From 3107cafeebc5919dc0747a31f8475812fd28b163 Mon Sep 17 00:00:00 2001 From: J Date: Tue, 19 Nov 2024 11:29:31 +0530 Subject: [PATCH 1/3] Added validations for fixing SSRF --- .../hub/channel/ProviderResource.java | 22 ++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/src/main/java/com/flightstats/hub/channel/ProviderResource.java b/src/main/java/com/flightstats/hub/channel/ProviderResource.java index 03a5973e0..89ee9166d 100644 --- a/src/main/java/com/flightstats/hub/channel/ProviderResource.java +++ b/src/main/java/com/flightstats/hub/channel/ProviderResource.java @@ -17,8 +17,10 @@ import javax.ws.rs.Produces; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; +import java.io.IOException; import java.io.InputStream; import java.util.Collection; +import java.util.regex.Pattern; /** * This is a convenience interface for external data Providers. @@ -28,6 +30,8 @@ @Path("/provider") public class ProviderResource { + private static final Pattern CHANNEL_NAME_PATTERN = Pattern.compile("^[a-zA-Z0-9_-]+$"); + private static final String ALLOWED_CONTENT_TYPES = "application/hub"; private final ChannelService channelService; private final ContentRetriever contentRetriever; @@ -80,10 +84,26 @@ public Response insertValue(@HeaderParam("channelName") final String channelName @Path("/bulk") public Response insertBulk(@HeaderParam("channelName") final String channelName, @HeaderParam("Content-Type") final String contentType, - final InputStream data) { + final InputStream data) throws IOException { try { + + // Validate channelName + if (channelName == null || !CHANNEL_NAME_PATTERN.matcher(channelName).matches()) { + return Response.status(400).entity("Invalid channel name").build(); + } + + // Validate contentType + if (contentType == null || !ALLOWED_CONTENT_TYPES.contains(contentType)) { + return Response.status(400).entity("Invalid content type").build(); + } + ensureChannel(channelName); + // Sanitize data (additional checks can be added as needed) + if (data == null || data.available() == 0) { + return Response.status(400).entity("Invalid data stream").build(); + } + BulkContent content = BulkContent.builder() .isNew(true) .contentType(contentType) From 0f1dad4ac267dcd93e8ef5b554b6de8810e76c6d Mon Sep 17 00:00:00 2001 From: J Date: Thu, 21 Nov 2024 10:30:50 +0530 Subject: [PATCH 2/3] removed data validation --- .../java/com/flightstats/hub/channel/ProviderResource.java | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/src/main/java/com/flightstats/hub/channel/ProviderResource.java b/src/main/java/com/flightstats/hub/channel/ProviderResource.java index 89ee9166d..840fa5272 100644 --- a/src/main/java/com/flightstats/hub/channel/ProviderResource.java +++ b/src/main/java/com/flightstats/hub/channel/ProviderResource.java @@ -98,12 +98,7 @@ public Response insertBulk(@HeaderParam("channelName") final String channelName, } ensureChannel(channelName); - - // Sanitize data (additional checks can be added as needed) - if (data == null || data.available() == 0) { - return Response.status(400).entity("Invalid data stream").build(); - } - + BulkContent content = BulkContent.builder() .isNew(true) .contentType(contentType) From 589e4b8bbe555056f672c65107a899a6ae490d38 Mon Sep 17 00:00:00 2001 From: J Date: Thu, 21 Nov 2024 10:39:40 +0530 Subject: [PATCH 3/3] removed data validation and changed ensurechannel --- .../java/com/flightstats/hub/channel/ProviderResource.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/java/com/flightstats/hub/channel/ProviderResource.java b/src/main/java/com/flightstats/hub/channel/ProviderResource.java index 840fa5272..f1429b631 100644 --- a/src/main/java/com/flightstats/hub/channel/ProviderResource.java +++ b/src/main/java/com/flightstats/hub/channel/ProviderResource.java @@ -87,6 +87,8 @@ public Response insertBulk(@HeaderParam("channelName") final String channelName, final InputStream data) throws IOException { try { + ensureChannel(channelName); + // Validate channelName if (channelName == null || !CHANNEL_NAME_PATTERN.matcher(channelName).matches()) { return Response.status(400).entity("Invalid channel name").build(); @@ -97,8 +99,6 @@ public Response insertBulk(@HeaderParam("channelName") final String channelName, return Response.status(400).entity("Invalid content type").build(); } - ensureChannel(channelName); - BulkContent content = BulkContent.builder() .isNew(true) .contentType(contentType)