From 7e51550ee0228996eb87e366e8986047566265bc Mon Sep 17 00:00:00 2001 From: Darran Lofthouse Date: Thu, 2 Oct 2014 12:15:24 +0100 Subject: [PATCH 01/26] Next is 1.0.2.Final --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index e944531..83562c5 100644 --- a/pom.xml +++ b/pom.xml @@ -6,7 +6,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.1.Final + 1.0.2.Final-SNAPSHOT org.jboss From 55e24fd8fce378b02fa03b385576ca5f845288f1 Mon Sep 17 00:00:00 2001 From: Darran Lofthouse Date: Thu, 2 Oct 2014 12:22:22 +0100 Subject: [PATCH 02/26] bz1052821 As this is the server side we do not need to provide a hint to the SSLEngine as to what is connecting, if a SSLSession is going to be re-used that would be decided on the client side. --- src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java b/src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java index 94cb90c..4f6beb4 100644 --- a/src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java +++ b/src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java @@ -70,7 +70,8 @@ class SSLStreams { this.chan= chan; InetSocketAddress addr = (InetSocketAddress)chan.socket().getRemoteSocketAddress(); - engine = sslctx.createSSLEngine (addr.getHostName(), addr.getPort()); + // This is the server side of the connection so we do not need to hint as to the clients address. + engine = sslctx.createSSLEngine (); engine.setUseClientMode (false); HttpsConfigurator cfg = server.getHttpsConfigurator(); configureEngine (cfg, addr); From b86492615d5944612b3fbee8a20a9b83d7293db8 Mon Sep 17 00:00:00 2001 From: Darran Lofthouse Date: Thu, 2 Oct 2014 12:23:59 +0100 Subject: [PATCH 03/26] bz1148565 The idle timeout is supposed to be 5 minutes, not 30 seconds. This gives client browsers an opportunity to handle their own keep-alive timeouts allowing for SSLSession re-use on re-establishment of the connection. --- src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java b/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java index a3ef60d..35359da 100644 --- a/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java +++ b/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java @@ -40,7 +40,7 @@ class ServerConfig { static final int DEFAULT_CLOCK_TICK = 10000; // 10 sec. /* These values must be a reasonable multiple of clockTick */ - static final long DEFAULT_IDLE_INTERVAL = 30; // 5 min + static final long DEFAULT_IDLE_INTERVAL = 300; // 5 min i.e. 300 seconds. static final int DEFAULT_MAX_IDLE_CONNECTIONS = 200; static final long DEFAULT_MAX_REQ_TIME = -1; // default: forever From 89b3cf01ee0d8d5d2b6795ab9f9c6475da9f5ba0 Mon Sep 17 00:00:00 2001 From: Darran Lofthouse Date: Thu, 2 Oct 2014 17:12:14 +0100 Subject: [PATCH 04/26] bz1148532 Release 1.0.2.Final --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 83562c5..6d5580e 100644 --- a/pom.xml +++ b/pom.xml @@ -6,7 +6,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.2.Final-SNAPSHOT + 1.0.2.Final org.jboss From 9a1004e05884186f2a480465a391001b601f703a Mon Sep 17 00:00:00 2001 From: Darran Lofthouse Date: Thu, 2 Oct 2014 17:16:28 +0100 Subject: [PATCH 05/26] Next is 1.0.3.Final --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 6d5580e..827f746 100644 --- a/pom.xml +++ b/pom.xml @@ -6,7 +6,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.2.Final + 1.0.3.Final-SNAPSHOT org.jboss From 19a7e6a771be5a9619b991bab022c5066bcfc2d2 Mon Sep 17 00:00:00 2001 From: Darran Lofthouse Date: Wed, 22 Oct 2014 11:32:31 +0100 Subject: [PATCH 06/26] bz1155531 Only call setWantClientAuth and setNeedClientAuth if actually going to be