Basic support for url parameter validation

fhessel · fhessel · commit 3640f6cf6454 · 2018-11-10T01:50:39.000+01:00
diff --git a/src/HTTPConnection.cpp b/src/HTTPConnection.cpp
@@ -446,7 +446,7 @@ void HTTPConnection::loop() {
 					}
 
 					// Create request context
-					HTTPRequest req  = HTTPRequest(this, _httpHeaders, resolvedResource.getParams(), _httpResource, _httpMethod, resolvedResource.getMatchingNode()->_tag);
+					HTTPRequest req  = HTTPRequest(this, _httpHeaders, resolvedResource.getMatchingNode(), resolvedResource.getParams(), _httpResource);
 					HTTPResponse res = HTTPResponse(this);
 
 					// Add default headers to the response
@@ -477,6 +477,10 @@ void HTTPConnection::loop() {
 						next = std::function<void()>(std::bind((*itMw), &req, &res, next));
 						itMw++;
 					}
+
+					// We insert the internal validation middleware at the start of the chain:
+					next = std::function<void()>(std::bind(&validationMiddleware, &req, &res, next));
+
  					// Call the whole chain
 					next();
 
@@ -581,6 +585,32 @@ bool HTTPConnection::checkWebsocket() {
 	   	return false;
 }
 
+/**
+ * Middleware function that handles the validation of parameters
+ */
+void validationMiddleware(HTTPRequest * req, HTTPResponse * res, std::function<void()> next) {
+	bool valid = true;
+	// Get the matched node
+	HTTPNode * node = req->getResolvedNode();
+	// Get the parameters
+	ResourceParameters * params = req->getParams();
+
+	// Iterate over the validators and run them
+	std::vector<HTTPValidator*> * validators = node->getValidators();
+	for(std::vector<HTTPValidator*>::iterator validator = validators->begin(); valid && validator != validators->end(); ++validator) {
+		std::string param = params->getUrlParameter((*validator)->_idx);
+    valid = ((*validator)->_validatorFunction)(param);
+	}
+
+	if (valid) {
+		next();
+	} else {
+		res->setStatusCode(400);
+		res->setStatusText("Bad Request");
+		res->print("400 Bad Request");
+	}
+}
+
 /**
  * Handler function for the websocket handshake. Will be used by HTTPConnection if a websocket is detected
  */
diff --git a/src/HTTPConnection.hpp b/src/HTTPConnection.hpp
@@ -163,6 +163,8 @@ void handleWebsocketHandshake(HTTPRequest * req, HTTPResponse * res);
 
 std::string websocketKeyResponseHash(std::string key);
 
+void validationMiddleware(HTTPRequest * req, HTTPResponse * res, std::function<void()> next);
+
 } /* namespace httpsserver */
 
 #endif /* SRC_HTTPCONNECTION_HPP_ */
diff --git a/src/HTTPNode.cpp b/src/HTTPNode.cpp
@@ -7,6 +7,9 @@ namespace httpsserver {
     _tag(std::move(tag)),
     _nodeType(nodeType) {
 
+    // Create vector for valdiators
+    _validators = new std::vector<HTTPValidator*>();
+
     // Count the parameters
     _urlParamCount = 0;
     size_t idx = 0;
@@ -32,6 +35,12 @@ namespace httpsserver {
     if (_urlParamIdx != NULL) {
       delete[] _urlParamIdx;
     }
+
+    // Delete validator references
+    for(std::vector<HTTPValidator*>::iterator validator = _validators->begin(); validator != _validators->end(); ++validator) {
+      delete *validator;
+    }
+    delete _validators;
   }
 
   bool HTTPNode::hasUrlParameter() {
@@ -49,4 +58,12 @@ namespace httpsserver {
   uint8_t HTTPNode::getUrlParamCount() {
     return _urlParamCount;
   }
+
+  void HTTPNode::addURLParamValidator(uint8_t paramIdx, const HTTPValidationFunction * validator) {
+    _validators->push_back(new HTTPValidator(paramIdx, validator));
+  }
+
+	std::vector<HTTPValidator*> * HTTPNode::getValidators() {
+    return _validators;
+  }
 }
diff --git a/src/HTTPNode.hpp b/src/HTTPNode.hpp
@@ -3,6 +3,10 @@
 
 #include <Arduino.h>
 #include <string>
+#undef min
+#undef max
+#include <vector>
+#include "HTTPValidator.hpp"
 
 namespace httpsserver {
 
@@ -37,9 +41,21 @@ class HTTPNode {
 	uint8_t getUrlParamCount();
 	size_t getParamIdx(uint8_t);
 
+	std::vector<HTTPValidator*> * getValidators();
+
+	virtual std::string getMethod() = 0;
+
+	/**
+	 * Adds a validation function that checks if the actual value of a parameter matches the expectation
+	 * @param paramIdx defines the ID of the parameter that should be checked (starts by 0)
+	 * @param validator the function (string -> bool) that checks if the parameter matches the expecatation
+	 */
+	void addURLParamValidator(uint8_t paramIdx, const HTTPValidationFunction * validator);
+
 private:
 	uint8_t _urlParamCount;
 	size_t * _urlParamIdx;
+	std::vector<HTTPValidator*> * _validators;
 };
 
