Skip to content

Commit e154fa2

Browse files
matisovaamatisovaa
committed
MagicNumber validation
1 parent 2017093 commit e154fa2

File tree

5 files changed

+34
-123
lines changed

5 files changed

+34
-123
lines changed

‎gui/admin-gui/src/main/java/com/evolveum/midpoint/gui/impl/factory/panel/UploadDownloadPanelFactory.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
import com.evolveum.midpoint.prism.path.ItemPath;
2525
import com.evolveum.midpoint.util.DOMUtil;
2626
import com.evolveum.midpoint.web.component.input.UploadDownloadPanel;
27-
import com.evolveum.midpoint.web.component.input.validator.FileValidatorFactory;
27+
import com.evolveum.midpoint.web.component.input.validator.FileValidatorUtil;
2828
import com.evolveum.midpoint.web.component.prism.InputPanel;
2929
import com.evolveum.midpoint.xml.ns._public.common.common_3.FocusType;
3030

@@ -95,7 +95,7 @@ public List<String> getAllowedUploadContentTypes() {
9595
ItemPath path = panelCtx.getValueWrapperModel().getObject().getParent().getPath();
9696

9797
if (Objects.equals(path, ItemPath.create(FocusType.F_JPEG_PHOTO))) {
98-
return FileValidatorFactory.ALLOWED_UPLOAD_IMAGE_CONTENT_TYPES;
98+
return FileValidatorUtil.ALLOWED_UPLOAD_IMAGE_CONTENT_TYPES;
9999
}
100100

101101
return super.getAllowedUploadContentTypes();

‎gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/input/UploadDownloadPanel.java‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import java.io.Serial;
1212
import java.net.URLConnection;
1313
import java.util.ArrayList;
14+
import java.util.HexFormat;
1415
import java.util.List;
1516

1617
import jakarta.activation.MimeType;
@@ -34,7 +35,7 @@
3435
import com.evolveum.midpoint.web.component.prism.InputPanel;
3536
import com.evolveum.midpoint.web.component.util.VisibleBehaviour;
3637
import com.evolveum.midpoint.web.component.input.validator.ContentTypeFileValidator;
37-
import com.evolveum.midpoint.web.component.input.validator.FileValidatorFactory;
38+
import com.evolveum.midpoint.web.component.input.validator.FileValidatorUtil;
3839

3940
/**
4041
* @author shood
@@ -123,20 +124,32 @@ protected void onError(AjaxRequestTarget target) {
123124
}
124125

125126
final String label = fileUpload.getLabel() != null ? fileUpload.getLabel().getObject() : fileUpload.getId();
126-
final List<MimeType> allowedTypes = FileValidatorFactory.getMimeTypes(getAllowedUploadContentTypes());
127+
final List<MimeType> allowedTypes = FileValidatorUtil.getMimeTypes(getAllowedUploadContentTypes());
127128

128129
try {
129130
for (FileUpload fu : list) {
131+
final String contentType = fu.getContentType();
132+
130133
final ContentTypeFileValidator contentTypeFileValidator = new ContentTypeFileValidator(allowedTypes);
131-
final String deniedContentType = contentTypeFileValidator.validate(fu);
134+
final String deniedContentType = contentTypeFileValidator.validate(contentType);
132135
if (!"".equals(deniedContentType)) {
133136
String msg = getPageBase().getString("UploadDownloadPanel.validationContentNotAllowed", label, deniedContentType);
134137
validatable.error(new ValidationError(msg));
135138
}
139+
140+
final String magicNumberForContentType = FileValidatorUtil.CONTENT_TYPES_TO_MAGIC_NUMBERS.get(contentType);
141+
final String magicNumberOfFile = HexFormat.of().formatHex(getInputStream().readNBytes(magicNumberForContentType.length() / 2));
142+
if (magicNumberForContentType != null && !magicNumberForContentType.equals(magicNumberOfFile)) {
143+
String msg = getPageBase().getString("UploadDownloadPanel.validationContentNotMatchAllowed", label, contentType);
144+
validatable.error(new ValidationError(msg));
145+
}
136146
}
137147
} catch (MimeTypeParseException ex) {
138148
String msg = getPageBase().getString("UploadDownloadPanel.validationContentNotAllowed", label, ex.getMessage());
139149
validatable.error(new ValidationError(msg));
150+
} catch (IOException ex) {
151+
String msg = getPageBase().getString("UploadDownloadPanel.validationContentNotMatchAllowed", label, ex.getMessage());
152+
validatable.error(new ValidationError(msg));
140153
}
141154
});
142155
fileUpload.setOutputMarkupId(true);

