Skip to content

Commit 7bf589d

Browse files
stroomdev66stroomdev66
authored
Merge pull request #4779 from gchq/csp_update
Csp update
2 parents c87a375 + 5e37f55 commit 7bf589d

File tree

16 files changed

+77
-69
lines changed

16 files changed

+77
-69
lines changed

Diff for: ‎stroom-app/src/main/java/stroom/app/App.java

+27-14
Original file line numberDiff line numberDiff line change
@@ -72,19 +72,15 @@
7272
import io.dropwizard.jersey.sessions.SessionFactoryProvider;
7373
import io.dropwizard.servlets.tasks.LogConfigurationTask;
7474
import jakarta.inject.Inject;
75-
import jakarta.servlet.DispatcherType;
76-
import jakarta.servlet.FilterRegistration;
7775
import jakarta.validation.ValidatorFactory;
7876
import org.eclipse.jetty.http.HttpCookie;
7977
import org.eclipse.jetty.server.handler.ContextHandler;
8078
import org.eclipse.jetty.server.session.SessionHandler;
81-
import org.eclipse.jetty.servlets.CrossOriginFilter;
8279

8380
import java.io.IOException;
8481
import java.nio.file.Path;
8582
import java.nio.file.Paths;
8683
import java.time.Duration;
87-
import java.util.EnumSet;
8884
import java.util.Objects;
8985

9086
public class App extends Application<Config> {
@@ -230,14 +226,15 @@ public void run(final Config configuration, final Environment environment) {
230226
// and configuration only holds the YAML view of the config, not the DB view.
231227
final ConfigMapper configMapper = bootStrapInjector.getInstance(ConfigMapper.class);
232228
final SessionCookieConfig sessionCookieConfig = configMapper.getConfigObject(SessionCookieConfig.class);
229+
// final CorsConfig corsConfig = configMapper.getConfigObject(CorsConfig.class);
233230
final SessionConfig sessionConfig = configMapper.getConfigObject(SessionConfig.class);
234231

235232
// Set up a session handler for Jetty
236233
configureSessionHandling(environment, sessionConfig);
237234
configureSessionCookie(environment, sessionCookieConfig);
238235

239-
// Configure Cross-Origin Resource Sharing.
240-
configureCors(environment);
236+
// // Configure Cross-Origin Resource Sharing.
237+
// configureCors(environment, corsConfig);
241238

242239
LOGGER.info("Starting Stroom Application");
243240

@@ -400,14 +397,30 @@ private void configureSessionCookie(final Environment environment,
400397
sessionCookieConfig.getSameSite().getAttributeValue());
401398
}
402399

403-
private static void configureCors(io.dropwizard.core.setup.Environment environment) {
404-
final FilterRegistration.Dynamic cors = environment.servlets()
405-
.addFilter("CORS", CrossOriginFilter.class);
406-
cors.addMappingForUrlPatterns(EnumSet.allOf(DispatcherType.class), true, "/*");
407-
cors.setInitParameter(CrossOriginFilter.ALLOWED_METHODS_PARAM, "GET,PUT,POST,DELETE,OPTIONS,PATCH");
408-
cors.setInitParameter(CrossOriginFilter.ALLOWED_ORIGINS_PARAM, "*");
409-
cors.setInitParameter(CrossOriginFilter.ALLOWED_HEADERS_PARAM, "*");
410-
}
400+
// private static void configureCors(final Environment environment,
401+
// final CorsConfig corsConfig) {
402+
// // Enable CORS headers
403+
// final FilterRegistration.Dynamic cors =
404+
// environment.servlets().addFilter("CORS", CrossOriginFilter.class);
405+
//
406+
// // Configure CORS parameters
407+
// cors.setInitParameter(CrossOriginFilter.ALLOWED_ORIGINS_PARAM,
408+
// "*"); // Same as default.
409+
// cors.setInitParameter(CrossOriginFilter.ALLOWED_HEADERS_PARAM,
410+
// "X-Requested-With,Content-Type,Accept,Origin"); // Same as default.
411+
// cors.setInitParameter(CrossOriginFilter.ALLOWED_METHODS_PARAM,
412+
// "GET,POST,HEAD"); // Same as default.
413+
//
414+
// // Add other overrides from config.
415+
// if (corsConfig != null && corsConfig.getParameters() != null && !corsConfig.getParameters().isEmpty()) {
416+
// corsConfig.getParameters().forEach(param -> {
417+
// cors.setInitParameter(param.getName(), param.getValue());
418+
// });
419+
// }
420+
//
421+
// // Add URL mapping
422+
// cors.addMappingForUrlPatterns(EnumSet.allOf(DispatcherType.class), true, "/*");
423+
// }
411424