 } // namespace httpserver
diff --git a/src/HTTPRequest.cpp b/src/HTTPRequest.cpp
@@ -2,13 +2,17 @@
 
 namespace httpsserver {
 
-HTTPRequest::HTTPRequest(ConnectionContext * con, HTTPHeaders * headers, ResourceParameters * params, std::string requestString, std::string method, std::string tag):
+HTTPRequest::HTTPRequest(
+		ConnectionContext * con,
+		HTTPHeaders * headers,
+		HTTPNode * resolvedNode,
+		ResourceParameters * params,
+		std::string requestString):
 	_con(con),
 	_headers(headers),
+	_resolvedNode(resolvedNode),
 	_params(params),
-	_requestString(requestString),
-	_method(method),
-	_tag(tag) {
+	_requestString(requestString) {
 
 	HTTPHeader * contentLength = headers->get("Content-Length");
 	if (contentLength == NULL) {
@@ -43,6 +47,10 @@ void HTTPRequest::setHeader(std::string name, std::string value) {
 	_headers->set(new HTTPHeader(name, value));
 }
 
+HTTPNode * HTTPRequest::getResolvedNode() {
+	return _resolvedNode;
+}
+
 size_t HTTPRequest::readBytes(byte * buffer, size_t length) {
 
 	// Limit reading to content length
@@ -72,11 +80,11 @@ std::string HTTPRequest::getRequestString() {
 }
 
 std::string HTTPRequest::getMethod() {
-	return _method;
+	return _resolvedNode->getMethod();
 }
 
 std::string HTTPRequest::getTag() {
-	return _tag;
+	return _resolvedNode->_tag;
 }
 
 bool HTTPRequest::requestComplete() {
diff --git a/src/HTTPRequest.hpp b/src/HTTPRequest.hpp
@@ -7,6 +7,7 @@
 #include <mbedtls/base64.h>
 
 #include "ConnectionContext.hpp"
+#include "HTTPNode.hpp"
 #include "HTTPHeader.hpp"
 #include "HTTPHeaders.hpp"
 #include "ResourceParameters.hpp"
@@ -16,11 +17,12 @@ namespace httpsserver {
 
 class HTTPRequest {
 public:
-	HTTPRequest(ConnectionContext * con, HTTPHeaders * headers, ResourceParameters * resource, std::string requestString, std::string method, std::string tag);
+	HTTPRequest(ConnectionContext * con, HTTPHeaders * headers, HTTPNode * resolvedNode, ResourceParameters * params, std::string requestString);
 	virtual ~HTTPRequest();
 
 	std::string getHeader(std::string name);
 	void setHeader(std::string name, std::string value);
+	HTTPNode * getResolvedNode();
 	std::string getRequestString();
 	std::string getMethod();
 	std::string getTag();
@@ -43,11 +45,11 @@ class HTTPRequest {
 
 	HTTPHeaders * _headers;
 
+	HTTPNode * _resolvedNode;
+
 	ResourceParameters * _params;
 
 	std::string _requestString;
-	std::string _method;
-	std::string _tag;
 
 	bool _contentLengthSet;
 	size_t _remainingContent;
diff --git a/src/HTTPValidator.cpp b/src/HTTPValidator.cpp
@@ -0,0 +1,15 @@
+#include "HTTPValidator.hpp"
+
+namespace httpsserver {
+
+HTTPValidator::HTTPValidator(const uint8_t idx, const HTTPValidationFunction * validatorFunction):
+	_idx(idx),
+	_validatorFunction(validatorFunction)	{
+
+}
+
+HTTPValidator::~HTTPValidator() {
+
+}
+
+} /* namespace httpsserver */
diff --git a/src/HTTPValidator.hpp b/src/HTTPValidator.hpp
@@ -0,0 +1,20 @@
+#ifndef SRC_HTTPVALIDATOR_HPP_
+#define SRC_HTTPVALIDATOR_HPP_
+
+#include <string>
+
+namespace httpsserver {
+
+typedef bool (HTTPValidationFunction)(std::string);
+
+class HTTPValidator {
+public:
+	HTTPValidator(const uint8_t idx, const HTTPValidationFunction * validatorFunction);
+	virtual ~HTTPValidator();
+	const uint8_t _idx;
+	const HTTPValidationFunction * _validatorFunction;
+};
+
+} /* namespace httpsserver */
+
+#endif /* SRC_HTTPVALIDATOR_HPP_ */
diff --git a/src/ResourceNode.hpp b/src/ResourceNode.hpp
@@ -15,6 +15,7 @@ class ResourceNode : public HTTPNode {
 
 	const std::string _method;
 	const HTTPSCallbackFunction * _callback;
+	std::string getMethod() { return _method; }
 };
 
 } /* namespace httpsserver */
diff --git a/src/WebsocketNode.hpp b/src/WebsocketNode.hpp
@@ -15,6 +15,7 @@ class WebsocketNode : public HTTPNode {
 	WebsocketNode(const std::string path, const WebsocketHandlerCreator creatorFunction, const std::string tag = "");
 	virtual ~WebsocketNode();
 	WebsocketHandler* newHandler();
+	std::string getMethod() { return std::string("GET"); }
 private:
 	const WebsocketHandlerCreator * _creatorFunction;
 };
