Skip to content

Commit ac118b1

Browse files
moodiRealistmoodiRealist
authored
Merge pull request #277 from SolaceProducts/moodiRealist/DATAGO-106034
DATAGO-106034: Reject h2 console routes
2 parents 2389534 + f65e61a commit ac118b1

File tree

5 files changed

+68
-5
lines changed

5 files changed

+68
-5
lines changed

‎service/application/pom.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,11 @@
109109
<artifactId>spring-security-rsa</artifactId>
110110
<version>${spring-security-rsa.version}</version>
111111
</dependency>
112+
<dependency>
113+
<groupId>org.springframework.boot</groupId>
114+
<artifactId>spring-boot-starter-security</artifactId>
115+
<version>${spring-boot.version}</version>
116+
</dependency>
112117
<dependency>
113118
<groupId>org.springframework.kafka</groupId>
114119
<artifactId>spring-kafka</artifactId>

‎service/application/src/main/java/com/solace/maas/ep/event/management/agent/config/H2ConsoleSecurityConfig.java‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
package com.solace.maas.ep.event.management.agent.config;
2+
3+
import jakarta.annotation.PostConstruct;
4+
import lombok.extern.slf4j.Slf4j;
5+
import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
6+
import org.springframework.boot.autoconfigure.h2.H2ConsoleProperties;
7+
import org.springframework.context.annotation.Bean;
8+
import org.springframework.context.annotation.Configuration;
9+
import org.springframework.context.annotation.Primary;
10+
import org.springframework.context.annotation.Profile;
11+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
12+
import org.springframework.security.web.SecurityFilterChain;
13+
14+
@Slf4j
15+
@Configuration
16+
@Profile("!TEST")
17+
@ConditionalOnExpression("!'none'.equals('${spring.main.web-application-type:}')")
18+
public class H2ConsoleSecurityConfig {
19+
20+
@PostConstruct
21+
public void logSecurityStatus() {
22+
log.info("H2 Console Security: COMPLETELY DISABLED");
23+
log.info("H2 Console has been forcibly disabled for security reasons");
24+
}
25+
26+
/**
27+
* Force H2 console to be disabled to ensures the H2 console cannot be enabled
28+
* even if spring.h2.console.enabled=true is set in configuration files.
29+
*/
30+
@Bean
31+
@Primary
32+
public H2ConsoleProperties h2ConsoleProperties() {
33+
H2ConsoleProperties properties = new H2ConsoleProperties();
34+
properties.setEnabled(false); // Force disabled
35+
log.info("H2 Console: Programmatically disabled via H2ConsoleProperties override");
36+
return properties;
37+
}
38+
39+
/**
40+
* Security filter chain that explicitly denies all access to H2 console endpoints.
41+
* This provides defense-in-depth by blocking access even if H2 console somehow gets enabled.
42+
*/
43+
@Bean
44+
public SecurityFilterChain h2ConsoleBlockingSecurityFilterChain(HttpSecurity http) throws Exception {
45+
log.info("Configuring H2 Console Blocking Security Filter Chain");
46+
47+
// Explicitly deny all access to H2 console paths
48+
http.authorizeHttpRequests(auth ->
49+
auth.requestMatchers("/h2/**", "/h2-console/**").denyAll()
50+
.anyRequest().permitAll());
51+
52+
log.info("H2 Console: All access to /h2/** and /h2-console/** endpoints BLOCKED");
53+
return http.build();
54+
}
55+
}

‎service/application/src/main/java/com/solace/maas/ep/event/management/agent/publisher/ScanStatusPublisher.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
import com.solace.maas.ep.event.management.agent.plugin.util.MdcUtil;
1010
import io.micrometer.core.instrument.MeterRegistry;
1111
import lombok.extern.slf4j.Slf4j;
12+
import org.apache.commons.lang3.ObjectUtils;
1213
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
1314
import org.springframework.stereotype.Component;
1415

