|
| 1 | +// Licensed to the Software Freedom Conservancy (SFC) under one |
| 2 | +// or more contributor license agreements. See the NOTICE file |
| 3 | +// distributed with this work for additional information |
| 4 | +// regarding copyright ownership. The SFC licenses this file |
| 5 | +// to you under the Apache License, Version 2.0 (the |
| 6 | +// "License"); you may not use this file except in compliance |
| 7 | +// with the License. You may obtain a copy of the License at |
| 8 | +// |
| 9 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | +// |
| 11 | +// Unless required by applicable law or agreed to in writing, |
| 12 | +// software distributed under the License is distributed on an |
| 13 | +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 14 | +// KIND, either express or implied. See the License for the |
| 15 | +// specific language governing permissions and limitations |
| 16 | +// under the License. |
| 17 | + |
| 18 | +package org.openqa.selenium.grid.router.httpd; |
| 19 | + |
| 20 | +import java.net.URLDecoder; |
| 21 | +import java.nio.charset.StandardCharsets; |
| 22 | +import java.util.ArrayList; |
| 23 | +import java.util.List; |
| 24 | + |
| 25 | +/** Represents a blocked route with HTTP method and path. */ |
| 26 | +public class BlockedRoute { |
| 27 | + private final String method; |
| 28 | + private final String path; |
| 29 | + |
| 30 | + public BlockedRoute(String method, String path) { |
| 31 | + this.method = method.toUpperCase(); |
| 32 | + this.path = path; |
| 33 | + } |
| 34 | + |
| 35 | + public String getMethod() { |
| 36 | + return method; |
| 37 | + } |
| 38 | + |
| 39 | + public String getPath() { |
| 40 | + return path; |
| 41 | + } |
| 42 | + |
| 43 | + /** |
| 44 | + * Creates a BlockedRoute from a string in the format "METHOD:path". |
| 45 | + * |
| 46 | + * @param routeStr String representation of blocked route |
| 47 | + * @return BlockedRoute instance |
| 48 | + * @throws IllegalArgumentException if the format is invalid |
| 49 | + */ |
| 50 | + public static BlockedRoute fromString(String routeStr) { |
| 51 | + if (routeStr == null || routeStr.trim().isEmpty()) { |
| 52 | + throw new IllegalArgumentException("Route string cannot be null or empty"); |
| 53 | + } |
| 54 | + |
| 55 | + String[] parts = routeStr.split(":", 2); |
| 56 | + if (parts.length != 2) { |
| 57 | + throw new IllegalArgumentException( |
| 58 | + "Invalid route format. Expected 'METHOD:path', got: " + routeStr); |
| 59 | + } |
| 60 | + |
| 61 | + String method = parts[0].trim().toUpperCase(); |
| 62 | + String path = parts[1].trim(); |
| 63 | + |
| 64 | + if (method.isEmpty() || path.isEmpty()) { |
| 65 | + throw new IllegalArgumentException("Method and path cannot be empty. Got: " + routeStr); |
| 66 | + } |
| 67 | + |
| 68 | + return new BlockedRoute(method, path); |
| 69 | + } |
| 70 | + |
| 71 | + /** |
| 72 | + * Checks if the given HTTP method and request path match this blocked route. |
| 73 | + * |
| 74 | + * @param requestMethod HTTP method of the request |
| 75 | + * @param requestPath Path of the request |
| 76 | + * @return true if the route should be blocked |
| 77 | + */ |
| 78 | + public boolean matches(String requestMethod, String requestPath) { |
| 79 | + if (!method.equals(requestMethod.toUpperCase())) { |
| 80 | + return false; |
| 81 | + } |
| 82 | + |
| 83 | + // Use safe string-based path matching instead of regex to prevent ReDoS attacks |
| 84 | + return matchesPathPattern(path, requestPath); |
| 85 | + } |
| 86 | + |
| 87 | + /** |
| 88 | + * Safely matches a path pattern against a request path without using regex. Handles path |
| 89 | + * parameters like {session-id} by treating them as wildcards. Both paths are normalized to |
| 90 | + * prevent path traversal attacks. |
| 91 | + * |
| 92 | + * @param pattern The path pattern to match against |
| 93 | + * @param requestPath The actual request path |
| 94 | + * @return true if the paths match |
| 95 | + */ |
| 96 | + private boolean matchesPathPattern(String pattern, String requestPath) { |
| 97 | + // Normalize both paths to prevent path traversal attacks |
| 98 | + String normalizedPattern = normalizePath(pattern); |
| 99 | + String normalizedRequestPath = normalizePath(requestPath); |
| 100 | + |
| 101 | + // Split both paths into segments |
| 102 | + String[] patternSegments = normalizedPattern.split("/", -1); // keep trailing empty segments |
| 103 | + String[] requestSegments = normalizedRequestPath.split("/", -1); |
| 104 | + |
| 105 | + // Paths must have the same number of segments |
| 106 | + if (patternSegments.length != requestSegments.length) { |