‎gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/input/validator/ContentTypeFileValidator.java‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88

99
import jakarta.activation.MimeType;
1010
import jakarta.activation.MimeTypeParseException;
11-
import org.apache.wicket.markup.html.form.upload.FileUpload;
1211

1312
import java.util.List;
1413

@@ -19,13 +18,12 @@
1918
public class ContentTypeFileValidator {
2019
private final List<MimeType> allowedTypes;
2120

22-
public ContentTypeFileValidator(List<MimeType> allowedTypes) {
21+
public ContentTypeFileValidator(final List<MimeType> allowedTypes) {
2322
this.allowedTypes = allowedTypes;
2423
}
2524

26-
public String validate(final FileUpload fileUpload) throws MimeTypeParseException {
27-
String contentType = fileUpload.getContentType();
28-
MimeType fileMime = new MimeType(contentType);
25+
public String validate(final String contentType) throws MimeTypeParseException {
26+
final MimeType fileMime = new MimeType(contentType);
2927

3028
for (MimeType allowed : allowedTypes) {
3129
if (allowed.match(fileMime)) {

gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/input/validator/FileValidatorFactory.java renamed to gui/admin-gui/src/main/java/com/evolveum/midpoint/web/component/input/validator/FileValidatorUtil.java

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,7 @@
99
import jakarta.activation.MimeType;
1010
import jakarta.activation.MimeTypeParseException;
1111

12-
import java.util.Arrays;
13-
import java.util.List;
14-
import java.util.Objects;
12+
import java.util.*;
1513

1614
import static com.evolveum.midpoint.common.MimeTypeUtil.MIME_IMAGE_JPEG;
1715
import static com.evolveum.midpoint.common.MimeTypeUtil.MIME_IMAGE_PNG;
@@ -20,8 +18,12 @@
2018
* @author matisovaa
2119
*
2220
*/
23-
public class FileValidatorFactory {
21+
public class FileValidatorUtil {
2422
public static final List<String> ALLOWED_UPLOAD_IMAGE_CONTENT_TYPES = Arrays.asList(MIME_IMAGE_JPEG, MIME_IMAGE_PNG);
23+
public static final Map<String, String> CONTENT_TYPES_TO_MAGIC_NUMBERS = Map.of(
24+
MIME_IMAGE_JPEG, "ffd8ff",
25+
MIME_IMAGE_PNG, "89504e470d0a1a0a"
26+
);
2527

2628
public static List<MimeType> getMimeTypes(final List<String> stringMimeTypes) {
2729
return stringMimeTypes.stream()

‎gui/admin-gui/src/test/java/com/evolveum/midpoint/web/component/FileValidatorTest.java‎

Lines changed: 7 additions & 109 deletions
Original file line numberDiff line numberDiff line change
@@ -6,23 +6,13 @@
66

77
package com.evolveum.midpoint.web.component;
88

9-
import org.apache.commons.fileupload2.core.FileItem;
10-
import org.apache.commons.fileupload2.core.FileItemHeaders;
11-
import org.apache.commons.fileupload2.core.FileItemHeadersProvider;
12-
import org.apache.wicket.markup.html.form.upload.FileUpload;
139
import org.springframework.test.context.ActiveProfiles;
1410
import org.testng.annotations.Test;
1511

16-
import java.io.IOException;
17-
import java.io.InputStream;
18-
import java.io.OutputStream;
19-
import java.nio.charset.Charset;
20-
import java.nio.file.Path;
21-
2212
import static com.evolveum.midpoint.common.MimeTypeUtil.*;
2313

2414
import com.evolveum.midpoint.web.component.input.validator.ContentTypeFileValidator;
25-
import com.evolveum.midpoint.web.component.input.validator.FileValidatorFactory;
15+
import com.evolveum.midpoint.web.component.input.validator.FileValidatorUtil;
2616