412425
private void registerLogConfiguration(final Environment environment) {
413426
// Task to allow configuration of log levels at runtime

Diff for: ‎stroom-config/stroom-config-app/build.gradle

+1
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ dependencies {
4747
implementation project(':stroom-search:stroom-search-impl')
4848
implementation project(':stroom-search:stroom-search-solr')
4949
implementation project(':stroom-search:stroom-searchable-impl')
50+
implementation project(':stroom-security:stroom-security-common-impl')
5051
implementation project(':stroom-security:stroom-security-identity')
5152
implementation project(':stroom-security:stroom-security-impl')
5253
implementation project(':stroom-security:stroom-security-impl-db')

Diff for: ‎stroom-config/stroom-config-app/src/main/java/stroom/config/app/AppConfig.java

+10
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ public class AppConfig extends AbstractConfig implements IsStroomConfig {
8787
public static final String PROP_NAME_COMMON_DB_DETAILS = "commonDbDetails";
8888
public static final String PROP_NAME_CONTENT_PACK_IMPORT = "contentPackImport";
8989
public static final String PROP_NAME_CORE = "core";
90+
public static final String PROP_NAME_CORS = "cors";
9091
public static final String PROP_NAME_DASHBOARD = "dashboard";
9192
public static final String PROP_NAME_DATA = "data";
9293
public static final String PROP_NAME_DOCSTORE = "docstore";
@@ -135,6 +136,7 @@ public class AppConfig extends AbstractConfig implements IsStroomConfig {
135136
private final ClusterLockConfig clusterLockConfig;
136137
private final CommonDbConfig commonDbConfig;
137138
private final ContentPackImportConfig contentPackImportConfig;
139+
// private final CorsConfig corsConfig;
138140
private final LegacyConfig legacyConfig;
139141
private final DashboardConfig dashboardConfig;
140142
private final DataConfig dataConfig;
@@ -186,6 +188,7 @@ public AppConfig() {
186188
new ClusterLockConfig(),
187189
new CommonDbConfig(),
188190
new ContentPackImportConfig(),
191+
// new CorsConfig(),
189192
new LegacyConfig(),
190193
new DashboardConfig(),
191194
new DataConfig(),
@@ -236,6 +239,7 @@ public AppConfig(@JsonProperty(PROP_NAME_HALT_BOOT_ON_CONFIG_VALIDATION_FAILURE)
236239
@JsonProperty(PROP_NAME_CLUSTER_LOCK) final ClusterLockConfig clusterLockConfig,
237240
@JsonProperty(PROP_NAME_COMMON_DB_DETAILS) final CommonDbConfig commonDbConfig,
238241
@JsonProperty(PROP_NAME_CONTENT_PACK_IMPORT) final ContentPackImportConfig contentPackImportConfig,
242+
// @JsonProperty(PROP_NAME_CORS) final CorsConfig corsConfig,
239243
@JsonProperty(PROP_NAME_CORE) final LegacyConfig legacyConfig,
240244
@JsonProperty(PROP_NAME_DASHBOARD) final DashboardConfig dashboardConfig,
241245
@JsonProperty(PROP_NAME_DATA) final DataConfig dataConfig,
@@ -282,6 +286,7 @@ public AppConfig(@JsonProperty(PROP_NAME_HALT_BOOT_ON_CONFIG_VALIDATION_FAILURE)
282286
this.clusterLockConfig = clusterLockConfig;
283287
this.commonDbConfig = commonDbConfig;
284288
this.contentPackImportConfig = contentPackImportConfig;
289+
// this.corsConfig = corsConfig;
285290
this.legacyConfig = legacyConfig;
286291
this.dashboardConfig = dashboardConfig;
287292
this.dataConfig = dataConfig;
@@ -381,6 +386,11 @@ public ContentPackImportConfig getContentPackImportConfig() {
381386
return contentPackImportConfig;
382387
}
383388

