.allow";
public static final String DEFAULT_SERVICE_ALLOW_CONNECTOR_PATTERN = "https://.*";
public static final String SERVICE_DENY_CONNECTOR_PROPERTY = "cx.agent.service.connector.deny";
public static final String DEFAULT_SERVICE_DENY_CONNECTOR_PATTERN = "^$";

public static final String MATCHMAKING_PORT = "web.http.internal.port";
public static final String MATCHMAKING_PATH = "web.http.internal.path";

Expand All @@ -110,6 +115,11 @@ public class AgentConfig {
protected final Pattern serviceAssetAllowPattern;
protected final Pattern serviceAssetDenyPattern;
protected final Pattern assetReferencePattern;
protected final Pattern connectorAllowPattern;
protected final Pattern connectorDenyPattern;

public static final Pattern PARAMETER_KEY_ALLOW = Pattern.compile("^(?<param>(?!asset$)[^&?=]+)$");
public static final Pattern PARAMETER_VALUE_ALLOW = Pattern.compile("^(?<value>[^&]+)$");

/**
* references to EDC services
Expand All @@ -130,6 +140,8 @@ public AgentConfig(Monitor monitor, Config config) {
serviceDenyPattern = Pattern.compile(config.getString(SERVICE_DENY_PROPERTY, DEFAULT_SERVICE_DENY_PATTERN));
serviceAssetAllowPattern = Pattern.compile(config.getString(SERVICE_ALLOW_ASSET_PROPERTY, DEFAULT_SERVICE_ALLOW_ASSET_PATTERN));
serviceAssetDenyPattern = Pattern.compile(config.getString(SERVICE_DENY_ASSET_PROPERTY, DEFAULT_SERVICE_DENY_ASSET_PATTERN));
connectorAllowPattern = Pattern.compile(config.getString(SERVICE_ALLOW_CONNECTOR_PROPERTY, DEFAULT_SERVICE_ALLOW_CONNECTOR_PATTERN));
connectorDenyPattern = Pattern.compile(config.getString(SERVICE_DENY_CONNECTOR_PROPERTY, DEFAULT_SERVICE_DENY_CONNECTOR_PATTERN));
assetReferencePattern = Pattern.compile("((?<url>[^#]+)#)?(?<asset>.+)");
}

Expand Down Expand Up @@ -183,7 +195,11 @@ public String getAccessPoint() {
* @return uri of the control plane management endpoint (without concrete api)
*/
public String getControlPlaneManagementUrl() {
return config.getString(CONTROL_PLANE_MANAGEMENT, null);
String url = config.getString(CONTROL_PLANE_MANAGEMENT, null);
if (url != null && connectorAllowPattern.matcher(url).matches() && !connectorDenyPattern.matcher(url).matches()) {
return url;
}
return null;
}

/**
Expand All @@ -192,7 +208,11 @@ public String getControlPlaneManagementUrl() {
* @return uri of the control plane management endpoint (without concrete api)
*/
public String getControlPlaneManagementProviderUrl() {
return config.getString(CONTROL_PLANE_MANAGEMENT_PROVIDER, config.getString(CONTROL_PLANE_MANAGEMENT, null));
String url = config.getString(CONTROL_PLANE_MANAGEMENT_PROVIDER, config.getString(CONTROL_PLANE_MANAGEMENT, null));
if (url != null && connectorAllowPattern.matcher(url).matches() && !connectorDenyPattern.matcher(url).matches()) {
return url;
}
return null;
}

/**
Expand All @@ -201,7 +221,11 @@ public String getControlPlaneManagementProviderUrl() {
* @return uri of the control plane ids endpoint (without concrete api)
*/
public String getControlPlaneIdsUrl() {
return config.getString(CONTROL_PLANE_IDS, null);
String url = config.getString(CONTROL_PLANE_IDS, null);
if (url != null && connectorAllowPattern.matcher(url).matches() && !connectorDenyPattern.matcher(url).matches()) {
return url;
}
return null;
}

/**
Expand All @@ -212,7 +236,7 @@ public String getControlPlaneIdsUrl() {
public Map<String, String> getControlPlaneManagementHeaders() {
String key = config.getString(CONTROL_PLANE_AUTH_HEADER, "X-Api-Key");
String value = config.getString(CONTROL_PLANE_AUTH_VALUE, null);
if (key != null && value != null) {
if (key != null && PARAMETER_KEY_ALLOW.matcher(key).matches() && value != null && PARAMETER_VALUE_ALLOW.matcher(value).matches()) {
return Map.of(key, value);
}
return Map.of();
Expand Down
7 changes: 3 additions & 4 deletions matchmaking/src/main/java/org/eclipse/tractusx/agents/http/DelegationServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,8 +185,7 @@ public DelegationResponse sendPostRequest(EndpointDataReference dataReference, S
return new DelegationResponse(sendRequest(newRequest, response), Response.status(response.getStatus()).build());
}

protected static final Pattern PARAMETER_KEY_ALLOW = Pattern.compile("^(?<param>(?!asset$)[^&?=]+)$");
protected static final Pattern PARAMETER_VALUE_ALLOW = Pattern.compile("^(?<value>[^&]+)$");


/**
* computes the url to target the given data plane
Expand All @@ -211,11 +210,11 @@ protected HttpUrl getUrl(String connectorUrl, String subUrl, HttpHeaders headers
HttpUrl.Builder httpBuilder = Objects.requireNonNull(okhttp3.HttpUrl.parse(url)).newBuilder();
for (Map.Entry<String, List<String>> param : uri.getQueryParameters().entrySet()) {
String key = param.getKey();
Matcher keyMatcher = PARAMETER_KEY_ALLOW.matcher(key);
Matcher keyMatcher = AgentConfig.PARAMETER_KEY_ALLOW.matcher(key);
if (keyMatcher.matches()) {
String recodeKey = HttpUtils.urlEncodeParameter(keyMatcher.group("param"));
for (String value : param.getValue()) {
Matcher valueMatcher = PARAMETER_VALUE_ALLOW.matcher(value);
Matcher valueMatcher = AgentConfig.PARAMETER_VALUE_ALLOW.matcher(value);
if (valueMatcher.matches()) {
String recodeValue = HttpUtils.urlEncodeParameter(valueMatcher.group("value"));
httpBuilder = httpBuilder.addQueryParameter(recodeKey, recodeValue);
Expand Down
Loading