2717
import static org.testng.Assert.assertEquals;
2818

@@ -35,117 +25,25 @@ public class FileValidatorTest {
3525

3626
@Test
3727
public void test4299ContentTypeFileValidator_validJPEG() throws Exception {
38-
final FileUpload fu = new FileUpload(this.getFileItem(MIME_IMAGE_JPEG));
3928
final ContentTypeFileValidator contentTypeFileValidator =
40-
new ContentTypeFileValidator(FileValidatorFactory.getMimeTypes(FileValidatorFactory.ALLOWED_UPLOAD_IMAGE_CONTENT_TYPES));
41-
final String deniedContentType = contentTypeFileValidator.validate(fu);
29+
new ContentTypeFileValidator(FileValidatorUtil.getMimeTypes(FileValidatorUtil.ALLOWED_UPLOAD_IMAGE_CONTENT_TYPES));
30+
final String deniedContentType = contentTypeFileValidator.validate(MIME_IMAGE_JPEG);
4231
assertEquals(deniedContentType, "");
4332
}
4433

4534
@Test
4635
public void test4299ContentTypeFileValidator_validPNG() throws Exception {
47-
final FileUpload fu = new FileUpload(this.getFileItem(MIME_IMAGE_PNG));
4836
final ContentTypeFileValidator contentTypeFileValidator =
49-
new ContentTypeFileValidator(FileValidatorFactory.getMimeTypes(FileValidatorFactory.ALLOWED_UPLOAD_IMAGE_CONTENT_TYPES));
50-
final String deniedContentType = contentTypeFileValidator.validate(fu);
37+
new ContentTypeFileValidator(FileValidatorUtil.getMimeTypes(FileValidatorUtil.ALLOWED_UPLOAD_IMAGE_CONTENT_TYPES));
38+
final String deniedContentType = contentTypeFileValidator.validate(MIME_IMAGE_PNG);
5139
assertEquals(deniedContentType, "");
5240
}
5341

5442
@Test
5543
public void test4299ContentTypeFileValidator_invalid() throws Exception {
56-
final FileUpload fu = new FileUpload(this.getFileItem(MIME_APPLICATION_XML));
5744
final ContentTypeFileValidator contentTypeFileValidator =
58-
new ContentTypeFileValidator(FileValidatorFactory.getMimeTypes(FileValidatorFactory.ALLOWED_UPLOAD_IMAGE_CONTENT_TYPES));
59-
final String deniedContentType = contentTypeFileValidator.validate(fu);
45+
new ContentTypeFileValidator(FileValidatorUtil.getMimeTypes(FileValidatorUtil.ALLOWED_UPLOAD_IMAGE_CONTENT_TYPES));
46+
final String deniedContentType = contentTypeFileValidator.validate(MIME_APPLICATION_XML);
6047
assertEquals(deniedContentType, MIME_APPLICATION_XML);
6148
}
62-
63-
private FileItem getFileItem(final String contentType) {
64-
return new FileItem() {
65-
@Override
66-
public FileItem delete() throws IOException {
67-
return null;
68-
}
69-
70-
@Override
71-
public byte[] get() throws IOException {
72-
return new byte[0];
73-
}
74-
75-
@Override
76-
public String getContentType() {
77-
return contentType;
78-
}
79-
80-
@Override
81-
public String getFieldName() {
82-
return "";
83-
}
84-
85-
@Override
86-
public InputStream getInputStream() throws IOException {
87-
return null;
88-
}
89-
90-
@Override
91-
public String getName() {
92-
return "";
93-
}
94-
95-
@Override
96-
public OutputStream getOutputStream() throws IOException {
97-
return null;
98-
}
99-
100-
@Override
101-
public long getSize() {
102-
return 0;
103-
}
104-
105-
@Override
106-
public String getString() throws IOException {
107-
return "";
108-
}
109-
110-
@Override
111-
public String getString(Charset charset) throws IOException {
112-
return "";
113-
}
114-
115-
@Override
116-
public boolean isFormField() {
117-
return false;
118-
}
119-
120-
@Override
121-
public boolean isInMemory() {
122-
return false;
123-
}
124-
125-
@Override
126-
public FileItem setFieldName(String s) {
127-
return null;
128-
}
129-
130-
@Override
131-
public FileItem setFormField(boolean b) {
132-
return null;
133-
}
134-
135-
@Override
136-
public FileItem write(Path path) throws IOException {
137-
return null;
138-
}
139-
140-
@Override
141-
public FileItemHeaders getHeaders() {
142-
return null;
143-
}
144-
145-
@Override
146-
public FileItemHeadersProvider setHeaders(FileItemHeaders fileItemHeaders) {
147-
return null;
148-
}
149-
};
150-
}
15149
}

0 commit comments

Comments
 (0)