setting to true. --- .../java/org/jboss/sun/net/httpserver/SSLStreams.java | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java b/src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java index 4f6beb4..91b321e 100644 --- a/src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java +++ b/src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java @@ -97,8 +97,12 @@ private void configureEngine(HttpsConfigurator cfg, InetSocketAddress addr){ ); } catch (IllegalArgumentException e) { /* LOG */} } - engine.setNeedClientAuth (params.getNeedClientAuth()); - engine.setWantClientAuth (params.getWantClientAuth()); + if (params.getNeedClientAuth()) { + engine.setNeedClientAuth (true); + } + if (params.getWantClientAuth()) { + engine.setWantClientAuth (true); + } if (params.getProtocols() != null) { try { engine.setEnabledProtocols ( From 94920a53050ee9dd7c6c08c514073b988dbda3df Mon Sep 17 00:00:00 2001 From: Darran Lofthouse Date: Wed, 22 Oct 2014 11:37:57 +0100 Subject: [PATCH 07/26] bz1155532 Set version for 1.0.3.Final release. --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 827f746..bccf148 100644 --- a/pom.xml +++ b/pom.xml @@ -6,7 +6,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.3.Final-SNAPSHOT + 1.0.3.Final org.jboss From c409920f7bf4d6fd95f4badd1fb012cee4e92c41 Mon Sep 17 00:00:00 2001 From: Darran Lofthouse Date: Wed, 22 Oct 2014 12:33:26 +0100 Subject: [PATCH 08/26] Next is 1.0.4.Final --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index bccf148..7fd3b97 100644 --- a/pom.xml +++ b/pom.xml @@ -6,7 +6,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.3.Final + 1.0.4.Final-SNAPSHOT org.jboss From abeba1358a691f96bacb435f8af444634360bb1e Mon Sep 17 00:00:00 2001 From: Darran Lofthouse Date: Wed, 19 Nov 2014 10:22:52 +0000 Subject: [PATCH 09/26] bz1165595 Relax restriction on request headers being unmodifiable to chaining can be used correctly. --- src/main/java/org/jboss/sun/net/httpserver/ExchangeImpl.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/jboss/sun/net/httpserver/ExchangeImpl.java b/src/main/java/org/jboss/sun/net/httpserver/ExchangeImpl.java index 9096c76..2109a0e 100644 --- a/src/main/java/org/jboss/sun/net/httpserver/ExchangeImpl.java +++ b/src/main/java/org/jboss/sun/net/httpserver/ExchangeImpl.java @@ -115,7 +115,7 @@ class ExchangeImpl { } public Headers getRequestHeaders () { - return new UnmodifiableHeaders (reqHdrs); + return reqHdrs; } public Headers getResponseHeaders () { @@ -137,7 +137,7 @@ public HttpContextImpl getHttpContext (){ private boolean isHeadRequest() { return HEAD.equals(getRequestMethod()); } - + public ServerConfig getServerConfig() { return server.getServerConfig(); } From 00c79babc9f46bb681117a67b34d9c97014d4af7 Mon Sep 17 00:00:00 2001 From: Darran Lofthouse Date: Wed, 19 Nov 2014 10:31:31 +0000 Subject: [PATCH 10/26] bz1165597 Set version to 1.0.4.Final --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 7fd3b97..56cfac0 100644 --- a/pom.xml +++ b/pom.xml @@ -6,7 +6,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.4.Final-SNAPSHOT + 1.0.4.Final org.jboss From ce2e5def4243bf03a88682ac417b64cc7d039f54 Mon Sep 17 00:00:00 2001 From: Darran Lofthouse Date: Wed, 19 Nov 2014 10:32:24 +0000 Subject: [PATCH 11/26] Next is 1.0.5.Final --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 56cfac0..86e7e75 100644 --- a/pom.xml +++ b/pom.xml @@ -6,7 +6,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.4.Final + 1.0.5.Final-SNAPSHOT org.jboss From aa59c52625650bbe5c28b93c06397d99d3b03d5b Mon Sep 17 00:00:00 2001 From: Chao Wang Date: Tue, 15 