389+
// @JsonProperty(PROP_NAME_CORS)
390+
// public CorsConfig getCorsConfig() {
391+
// return corsConfig;
392+
// }
393+
384394
@JsonProperty(PROP_NAME_CORE)
385395
@JsonPropertyDescription("Configuration for the core stroom DB")
386396
public LegacyConfig getLegacyConfig() {

Diff for: ‎stroom-config/stroom-config-app/src/main/java/stroom/config/app/SecurityConfig.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
package stroom.config.app;
22

33
import stroom.search.elastic.CryptoConfig;
4+
import stroom.security.common.impl.ContentSecurityConfig;
45
import stroom.security.identity.config.IdentityConfig;
56
import stroom.security.impl.AuthenticationConfig;
67
import stroom.security.impl.AuthorisationConfig;
7-
import stroom.security.impl.ContentSecurityConfig;
88
import stroom.util.shared.AbstractConfig;
99
import stroom.util.shared.IsStroomConfig;
1010

Diff for: ‎stroom-config/stroom-config-app/src/main/java/stroom/config/app/SuperDevUtil.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
package stroom.config.app;
22

3-
import stroom.security.impl.ContentSecurityConfig;
3+
import stroom.security.common.impl.ContentSecurityConfig;
44
import stroom.util.ColouredStringBuilder;
55
import stroom.util.ConsoleColour;
66
import stroom.util.shared.AbstractConfig;

Diff for: ‎stroom-config/stroom-config-app/src/test/resources/stroom/config/app/expected.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -933,7 +933,7 @@ appConfig:
933933
webContent:
934934
contentSecurityPolicy: "default-src 'self'; script-src 'self' 'unsafe-eval'\
935935
\ 'unsafe-inline'; img-src 'self' data:; style-src 'self' 'unsafe-inline';\
936-
\ connect-src 'self' wss:; frame-ancestors 'self';"
936+
\ frame-ancestors 'self';"
937937
contentTypeOptions: "nosniff"
938938
frameOptions: "sameorigin"
939939
strictTransportSecurity: "max-age=31536000; includeSubDomains; preload"

Diff for: ‎stroom-config/stroom-config-global-impl/build.gradle

+1
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ dependencies {
4343
implementation project(':stroom-search:stroom-search-solr')
4444
implementation project(':stroom-search:stroom-searchable-impl')
4545
implementation project(':stroom-security:stroom-security-api')
46+
implementation project(':stroom-security:stroom-security-common-impl')
4647
implementation project(':stroom-security:stroom-security-identity')
4748
implementation project(':stroom-security:stroom-security-impl')
4849
implementation project(':stroom-security:stroom-security-openid-api')

Diff for: ‎stroom-config/stroom-config-global-impl/src/main/java/stroom/config/global/impl/ConfigProvidersModule.java

+9-9
Original file line numberDiff line numberDiff line change
@@ -636,6 +636,15 @@ stroom.search.solr.search.SolrSearchConfig getSolrSearchConfig(
636636
stroom.search.solr.search.SolrSearchConfig.class);
637637
}
638638