@@ -62,7 +63,7 @@ public void sendOverallScanStatus(ScanStatusMessage message, Map<String, String>
6263
STATUS_TAG, status,
6364
SCAN_ID_TAG, scanId,
6465
ORG_ID_TAG, message.getOrgId(),
65-
ORIGIN_ORG_ID_TAG, message.getOriginOrgId(),
66+
ORIGIN_ORG_ID_TAG, ObjectUtils.isEmpty(message.getOriginOrgId()) ? message.getOrgId() : message.getOriginOrgId(),
6667
IS_LINKED_TAG, MdcUtil.isLinked(message.getOrgId(), message.getOriginOrgId()) ? "true" : "false")
6768
.increment();
6869
}
@@ -96,7 +97,7 @@ public void sendScanDataStatus(ScanDataStatusMessage message, Map<String, String
9697
STATUS_TAG, status,
9798
SCAN_ID_TAG, scanId,
9899
ORG_ID_TAG, topicDetails.get("orgId"),
99-
ORIGIN_ORG_ID_TAG, message.getOriginOrgId(),
100+
ORIGIN_ORG_ID_TAG, ObjectUtils.isEmpty(message.getOriginOrgId()) ? topicDetails.get("orgId") : message.getOriginOrgId(),
100101
IS_LINKED_TAG, MdcUtil.isLinked(message.getOrgId(), message.getOriginOrgId()) ? "true" : "false")
101102
.increment();
102103
}

‎service/application/src/main/java/com/solace/maas/ep/event/management/agent/service/ScanService.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,7 @@ public String singleScan(SingleScanSpecification singleScanSpecification) {
129129
log.info("Scan request [{}], trace ID [{}]: Total of {} scan types to be retrieved: [{}].",
130130
scanId, traceId, scanTypes.size(), StringUtils.join(scanTypes, ", "));
131131

132+
132133
sendScanStatus(orgId,
133134
originOrgId,
134135
groupId,
@@ -289,7 +290,7 @@ public void sendScanStatus(String orgId,
289290
STATUS_TAG, status.name(),
290291
SCAN_ID_TAG, scanId,
291292
ORG_ID_TAG, orgId,
292-
ORIGIN_ORG_ID_TAG, originOrgId,
293+
ORIGIN_ORG_ID_TAG, ObjectUtils.isEmpty(originOrgId) ? orgId : originOrgId,
293294
IS_LINKED_TAG, MdcUtil.isLinked(orgId, originOrgId) ? "true" : "false")
294295
.increment();
295296
}

‎service/application/src/main/java/com/solace/maas/ep/event/management/agent/subscriber/messageProcessors/ScanCommandMessageProcessor.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
import lombok.extern.slf4j.Slf4j;
1111
import net.logstash.logback.encoder.org.apache.commons.lang3.StringUtils;
1212
import org.apache.commons.collections4.CollectionUtils;
13+
import org.apache.commons.lang3.ObjectUtils;
1314
import org.apache.commons.lang3.Validate;
1415
import org.awaitility.core.ConditionTimeoutException;
1516
import org.slf4j.MDC;
@@ -62,7 +63,7 @@ public void processMessage(ScanCommandMessage message) {
6263
meterRegistry.counter(MAAS_EMA_SCAN_EVENT_RECEIVED,
6364
SCAN_ID_TAG, scanId,
6465
ORG_ID_TAG, message.getOrgId(),
65-
ORIGIN_ORG_ID_TAG, message.getOriginOrgId(),
66+
ORIGIN_ORG_ID_TAG, ObjectUtils.isEmpty(message.getOriginOrgId()) ? message.getOrgId() : message.getOriginOrgId(),
6667
IS_LINKED_TAG, MdcUtil.isLinked(message.getOrgId(), message.getOriginOrgId()) ? "true" : "false")
6768
.increment();
6869

@@ -161,7 +162,7 @@ public void sendCycleTimeMetric(Instant startTime, ScanCommandMessage message, S
161162
Timer jobCycleTime = Timer
162163
.builder(MAAS_EMA_SCAN_EVENT_CYCLE_TIME)
163164
.tag(ORG_ID_TAG, message.getOrgId())
164-
.tag(ORIGIN_ORG_ID_TAG, message.getOriginOrgId())
165+
.tag(ORIGIN_ORG_ID_TAG, ObjectUtils.isEmpty(message.getOriginOrgId()) ? message.getOrgId() : message.getOriginOrgId())
165166
.tag(IS_LINKED_TAG, MdcUtil.isLinked(message.getOrgId(), message.getOriginOrgId()) ? "true" : "false")
166167
.tag(STATUS_TAG, status)
167168
.register(meterRegistry);

0 commit comments

Comments
 (0)