Sep 2015 12:27:47 +0800 Subject: [PATCH 12/26] CVE-2015-5220 limit http request header size --- src/main/java/org/jboss/sun/net/httpserver/Request.java | 4 ++++ .../java/org/jboss/sun/net/httpserver/ServerConfig.java | 9 +++++++++ 2 files changed, 13 insertions(+) diff --git a/src/main/java/org/jboss/sun/net/httpserver/Request.java b/src/main/java/org/jboss/sun/net/httpserver/Request.java index cc409b3..ab59035 100644 --- a/src/main/java/org/jboss/sun/net/httpserver/Request.java +++ b/src/main/java/org/jboss/sun/net/httpserver/Request.java @@ -178,6 +178,10 @@ Headers headers () throws IOException { c = ' '; break; } + if (s.length >= ServerConfig.getMaxReqHeaderSize()) { + throw new IOException("Maximum size of request header (" + + "sun.net.httpserver.maxReqHeaderSize) exceeded, " + ServerConfig.getMaxReqHeaderSize() + "."); + } if (len >= s.length) { char ns[] = new char[s.length * 2]; System.arraycopy(s, 0, ns, 0, len); diff --git a/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java b/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java index 35359da..c27bd85 100644 --- a/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java +++ b/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java @@ -48,11 +48,15 @@ class ServerConfig { static final long DEFAULT_TIMER_MILLIS = 1000; static final long DEFAULT_DRAIN_AMOUNT = 64 * 1024; + static final long DEFAULT_MAX_REQ_HEADER_SIZE = 8192; final long idleInterval; final long drainAmount; // max # of bytes to drain from an inputstream final int maxIdleConnections; + // The maximum size of request header allowable + private static long maxReqHeaderSize; + // max time a request or response is allowed to take final long maxReqTime; final long maxRspTime; @@ -68,6 +72,7 @@ public ServerConfig(Map configuration) { clockTick = getIntegerProperty(configuration, "sun.net.httpserver.clockTick", DEFAULT_CLOCK_TICK); maxIdleConnections = getIntegerProperty(configuration, "sun.net.httpserver.maxIdleConnections", DEFAULT_MAX_IDLE_CONNECTIONS); drainAmount = getLongProperty(configuration, "sun.net.httpserver.drainAmount", DEFAULT_DRAIN_AMOUNT); + maxReqHeaderSize = getLongProperty(configuration, "sun.net.httpserver.maxReqHeaderSize", DEFAULT_MAX_REQ_HEADER_SIZE); maxReqTime = getLongProperty(configuration, "sun.net.httpserver.maxReqTime", DEFAULT_MAX_REQ_TIME); maxRspTime = getLongProperty(configuration, "sun.net.httpserver.maxRspTime", DEFAULT_MAX_RSP_TIME); timerMillis = getLongProperty(configuration, "sun.net.httpserver.timerMillis", DEFAULT_TIMER_MILLIS); @@ -117,6 +122,10 @@ long getDrainAmount() { return drainAmount; } + public static long getMaxReqHeaderSize() { + return maxReqHeaderSize; + } + long getMaxReqTime() { return maxReqTime; } From ea52321496ea17c42ab1d0511c3775205df845cf Mon Sep 17 00:00:00 2001 From: Chao Wang Date: Tue, 15 Sep 2015 12:28:28 +0800 Subject: [PATCH 13/26] CVE-2011-5035 limit http request headers number --- .../java/org/jboss/sun/net/httpserver/Request.java | 8 +++++++- .../org/jboss/sun/net/httpserver/ServerConfig.java | 10 +++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/jboss/sun/net/httpserver/Request.java b/src/main/java/org/jboss/sun/net/httpserver/Request.java index ab59035..52707fd 100644 --- a/src/main/java/org/jboss/sun/net/httpserver/Request.java +++ b/src/main/java/org/jboss/sun/net/httpserver/Request.java @@ -209,7 +209,13 @@ Headers headers () throws IOException { v = new String(); else v = String.copyValueOf(s, keyend, len - keyend); - hdrs.add (k,v); + + if (hdrs.size() >= ServerConfig.getMaxReqHeaders()) { + throw new