639+
@Generated("stroom.config.global.impl.GenerateConfigProvidersModule")
640+
@Provides
641+
@SuppressWarnings("unused")
642+
stroom.security.common.impl.ContentSecurityConfig getContentSecurityConfig(
643+
final ConfigMapper configMapper) {
644+
return configMapper.getConfigObject(
645+
stroom.security.common.impl.ContentSecurityConfig.class);
646+
}
647+
639648
@Generated("stroom.config.global.impl.GenerateConfigProvidersModule")
640649
@Provides
641650
@SuppressWarnings("unused")
@@ -699,15 +708,6 @@ stroom.security.impl.AuthorisationConfig getAuthorisationConfig(
699708
stroom.security.impl.AuthorisationConfig.class);
700709
}
701710

702-
@Generated("stroom.config.global.impl.GenerateConfigProvidersModule")
703-
@Provides
704-
@SuppressWarnings("unused")
705-
stroom.security.impl.ContentSecurityConfig getContentSecurityConfig(
706-
final ConfigMapper configMapper) {
707-
return configMapper.getConfigObject(
708-
stroom.security.impl.ContentSecurityConfig.class);
709-
}
710-
711711
@Generated("stroom.config.global.impl.GenerateConfigProvidersModule")
712712
@Provides
713713
@SuppressWarnings("unused")

Diff for: ‎stroom-config/stroom-config-global-impl/src/test/java/stroom/config/global/impl/TestConfigMapper.java

+2-5
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,7 @@
7676
import stroom.util.time.StroomDuration;
7777

7878
import com.fasterxml.jackson.annotation.JsonCreator;
79-
import com.fasterxml.jackson.annotation.JsonInclude.Include;
8079
import com.fasterxml.jackson.annotation.JsonProperty;
81-
import com.fasterxml.jackson.databind.DeserializationFeature;
82-
import com.fasterxml.jackson.databind.ObjectMapper;
83-
import com.fasterxml.jackson.databind.SerializationFeature;
84-
import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
8580
import com.google.common.reflect.TypeToken;
8681
import io.dropwizard.configuration.ConfigurationException;
8782
import io.dropwizard.core.Configuration;
@@ -930,6 +925,7 @@ public TestConfig(
930925
@JsonProperty(PROP_NAME_CLUSTER_LOCK) final ClusterLockConfig clusterLockConfig,
931926
@JsonProperty(PROP_NAME_COMMON_DB_DETAILS) final CommonDbConfig commonDbConfig,
932927
@JsonProperty(PROP_NAME_CONTENT_PACK_IMPORT) final ContentPackImportConfig contentPackImportConfig,
928+
// @JsonProperty(PROP_NAME_CORS) final CorsConfig corsConfig,
933929
@JsonProperty(PROP_NAME_CORE) final LegacyConfig legacyConfig,
934930
@JsonProperty(PROP_NAME_DASHBOARD) final DashboardConfig dashboardConfig,
935931
@JsonProperty(PROP_NAME_DATA) final DataConfig dataConfig,
@@ -991,6 +987,7 @@ public TestConfig(
991987
clusterLockConfig,
992988
commonDbConfig,
993989
contentPackImportConfig,
990+
// corsConfig,
994991
legacyConfig,
995992
dashboardConfig,
996993
dataConfig,

Diff for: ‎stroom-proxy/stroom-proxy-app/src/main/java/stroom/proxy/app/App.java

-15
Original file line numberDiff line numberDiff line change
@@ -56,15 +56,11 @@
5656
import io.dropwizard.core.setup.Environment;
5757
import io.dropwizard.servlets.tasks.LogConfigurationTask;
5858
import jakarta.inject.Inject;
59-
import jakarta.servlet.DispatcherType;
60-
import jakarta.servlet.FilterRegistration;
6159
import jakarta.validation.ValidatorFactory;
6260
import org.eclipse.jetty.server.session.SessionHandler;
63-
import org.eclipse.jetty.servlets.CrossOriginFilter;
6461

6562
import java.io.IOException;
6663
import java.nio.file.Path;
67-
import java.util.EnumSet;
6864
import java.util.Objects;
6965

