File D:\maven-qcr-plugin-testsunitaires\qcr4java\jenkins-master\target\site\qc\core\src\main\java\hudson\security\csrf\CrumbFilter.java.html

1 /**
2 * Copyright (c) 2008-2009 Yahoo! Inc.
3 * All rights reserved.
4 * The copyrights to the contents of this file are licensed under the MIT License (http://www.opensource.org/licenses/mit-license.php)
5 */
6 package hudson.security.csrf;
7
8 import jenkins.model.Jenkins;
9
10 import java.io.IOException;
11 import java.util.Enumeration;
12 import java.util.logging.Logger;
13
14 import javax.servlet.Filter;
15 import javax.servlet.FilterChain;
16 import javax.servlet.FilterConfig;
17 import javax.servlet.ServletException;
18 import javax.servlet.ServletRequest;
19 import javax.servlet.ServletResponse;
20 import javax.servlet.http.HttpServletRequest;
21 import javax.servlet.http.HttpServletResponse;
22
23 /**
24 * Checks for and validates crumbs on requests that cause state changes, to
25 * protect against cross site request forgeries.
26 *
27 * @author dty
28 */
29 public class CrumbFilter implements Filter {
30 /**
31 * Because servlet containers generally don't specify the ordering of the initialization
32 * (and different implementations indeed do this differently --- See HUDSON-3878),
33 * we cannot use Hudson to the CrumbIssuer into CrumbFilter eagerly.
34 */
35 public CrumbIssuer getCrumbIssuer() {
36 Jenkins h = Jenkins.getInstance();
37 if(h==null) return null; // before Jenkins is initialized?
38 return h.getCrumbIssuer();
39 }
40
41 public void init(FilterConfig filterConfig) throws ServletException {
42 }
43
44 public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
45 CrumbIssuer crumbIssuer = getCrumbIssuer();
46 if (crumbIssuer == null || !(request instanceof HttpServletRequest)) {
47 chain.doFilter(request, response);
48 return;
49 }
50
51 HttpServletRequest httpRequest = (HttpServletRequest) request;
52 HttpServletResponse httpResponse = (HttpServletResponse) response;
53
54 if ("POST".equals(httpRequest.getMethod())) {
55 for (CrumbExclusion e : CrumbExclusion.all()) {
56 if (e.process(httpRequest,httpResponse,chain))
57 return;
58 }
59
60 String crumbFieldName = crumbIssuer.getDescriptor().getCrumbRequestField();
61 String crumbSalt = crumbIssuer.getDescriptor().getCrumbSalt();
62
63 String crumb = httpRequest.getHeader(crumbFieldName);
64 boolean valid = false;
65 if (crumb == null) {
66 Enumeration<?> paramNames = request.getParameterNames();
67 while (paramNames.hasMoreElements()) {
68 String paramName = (String) paramNames.nextElement();
69 if (crumbFieldName.equals(paramName)) {
70 crumb = request.getParameter(paramName);
71 break;
72 }
73 }
74 }
75 if (crumb != null) {
76 if (crumbIssuer.validateCrumb(httpRequest, crumbSalt, crumb)) {
77 valid = true;
78 } else {
79 LOGGER.warning("Found invalid crumb " + crumb +
80 ". Will check remaining parameters for a valid one...");
81 }
82 }
83 // Multipart requests need to be handled by each handler.
84 if (valid || isMultipart(httpRequest)) {
85 chain.doFilter(request, response);
86 } else {
87 LOGGER.warning("No valid crumb was included in request for " + httpRequest.getRequestURI() + ". Returning " + HttpServletResponse.SC_FORBIDDEN + ".");
88 httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN,"No valid crumb was included in the request");
89 }
90 } else {
91 chain.doFilter(request, response);
92 }
93 }
94
95 protected static boolean isMultipart(HttpServletRequest request) {
96 if (request == null) {
97 return false;
98 }
99
100 String contentType = request.getContentType();
101 if (contentType == null) {
102 return false;
103 }
104
105 String[] parts = contentType.split(";");
106 if (parts.length == 0) {
107 return false;
108 }
109
110 for (int i = 0; i < parts.length; i++) {
111 if ("multipart/form-data".equals(parts[i])) {
112 return true;
113 }
114 }
115
116 return false;
117 }
118
119 /**
120 * {@inheritDoc}
121 */
122 public void destroy() {
123 }
124
125 private static final Logger LOGGER = Logger.getLogger(CrumbFilter.class.getName());
126 }
127