| 107 | + return false; |
| 108 | + } |
| 109 | + |
| 110 | + // Compare each segment |
| 111 | + for (int i = 0; i < patternSegments.length; i++) { |
| 112 | + String patternSegment = patternSegments[i]; |
| 113 | + String requestSegment = requestSegments[i]; |
| 114 | + |
| 115 | + // If both are empty (leading/trailing slash), continue |
| 116 | + if (patternSegment.isEmpty() && requestSegment.isEmpty()) { |
| 117 | + continue; |
| 118 | + } |
| 119 | + // If pattern segment is a path parameter (enclosed in {}), it matches any non-empty segment |
| 120 | + if (isPathParameter(patternSegment)) { |
| 121 | + if (requestSegment.isEmpty()) { |
| 122 | + return false; |
| 123 | + } |
| 124 | + } else { |
| 125 | + // For literal segments, they must match exactly |
| 126 | + if (!patternSegment.equals(requestSegment)) { |
| 127 | + return false; |
| 128 | + } |
| 129 | + } |
| 130 | + } |
| 131 | + |
| 132 | + return true; |
| 133 | + } |
| 134 | + |
| 135 | + /** |
| 136 | + * Normalizes a path to prevent path traversal attacks. This method: 1. URL decodes |
| 137 | + * percent-encoded characters 2. Normalizes multiple consecutive slashes to single slashes 3. |
| 138 | + * Resolves path traversal sequences (../) 4. Ensures the path doesn't escape the root directory |
| 139 | + * |
| 140 | + * @param path The path to normalize |
| 141 | + * @return The normalized path |
| 142 | + * @throws IllegalArgumentException if the path contains invalid traversal sequences |
| 143 | + */ |
| 144 | + private String normalizePath(String path) { |
| 145 | + if (path == null || path.isEmpty()) { |
| 146 | + return "/"; |
| 147 | + } |
| 148 | + |
| 149 | + try { |
| 150 | + // URL decode the path to handle percent-encoded characters like %2F |
| 151 | + String decodedPath = URLDecoder.decode(path, StandardCharsets.UTF_8); |
| 152 | + |
| 153 | + // Normalize multiple consecutive slashes to single slashes |
| 154 | + String normalizedPath = decodedPath.replaceAll("/+", "/"); |
| 155 | + |
| 156 | + // Split into segments and resolve path traversal |
| 157 | + String[] segments = normalizedPath.split("/"); |
| 158 | + List<String> resolvedSegments = new ArrayList<>(); |
| 159 | + |
| 160 | + for (String segment : segments) { |
| 161 | + if (segment.isEmpty() || ".".equals(segment)) { |
| 162 | + // Skip empty segments and current directory references |
| 163 | + continue; |
| 164 | + } else if ("..".equals(segment)) { |
| 165 | + // Go up one directory level |
| 166 | + if (!resolvedSegments.isEmpty()) { |
| 167 | + resolvedSegments.remove(resolvedSegments.size() - 1); |
| 168 | + } else { |
| 169 | + // Attempting to go above root - this is a security violation |
| 170 | + throw new IllegalArgumentException("Path traversal attack detected: " + path); |
| 171 | + } |
| 172 | + } else { |
| 173 | + // Add normal segment |
| 174 | + resolvedSegments.add(segment); |
| 175 | + } |
| 176 | + } |
| 177 | + |
| 178 | + // Reconstruct the path |
| 179 | + StringBuilder result = new StringBuilder(); |
| 180 | + for (String segment : resolvedSegments) { |
| 181 | + result.append("/").append(segment); |
| 182 | + } |
| 183 | + |
| 184 | + // Ensure the result starts with / and handle empty path case |
| 185 | + String finalPath = result.toString(); |
| 186 | + return finalPath.isEmpty() ? "/" : finalPath; |
| 187 | + |
| 188 | + } catch (Exception e) { |
| 189 | + // If URL decoding fails or any other error occurs, throw security exception |
| 190 | + throw new IllegalArgumentException("Invalid path format: " + path, e); |
| 191 | + } |
| 192 | + } |
| 193 | + |
| 194 | + /** |
| 195 | + * Checks if a path segment is a path parameter (enclosed in curly braces). |
| 196 | + * |
| 197 | + * @param segment The path segment to check |
| 198 | + * @return true if it's a path parameter |
| 199 | + */ |
| 200 | + private boolean isPathParameter(String segment) { |
| 201 | + return segment.startsWith("{") && segment.endsWith("}") && segment.length() > 2; |
| 202 | + } |
| 203 | + |
| 204 | + @Override |
| 205 | + public String toString() { |
| 206 | + return method + ":" + path; |
| 207 | + } |
| 208 | + |
| 209 | + @Override |
| 210 | + public boolean equals(Object obj) { |
| 211 | + if (this == obj) return true; |
| 212 | + if (obj == null || getClass() != obj.getClass()) return false; |
| 213 | + BlockedRoute that = (BlockedRoute) obj; |
| 214 | + return method.equals(that.method) && path.equals(that.path); |
| 215 | + } |
| 216 | + |
| 217 | + @Override |
| 218 | + public int hashCode() { |
| 219 | + return method.hashCode() * 31 + path.hashCode(); |
| 220 | + } |
| 221 | +} |
0 commit comments