7066
public class App extends Application<Config> {
@@ -164,9 +160,6 @@ public void run(final Config configuration, final Environment environment) {
164160
// Set up a session handler for Jetty
165161
environment.servlets().setSessionHandler(new SessionHandler());
166162

167-
// Configure Cross-Origin Resource Sharing.
168-
configureCors(environment);
169-
170163
LOGGER.info("Starting Stroom Proxy");
171164

172165
final ProxyModule proxyModule = new ProxyModule(configuration, environment, configFile);
@@ -236,14 +229,6 @@ private void warnAboutDefaultOpenIdCreds(final Config configuration, final Injec
236229
}
237230
}
238231

239-
private static void configureCors(io.dropwizard.core.setup.Environment environment) {
240-
FilterRegistration.Dynamic cors = environment.servlets().addFilter("CORS", CrossOriginFilter.class);
241-
cors.addMappingForUrlPatterns(EnumSet.allOf(DispatcherType.class), true, "/*");
242-
cors.setInitParameter(CrossOriginFilter.ALLOWED_METHODS_PARAM, "GET,PUT,POST,DELETE,OPTIONS,PATCH");
243-
cors.setInitParameter(CrossOriginFilter.ALLOWED_ORIGINS_PARAM, "*");
244-
cors.setInitParameter(CrossOriginFilter.ALLOWED_HEADERS_PARAM, "*");
245-
}
246-
247232
private void registerLogConfiguration(final Environment environment) {
248233
// Task to allow configuration of log levels at runtime
249234
String path = environment.getAdminContext().getContextPath();

Diff for: ‎stroom-proxy/stroom-proxy-app/src/main/java/stroom/proxy/app/ProxyConfig.java

+15-17
Original file line numberDiff line numberDiff line change
@@ -73,25 +73,23 @@ public class ProxyConfig extends AbstractConfig implements IsProxyConfig {
7373
private final List<SqsConnectorConfig> sqsConnectors;
7474

7575
public ProxyConfig() {
76-
haltBootOnConfigValidationFailure = DEFAULT_HALT_BOOT_ON_CONFIG_VALIDATION_FAILURE;
77-
proxyId = null;
78-
contentDir = DEFAULT_CONTENT_DIR;
79-
80-
pathConfig = new ProxyPathConfig();
81-
receiveDataConfig = new ReceiveDataConfig();
82-
eventStoreConfig = new EventStoreConfig();
83-
aggregatorConfig = new AggregatorConfig();
84-
forwardFileDestinations = new ArrayList<>();
85-
forwardHttpDestinations = new ArrayList<>();
86-
logStreamConfig = new LogStreamConfig();
87-
contentSyncConfig = new ContentSyncConfig();
88-
feedStatusConfig = new FeedStatusConfig();
89-
threadConfig = new ThreadConfig();
90-
proxySecurityConfig = new ProxySecurityConfig();
91-
sqsConnectors = new ArrayList<>();
76+
this(DEFAULT_HALT_BOOT_ON_CONFIG_VALIDATION_FAILURE,
77+
null,
78+
DEFAULT_CONTENT_DIR,
79+
new ProxyPathConfig(),
80+
new ReceiveDataConfig(),
81+
new EventStoreConfig(),
82+
new AggregatorConfig(),
83+
new ArrayList<>(),
84+
new ArrayList<>(),
85+
new LogStreamConfig(),
86+
new ContentSyncConfig(),
87+
new FeedStatusConfig(),
88+
new ThreadConfig(),
89+
new ProxySecurityConfig(),
90+
new ArrayList<>());
9291
}
9392

94-
9593
@SuppressWarnings("checkstyle:LineLength")
9694
@JsonCreator
9795
public ProxyConfig(

Diff for: ‎stroom-proxy/stroom-proxy-app/src/main/java/stroom/proxy/app/guice/ProxyModule.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,8 @@
6060