IOException("Maximum number of request headers (" + "sun.net.httpserver.maxReqHeaders) exceeded, " + + ServerConfig.getMaxReqHeaders() + "."); + } + + hdrs.add(k, v); len = 0; } return hdrs; diff --git a/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java b/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java index c27bd85..2a83d69 100644 --- a/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java +++ b/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java @@ -49,6 +49,7 @@ class ServerConfig { static final long DEFAULT_DRAIN_AMOUNT = 64 * 1024; static final long DEFAULT_MAX_REQ_HEADER_SIZE = 8192; + static final int DEFAULT_MAX_REQ_HEADERS = 200; final long idleInterval; final long drainAmount; // max # of bytes to drain from an inputstream @@ -56,6 +57,8 @@ class ServerConfig { // The maximum size of request header allowable private static long maxReqHeaderSize; + // The maximum number of request headers allowable + private static long maxReqHeaders; // max time a request or response is allowed to take final long maxReqTime; @@ -73,6 +76,7 @@ public ServerConfig(Map configuration) { maxIdleConnections = getIntegerProperty(configuration, "sun.net.httpserver.maxIdleConnections", DEFAULT_MAX_IDLE_CONNECTIONS); drainAmount = getLongProperty(configuration, "sun.net.httpserver.drainAmount", DEFAULT_DRAIN_AMOUNT); maxReqHeaderSize = getLongProperty(configuration, "sun.net.httpserver.maxReqHeaderSize", DEFAULT_MAX_REQ_HEADER_SIZE); + maxReqHeaders = getLongProperty(configuration, "sun.net.httpserver.maxReqHeaders", DEFAULT_MAX_REQ_HEADERS); maxReqTime = getLongProperty(configuration, "sun.net.httpserver.maxReqTime", DEFAULT_MAX_REQ_TIME); maxRspTime = getLongProperty(configuration, "sun.net.httpserver.maxRspTime", DEFAULT_MAX_RSP_TIME); timerMillis = getLongProperty(configuration, "sun.net.httpserver.timerMillis", DEFAULT_TIMER_MILLIS); @@ -122,10 +126,14 @@ long getDrainAmount() { return drainAmount; } - public static long getMaxReqHeaderSize() { + static long getMaxReqHeaderSize() { return maxReqHeaderSize; } + static long getMaxReqHeaders() { + return maxReqHeaders; + } + long getMaxReqTime() { return maxReqTime; } From af7a397f4e7203fb37a51f00ca7e465da5e003bf Mon Sep 17 00:00:00 2001 From: Chao Wang Date: Tue, 15 Sep 2015 15:19:05 +0800 Subject: [PATCH 14/26] set DEFAULT_MAX_REQ_HEADER_SIZE to 1024 * 1024 --- src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java b/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java index 2a83d69..56e48fb 100644 --- a/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java +++ b/src/main/java/org/jboss/sun/net/httpserver/ServerConfig.java @@ -48,7 +48,7 @@ class ServerConfig { static final long DEFAULT_TIMER_MILLIS = 1000; static final long DEFAULT_DRAIN_AMOUNT = 64 * 1024; - static final long DEFAULT_MAX_REQ_HEADER_SIZE = 8192; + static final long DEFAULT_MAX_REQ_HEADER_SIZE = 1024 * 1024; static final int DEFAULT_MAX_REQ_HEADERS = 200; final long idleInterval; From a7a3b886c7fb24b5cd1caf05bb620d6fc3f30d75 Mon Sep 17 00:00:00 2001 From: Carlo de Wolf Date: Tue, 15 Sep 2015 11:45:35 +0200 Subject: [PATCH 15/26] Prepare for maven release --- pom.xml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 86e7e75..72f1e22 100644 --- a/pom.xml +++ b/pom.xml @@ -11,7 +11,7 @@ org.jboss jboss-parent - 5 + 16 Lightweight HTTP Server @@ -47,4 +47,10 @@ + + + scm:git:https://github.com/jbossas/httpserver.git + scm:git:git@github.com:jbossas/httpserver.git + https://github.com/jbossas/httpserver + From b9d646b77dfca1f107757d2b9831f3165e9d597a Mon Sep 17 00:00:00 2001 From: Carlo de