eclipse-sailing-analytics/sailing-analytics
1
0
Fork 0
mirror of https://github.com/eclipse-sailing-analytics/sailing-analytics.git synced 2026-09-20 12:45:35 +00:00
Code Activity

Bug 4894: secured getFile method with in FileStorageResource for

Browse Source 
AmazonS3FileStorageServiceImpl and LocalFileStorageServiceImpl.
This commit is contained in:
Steffen Jacobs
2019-04-03 18:09:11 +02:00
parent 5a114a3666
commit ad8ecde81d
4 changed files with 31 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/FileStorageResource.java
+7 -1
View File
@@ -43,6 +43,10 @@ public class FileStorageResource extends AbstractSailingServerResource {
public Response getFile(@QueryParam("uri") String uri) {
Response response;
try {
getService().getFileStorageManagementService().getActiveFileStorageService()
.doPermissionCheckForGetFile(new URI(uri));
InputStream inputStream = new URL(uri).openStream();
ResponseBuilder responseBuilder = Response.ok().entity(inputStream);
if (uri.toLowerCase().endsWith(".jpg")) {
@@ -51,8 +55,10 @@ public class FileStorageResource extends AbstractSailingServerResource {
responseBuilder.header("Content-Type", "image/png");
}
response = responseBuilder.build();
} catch (IOException ioe) {
} catch (IOException | URISyntaxException ioe) {
response = Response.status(Status.BAD_REQUEST).entity(ioe.getMessage()).build();
} catch (UnauthorizedException e) {
response = Response.status(Status.UNAUTHORIZED).entity(e.getMessage()).build();
}
return response;
}
java/com.sap.sse.filestorage/src/com/sap/sse/filestorage/FileStorageService.java
+3
View File
@@ -55,4 +55,7 @@ public interface FileStorageService extends IsManagedByCache<FileStorageServiceR
* Test whether properties are valid, e.g. by trying to log in using access credentials provided as properties.
*/
void testProperties() throws InvalidPropertiesException, IOException;
/** Check required permissions for getfile. */
void doPermissionCheckForGetFile(URI uri) throws UnauthorizedException;
}
java/com.sap.sse.filestorage/src/com/sap/sse/filestorage/impl/AmazonS3FileStorageServiceImpl.java
+11 -1
View File
@@ -120,12 +120,13 @@ public class AmazonS3FileStorageServiceImpl extends BaseFileStorageServiceImpl i
@Override
public void removeFile(URI uri) throws InvalidPropertiesException, OperationFailedException, UnauthorizedException {
String key = uri.getPath().substring(uri.getPath().lastIndexOf("/")+1);
AmazonS3Client s3Client = createS3Client();
SecurityUtils.getSubject().checkPermission(
SecuredDomainType.FILE_STORAGE.getStringPermissionForTypeRelativeIdentifier(DefaultActions.DELETE,
new TypeRelativeObjectIdentifier(key)));
AmazonS3Client s3Client = createS3Client();
try {
s3Client.deleteObject(new DeleteObjectRequest(bucketName.getValue(), key));
} catch (AmazonClientException e) {
@@ -158,4 +159,13 @@ public class AmazonS3FileStorageServiceImpl extends BaseFileStorageServiceImpl i
bucketName, "bucket does not exist"));
}
}
@Override
public void doPermissionCheckForGetFile(URI uri) throws UnauthorizedException {
String key = uri.getPath().substring(uri.getPath().lastIndexOf("/") + 1);
SecurityUtils.getSubject().checkPermission(
SecuredDomainType.FILE_STORAGE.getStringPermissionForTypeRelativeIdentifier(DefaultActions.DELETE,
new TypeRelativeObjectIdentifier(key)));
}
}
java/com.sap.sse.filestorage/src/com/sap/sse/filestorage/impl/LocalFileStorageServiceImpl.java
+10
View File
@@ -183,4 +183,14 @@ public class LocalFileStorageServiceImpl extends BaseFileStorageServiceImpl impl
}
return value;
}
@Override
public void doPermissionCheckForGetFile(URI uri) throws UnauthorizedException {
String filePath = uri.getPath();
String fileName = filePath.substring(filePath.lastIndexOf("/") + 1);
final String pathToFile = localPath.getValue() + "/" + fileName;
SecurityUtils.getSubject().checkPermission(
SecuredDomainType.FILE_STORAGE.getStringPermissionForTypeRelativeIdentifier(DefaultActions.READ,
new TypeRelativeObjectIdentifier(pathToFile)));
}
}