6161
public class ProxyModule extends AbstractModule {
6262

63+
private static final String MATCH_ALL_PATHS = "/*";
64+
6365
private final Config configuration;
6466
private final Environment environment;
6567
private final ProxyConfigHolder proxyConfigHolder;
@@ -95,7 +97,7 @@ protected void configure() {
9597
.bind(RemoteFeedStatusService.class);
9698

9799
FilterBinder.create(binder())
98-
.bind(new FilterInfo(ProxySecurityFilter.class.getSimpleName(), "/*"),
100+
.bind(new FilterInfo(ProxySecurityFilter.class.getSimpleName(), MATCH_ALL_PATHS),
99101
ProxySecurityFilter.class);
100102

101103
ServletBinder.create(binder())

Diff for: ‎stroom-security/stroom-security-common-impl/build.gradle

+1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ dependencies {
1111
implementation libs.caffeine
1212
implementation libs.dropwizard.metrics.healthchecks
1313
implementation libs.dropwizard.lifecycle
14+
implementation libs.guava
1415
implementation libs.http.client
1516
implementation libs.jackson.core
1617
implementation libs.jackson.databind

Diff for: ‎stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/ContentSecurityConfig.java renamed to ‎stroom-security/stroom-security-common-impl/src/main/java/stroom/security/common/impl/ContentSecurityConfig.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,10 @@
1515
* you may not use this file except in compliance with the License.
1616
*/
1717

18-
package stroom.security.impl;
18+
package stroom.security.common.impl;
1919

2020
import stroom.util.shared.AbstractConfig;
21+
import stroom.util.shared.IsProxyConfig;
2122
import stroom.util.shared.IsStroomConfig;
2223

2324
import com.fasterxml.jackson.annotation.JsonCreator;
@@ -27,7 +28,7 @@
2728

2829

2930
@JsonPropertyOrder(alphabetic = true)
30-
public class ContentSecurityConfig extends AbstractConfig implements IsStroomConfig {
31+
public class ContentSecurityConfig extends AbstractConfig implements IsStroomConfig, IsProxyConfig {
3132

3233
public static final String PROP_NAME_CONTENT_SECURITY_POLICY = "contentSecurityPolicy";
3334
public static final String PROP_NAME_STRICT_TRANSPORT_SECURITY = "strictTransportSecurity";
@@ -44,7 +45,6 @@ public ContentSecurityConfig() {
4445
"script-src 'self' 'unsafe-eval' 'unsafe-inline'; " +
4546
"img-src 'self' data:; " +
4647
"style-src 'self' 'unsafe-inline'; " +
47-
"connect-src 'self' wss:; " +
4848
"frame-ancestors 'self';";
4949
contentTypeOptions = "nosniff";
5050
frameOptions = "sameorigin";

Diff for: ‎stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/ContentSecurityFilter.java renamed to ‎stroom-security/stroom-security-common-impl/src/main/java/stroom/security/common/impl/ContentSecurityFilter.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
* limitations under the License.
1515
*/
1616

17-
package stroom.security.impl;
17+
package stroom.security.common.impl;
1818

1919
import stroom.util.NullSafe;
2020
import stroom.util.logging.LambdaLogger;

Diff for: ‎stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/SecurityModule.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import stroom.security.api.DocumentPermissionService;
2222
import stroom.security.api.ServiceUserFactory;
2323
import stroom.security.api.UserIdentityFactory;
24+
import stroom.security.common.impl.ContentSecurityFilter;
2425
import stroom.security.common.impl.DelegatingServiceUserFactory;
2526
import stroom.security.common.impl.ExternalIdpConfigurationProvider;
2627
import stroom.security.common.impl.ExternalServiceUserFactory;
@@ -46,7 +47,6 @@
4647
import stroom.util.guice.GuiceUtil;
4748
import stroom.util.guice.HasHealthCheckBinder;
4849
import stroom.util.guice.RestResourcesBinder;
49-
import stroom.util.http.HttpClientFactory;
5050
import stroom.util.shared.Clearable;
5151

5252
import com.google.inject.AbstractModule;

0 commit comments

Comments
 (0)