Wolf Date: Tue, 15 Sep 2015 12:37:03 +0200 Subject: [PATCH 16/26] [maven-release-plugin] prepare release 1.0.5.Final --- pom.xml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/pom.xml b/pom.xml index 72f1e22..2dc5cb0 100644 --- a/pom.xml +++ b/pom.xml @@ -1,12 +1,10 @@ - + 4.0.0 org.jboss.com.sun.httpserver httpserver - 1.0.5.Final-SNAPSHOT + 1.0.5.Final org.jboss @@ -52,5 +50,6 @@ scm:git:https://github.com/jbossas/httpserver.git scm:git:git@github.com:jbossas/httpserver.git https://github.com/jbossas/httpserver - + 1.0.5.Final + From 437d9541c280347819b6fb17330336175a626727 Mon Sep 17 00:00:00 2001 From: Carlo de Wolf Date: Tue, 15 Sep 2015 12:37:07 +0200 Subject: [PATCH 17/26] [maven-release-plugin] prepare for next development iteration --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 2dc5cb0..dafd8d5 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.5.Final + 1.0.6.Final-SNAPSHOT org.jboss @@ -50,6 +50,6 @@ scm:git:https://github.com/jbossas/httpserver.git scm:git:git@github.com:jbossas/httpserver.git https://github.com/jbossas/httpserver - 1.0.5.Final + HEAD From 68f10eda884972496814fb0ad675ae3349f635ad Mon Sep 17 00:00:00 2001 From: Aaron Ogburn Date: Thu, 8 Oct 2015 14:24:07 -0400 Subject: [PATCH 18/26] [BZ-1269979] return a -1 for an SSLStream eof instead of 0 --- .../java/org/jboss/sun/net/httpserver/SSLStreams.java | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java b/src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java index 91b321e..6e9f069 100644 --- a/src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java +++ b/src/main/java/org/jboss/sun/net/httpserver/SSLStreams.java @@ -523,7 +523,7 @@ public int read (byte[] buf, int off, int len) throws IOException { throw new IOException ("SSL stream is closed"); } if (eof) { - return 0; + return -1; } int available=0; if (!needData) { @@ -536,7 +536,7 @@ public int read (byte[] buf, int off, int len) throws IOException { bbuf = r.buf== bbuf? bbuf: r.buf; if ((available=bbuf.remaining()) == 0) { eof = true; - return 0; + return -1; } else { needData = false; } @@ -567,7 +567,7 @@ public long skip (long s) throws IOException { throw new IOException ("SSL stream is closed"); } if (eof) { - return 0; + return -1; } int ret = n; while (n > 0) { @@ -602,7 +602,7 @@ public int read (byte[] buf) throws IOException { public int read () throws IOException { int n = read (single, 0, 1); - if (n == 0) { + if (n == 0 || n == -1) { return -1; } else { return single[0] & 0xFF; From 109b95b1d7923db1c6bed713817955186084be73 Mon Sep 17 00:00:00 2001 From: Ivo Studensky Date: Mon, 14 Dec 2015 13:28:21 +0100 Subject: [PATCH 19/26] [maven-release-plugin] prepare release 1.0.6.Final --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index dafd8d5..cc6ddde 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.6.Final-SNAPSHOT + 1.0.6.Final org.jboss @@ -50,6 +50,6 @@ scm:git:https://github.com/jbossas/httpserver.git scm:git:git@github.com:jbossas/httpserver.git https://github.com/jbossas/httpserver - HEAD + 1.0.6.Final From b88d2ee53cb3d24c95f86a00ed7da2e929132256 Mon Sep 17 00:00:00 2001 From: Ivo Studensky Date: Mon, 14 Dec 2015 13:28:26 +0100 Subject: [PATCH 20/26] [maven-release-plugin] prepare for next development iteration --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index cc6ddde..497a01e 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.6.Final + 1.0.7.Final-SNAPSHOT org.jboss @@ -50,6 +50,6 @@ scm:git:https://github.com/jbossas/httpserver.git scm:git:git@github.com:jbossas/httpserver.git https://github.com/jbossas/httpserver - 