File D:\maven-qcr-plugin-testsunitaires\qcr4java\jenkins-master\target\site\qc\core\src\main\java\hudson\security\csrf\DefaultCrumbIssuer.java.html

1 /**
2 * Copyright (c) 2008-2010 Yahoo! Inc.
3 * All rights reserved.
4 * The copyrights to the contents of this file are licensed under the MIT License (http://www.opensource.org/licenses/mit-license.php)
5 */
6 package hudson.security.csrf;
7
8 import java.security.MessageDigest;
9 import java.security.NoSuchAlgorithmException;
10 import java.util.logging.Level;
11 import java.util.logging.Logger;
12
13 import hudson.Extension;
14 import hudson.Util;
15 import jenkins.model.Jenkins;
16 import hudson.model.ModelObject;
17
18 import javax.servlet.ServletRequest;
19 import javax.servlet.http.HttpServletRequest;
20
21 import net.sf.json.JSONObject;
22
23 import org.acegisecurity.Authentication;
24 import org.kohsuke.stapler.DataBoundConstructor;
25 import org.kohsuke.stapler.StaplerRequest;
26
27 /**
28 * A crumb issuing algorithm based on the request principal and the remote address.
29 *
30 * @author dty
31 */
32 public class DefaultCrumbIssuer extends CrumbIssuer {
33
34 private transient MessageDigest md;
35 private boolean excludeClientIPFromCrumb;
36
37 @DataBoundConstructor
38 public DefaultCrumbIssuer(boolean excludeClientIPFromCrumb) {
39 try {
40 this.md = MessageDigest.getInstance("MD5");
41 this.excludeClientIPFromCrumb = excludeClientIPFromCrumb;
42 } catch (NoSuchAlgorithmException e) {
43 this.md = null;
44 this.excludeClientIPFromCrumb = false;
45 LOGGER.log(Level.SEVERE, "Can't find MD5", e);
46 }
47 }
48
49 public boolean isExcludeClientIPFromCrumb() {
50 return this.excludeClientIPFromCrumb;
51 }
52
53 private Object readResolve() {
54 try {
55 this.md = MessageDigest.getInstance("MD5");
56 } catch (NoSuchAlgorithmException e) {
57 this.md = null;
58 LOGGER.log(Level.SEVERE, "Can't find MD5", e);
59 }
60
61 return this;
62 }
63
64 /**
65 * {@inheritDoc}
66 */
67 @Override
68 protected synchronized String issueCrumb(ServletRequest request, String salt) {
69 if (request instanceof HttpServletRequest) {
70 if (md != null) {
71 HttpServletRequest req = (HttpServletRequest) request;
72 StringBuilder buffer = new StringBuilder();
73 Authentication a = Jenkins.getAuthentication();
74 if (a != null) {
75 buffer.append(a.getName());
76 }
77 buffer.append(';');
78 if (!isExcludeClientIPFromCrumb()) {
79 buffer.append(getClientIP(req));
80 }
81
82 md.update(buffer.toString().getBytes());
83 return Util.toHexString(md.digest(salt.getBytes()));
84 }
85 }
86 return null;
87 }
88
89 /**
90 * {@inheritDoc}
91 */
92 @Override
93 public boolean validateCrumb(ServletRequest request, String salt, String crumb) {
94 if (request instanceof HttpServletRequest) {
95 String newCrumb = issueCrumb(request, salt);
96 if ((newCrumb != null) && (crumb != null)) {
97 return newCrumb.equals(crumb);
98 }
99 }
100 return false;
101 }
102
103 private final String PROXY_HEADER = "X-Forwarded-For";
104
105 private String getClientIP(HttpServletRequest req) {
106 String defaultAddress = req.getRemoteAddr();
107 String forwarded = req.getHeader(PROXY_HEADER);
108 if (forwarded != null) {
109 String[] hopList = forwarded.split(",");
110 if (hopList.length >= 1) {
111 return hopList[0];
112 }
113 }
114 return defaultAddress;
115 }
116
117 @Extension
118 public static final class DescriptorImpl extends CrumbIssuerDescriptor<DefaultCrumbIssuer> implements ModelObject {
119
120 public DescriptorImpl() {
121 // salt just needs to be unique, and it doesn't have to be a secret
122 super(Jenkins.getInstance().getLegacyInstanceId(), System.getProperty("hudson.security.csrf.requestfield", ".crumb"));
123 load();
124 }
125
126 @Override
127 public String getDisplayName() {
128 return Messages.DefaultCrumbIssuer_DisplayName();
129 }
130
131 @Override
132 public DefaultCrumbIssuer newInstance(StaplerRequest req, JSONObject formData) throws FormException {
133 return req.bindJSON(DefaultCrumbIssuer.class, formData);
134 }
135 }
136
137 private static final Logger LOGGER = Logger.getLogger(DefaultCrumbIssuer.class.getName());
138 }
139