1.0.6.Final + HEAD From 8918b826268dff32f3ff9dfb768ed49c0c38569a Mon Sep 17 00:00:00 2001 From: Bartosz Spyrko-Smietanko Date: Wed, 24 Feb 2016 16:46:10 +0000 Subject: [PATCH 21/26] BZ1270708 Allow using different encoding based on User-Agent --- .../net/httpserver/BasicAuthenticator.java | 40 ++++- .../com/sun/net/httpserver/BZ1312064.java | 152 ++++++++++++++++++ 2 files changed, 191 insertions(+), 1 deletion(-) create mode 100644 src/test/java/org/jboss/com/sun/net/httpserver/BZ1312064.java diff --git a/src/main/java/org/jboss/com/sun/net/httpserver/BasicAuthenticator.java b/src/main/java/org/jboss/com/sun/net/httpserver/BasicAuthenticator.java index f2f301e..0cfd4bb 100644 --- a/src/main/java/org/jboss/com/sun/net/httpserver/BasicAuthenticator.java +++ b/src/main/java/org/jboss/com/sun/net/httpserver/BasicAuthenticator.java @@ -25,6 +25,12 @@ package org.jboss.com.sun.net.httpserver; +import java.nio.charset.Charset; +import java.util.Collections; +import java.util.HashMap; +import java.util.Map; +import java.util.regex.Pattern; + /** * BasicAuthenticator provides an implementation of HTTP Basic * authentication. It is an abstract class and must be extended @@ -33,15 +39,35 @@ */ public abstract class BasicAuthenticator extends Authenticator { + public static final Charset DEFAULT_CHARSET = Charset.forName("UTF-8"); protected String realm; + private Map browserCharsetMap; + private Charset defaultCharset; + /** * Creates a BasicAuthenticator for the given HTTP realm * @param realm The HTTP Basic authentication realm * @throws NullPointerException if the realm is an empty string */ public BasicAuthenticator (String realm) { + this(realm, DEFAULT_CHARSET, Collections.emptyMap()); + } + + /** + * Creates a BasicAuthenticator for the given HTTP realm. + * + * browserCharsetMap is used to specify a character encoding used to decode BASIC authentication response depending + * on the browser that issued it. + * + * @param realm The HTTP Basic authentication realm + * @param defaultCharset charset that should be used to decode credentials if the user agent is not listed in browserCharsetMap + * @param browserCharsetMap map indexed by Patterns representing User-Agent strings with the charset as values + */ + public BasicAuthenticator (String realm, Charset defaultCharset, Map browserCharsetMap) { this.realm = realm; + this.defaultCharset = defaultCharset; + this.browserCharsetMap = Collections.unmodifiableMap(new HashMap(browserCharsetMap)); } /** @@ -69,7 +95,19 @@ public Result authenticate (HttpExchange t) return new Authenticator.Failure (401); } byte[] b = Base64.base64ToByteArray (auth.substring(sp+1)); - String userpass = new String (b); + + Charset charset = DEFAULT_CHARSET; + if (!browserCharsetMap.isEmpty()) { + String userAgent = rmap.getFirst("User-Agent"); + for (Map.Entry entry : browserCharsetMap.entrySet()) { + if (entry.getKey().matcher(userAgent).matches()) { + charset = entry.getValue(); + } + } + + } + + String userpass = new String (b, charset); int colon = userpass.indexOf (':'); String uname = userpass.substring (0, colon); String pass = userpass.substring (colon+1); diff --git a/src/test/java/org/jboss/com/sun/net/httpserver/BZ1312064.java b/src/test/java/org/jboss/com/sun/net/httpserver/BZ1312064.java new file mode 100644 index 0000000..f9c1b2b --- /dev/null +++ b/src/test/java/org/jboss/com/sun/net/httpserver/BZ1312064.java @@ -0,0 +1,152 @@ +/* + * Copyright (c) 2005, 2006, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +package org.jboss.com.sun.net.httpserver; + +import org.junit.After; +import org.junit.AfterClass; +import org.junit.Assert; +import org.junit.BeforeClass; +import org.junit.Test; + +import java.io.IOException; +import java.net.HttpURLConnection; +import java.net.InetSocketAddress; +import java.net.URL; +import java.nio.charset.Charset; +import java.util.HashMap; +import java.util.Map; +import java.util.concurrent.ExecutorService; +import java.util.concurrent.Executors; +import java.util.regex.Pattern; + +public class BZ1312064 { + + private static HttpServer server; + private static ExecutorService executor; + private static SimpleAuthenticator authenticator; + private static Map browserCharsetMap = new HashMap(); + + static { + browserCharsetMap.put(Pattern.compile(".*Firefox.*"), Charset.forName("8859_1")); + } + + // set up one server instance for all tests to speed things up + @BeforeClass + public static void setUpServer() throws Exception { + Handler handler = new Handler(); + InetSocketAddress addr = new InetSocketAddress (0); + server = HttpServer.create (addr, 0); + HttpContext ctx = server.createContext ("/test", handler); + + authenticator = new SimpleAuthenticator(); + ctx.setAuthenticator (authenticator); + executor = Executors.newCachedThreadPool(); + server.setExecutor (executor); + server.start (); + } + + @AfterClass + public static void shutDownServer() { + server.stop(2); + executor.shutdown(); + } + + @After + public void cleanUpAllowedCredentials() { + authenticator.purge(); + } + + @Test + public void testASCIIPassword() throws Exception { + authenticator.accept("fred", "xyz"); + + final int responseCode = makeCall("fred", "xyz", null, "UTF-8"); + + Assert.assertEquals(HttpURLConnection.HTTP_OK, responseCode); + } + + @Test + public void testNonAsciiPasswordOnUtf8Browser() throws Exception { + authenticator.accept("fred", "test123!ü"); + + final int responseCode = makeCall("fred", "test123!ü", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36", "UTF-8"); + + Assert.assertEquals(HttpURLConnection.HTTP_OK, responseCode); + } + + @Test + public void testNonAsciiPasswordOnIso8859Browser() throws Exception { + authenticator.accept("fred", "test123!ü"); + + final int responseCode = makeCall("fred", "test123!ü", "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1", "8859_1"); + + Assert.assertEquals(HttpURLConnection.HTTP_OK, responseCode); + } + + private int makeCall(String username, String password, String userAgent, String encoding) throws IOException { + URL url = new URL ("http://localhost:"+server.getAddress().getPort()+"/test/foo.html"); + HttpURLConnection urlc = (HttpURLConnection)url.openConnection (); + + final String encodedCredentials = Base64.byteArrayToBase64((username + ":" + password).getBytes(encoding)); + urlc.addRequestProperty("Authorization", "Basic " + encodedCredentials); + if (userAgent != null) { + urlc.addRequestProperty("User-Agent", userAgent); + } + urlc.setRequestMethod("GET"); + + return urlc.getResponseCode(); + } + + public static boolean error = false; + + + static class SimpleAuthenticator extends BasicAuthenticator { + private Map acceptedCredentials = new HashMap(); + + SimpleAuthenticator() { + super ("foobar@test.realm", Charset.forName("UTF-8"), BZ1312064.browserCharsetMap); + } + + public boolean checkCredentials (String username, String pw) { + return acceptedCredentials.containsKey(username) && acceptedCredentials.get(username).equals(pw); + } + + public void accept(String username, String password) { + acceptedCredentials.put(username, password); + } + + public void purge() { + acceptedCredentials.clear(); + } + } + + static class Handler implements HttpHandler { + public void handle (HttpExchange t) + throws IOException + { + t.sendResponseHeaders (200, -1); + t.close(); + } + } +} From 2edd25e6fce65176c48b728a3e84555d608163c7 Mon Sep 17 00:00:00 2001 From: Carlo de Wolf Date: Wed, 27 Jul 2016 17:49:04 +0200 Subject: [PATCH 22/26] [maven-release-plugin] prepare release 1.0.7.Final --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 497a01e..8da1c73 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.7.Final-SNAPSHOT + 1.0.7.Final org.jboss @@ -50,6 +50,6 @@ scm:git:https://github.com/jbossas/httpserver.git scm:git:git@github.com:jbossas/httpserver.git https://github.com/jbossas/httpserver - HEAD + 1.0.7.Final From 9a055948f3a0e2db6ec0d73773fb4fb0ab4bdf3d Mon Sep 17 00:00:00 2001 From: Carlo de Wolf Date: Wed, 27 Jul 2016 17:49:10 +0200 Subject: [PATCH 23/26] [maven-release-plugin] prepare for next development iteration --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 8da1c73..7ee9f28 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.7.Final + 1.0.8.Final-SNAPSHOT org.jboss @@ -50,6 +50,6 @@ scm:git:https://github.com/jbossas/httpserver.git scm:git:git@github.com:jbossas/httpserver.git https://github.com/jbossas/httpserver - 1.0.7.Final + HEAD From 3883cf492d1c8ced637fd47439fe7b75342ab51f Mon Sep 17 00:00:00 2001 From: Masafumi Miura Date: Sat, 4 Feb 2017 05:04:39 +0900 Subject: [PATCH 24/26] BZ1417653 NullPointerException on missing user-agent in the request --- .../jboss/com/sun/net/httpserver/BasicAuthenticator.java | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/main/java/org/jboss/com/sun/net/httpserver/BasicAuthenticator.java b/src/main/java/org/jboss/com/sun/net/httpserver/BasicAuthenticator.java index 0cfd4bb..348e926 100644 --- a/src/main/java/org/jboss/com/sun/net/httpserver/BasicAuthenticator.java +++ b/src/main/java/org/jboss/com/sun/net/httpserver/BasicAuthenticator.java @@ -99,12 +99,13 @@ public Result authenticate (HttpExchange t) Charset charset = DEFAULT_CHARSET; if (!browserCharsetMap.isEmpty()) { String userAgent = rmap.getFirst("User-Agent"); - for (Map.Entry entry : browserCharsetMap.entrySet()) { - if (entry.getKey().matcher(userAgent).matches()) { - charset = entry.getValue(); + if (userAgent != null) { + for (Map.Entry entry : browserCharsetMap.entrySet()) { + if (entry.getKey().matcher(userAgent).matches()) { + charset = entry.getValue(); + } } } - } String userpass = new String (b, charset); From 4336edcf1dbcb94f152be149492846db61109c21 Mon Sep 17 00:00:00 2001 From: Carlo de Wolf Date: Thu, 23 Mar 2017 09:56:30 +0100 Subject: [PATCH 25/26] [maven-release-plugin] prepare release 1.0.8.Final --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 7ee9f28..f42c160 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.8.Final-SNAPSHOT + 1.0.8.Final org.jboss @@ -50,6 +50,6 @@ scm:git:https://github.com/jbossas/httpserver.git scm:git:git@github.com:jbossas/httpserver.git https://github.com/jbossas/httpserver - HEAD + 1.0.8.Final From 54a58ba95d5b47dc04e0ce047ab4c4b83811c381 Mon Sep 17 00:00:00 2001 From: Carlo de Wolf Date: Thu, 23 Mar 2017 09:56:37 +0100 Subject: [PATCH 26/26] [maven-release-plugin] prepare for next development iteration --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index f42c160..fc994cb 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.jboss.com.sun.httpserver httpserver - 1.0.8.Final + 1.0.9.Final-SNAPSHOT org.jboss @@ -50,6 +50,6 @@ scm:git:https://github.com/jbossas/httpserver.git scm:git:git@github.com:jbossas/httpserver.git https://github.com/jbossas/httpserver - 1.0.8.Final + HEAD