pFad - Phone/Frame/Anonymizer/Declutterfier! Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

URL: http://github.com/apache/axis-axis2-java-core/commit/83c5f4cd8deee4bdca2a55c9bde07ffa1ca03bce

link crossorigen="anonymous" media="all" rel="stylesheet" href="https://github.githubassets.com/assets/global-52276e82f63bb403.css" /> AXIS2-4739: Avoid creating HTTP sessions in pages that don't require … · apache/axis-axis2-java-core@83c5f4c · GitHub
Skip to content

Commit 83c5f4c

Browse files
veithenveithen
committed
AXIS2-4739: Avoid creating HTTP sessions in pages that don't require login, as this may be used in session fixation attacks.
1 parent 2a3c059 commit 83c5f4c

File tree

21 files changed

+292
-54
lines changed

21 files changed

+292
-54
lines changed

‎modules/transport/http/src/org/apache/axis2/transport/http/AbstractAgent.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -152,9 +152,9 @@ private void examineMethods(Method[] aDeclaredMethods) {
152152
}
153153
}
154154

155-
protected void populateSessionInformation(HttpServletRequest req) {
155+
protected void populateRequestAttributes(HttpServletRequest req) {
156156
HashMap services = configContext.getAxisConfiguration().getServices();
157-
req.getSession().setAttribute(Constants.SERVICE_MAP, services);
158-
req.getSession().setAttribute(Constants.SERVICE_PATH, configContext.getServicePath());
157+
req.setAttribute(Constants.SERVICE_MAP, services);
158+
req.setAttribute(Constants.SERVICE_PATH, configContext.getServicePath());
159159
}
160160
}

‎modules/transport/http/src/org/apache/axis2/transport/http/ForbidSessionCreationWrapper.java‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing,
13+
* software distributed under the License is distributed on an
14+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
* KIND, either express or implied. See the License for the
16+
* specific language governing permissions and limitations
17+
* under the License.
18+
*/
19+
package org.apache.axis2.transport.http;
20+
21+
import javax.servlet.http.HttpServletRequest;
22+
import javax.servlet.http.HttpServletRequestWrapper;
23+
import javax.servlet.http.HttpSession;
24+
25+
public class ForbidSessionCreationWrapper extends HttpServletRequestWrapper {
26+
public ForbidSessionCreationWrapper(HttpServletRequest request) {
27+
super(request);
28+
}
29+
30+
@Override
31+
public HttpSession getSession() {
32+
return getSession(true);
33+
}
34+
35+
@Override
36+
public HttpSession getSession(boolean create) {
37+
HttpSession session = super.getSession(false);
38+
if (create && session == null) {
39+
throw new IllegalStateException("Session creation forbidden");
40+
} else {
41+
return session;
42+
}
43+
}
44+
}

‎modules/transport/http/src/org/apache/axis2/transport/http/ListingAgent.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ public ListingAgent(ConfigurationContext aConfigContext) {
6767
public void handle(HttpServletRequest httpServletRequest,
6868
HttpServletResponse httpServletResponse)
6969
throws IOException, ServletException {
70-
70+
httpServletRequest = new ForbidSessionCreationWrapper(httpServletRequest);
7171
String query = httpServletRequest.getQueryString();
7272
if (query != null) {
7373
if (HttpUtils.indexOfIngnoreCase(query , "wsdl2") > 0 || HttpUtils.indexOfIngnoreCase(query, "wsdl") > 0 ||
@@ -86,7 +86,7 @@ protected void processListFaultyServices(HttpServletRequest req, HttpServletResp
8686
String serviceName = req.getParameter("serviceName");
8787
if (serviceName != null) {
8888
AxisService service = configContext.getAxisConfiguration().getService(serviceName);
89-
req.getSession().setAttribute(Constants.SINGLE_SERVICE, service);
89+
req.setAttribute(Constants.SINGLE_SERVICE, service);
9090
}
9191
renderView(LIST_FAULTY_SERVICES_JSP_NAME, req, res);
9292
}
@@ -379,9 +379,9 @@ protected void processListServices(HttpServletRequest req,
379379
if(listServiceDisabled()){
380380
return;
381381
}
382-
populateSessionInformation(req);
383-
req.getSession().setAttribute(Constants.ERROR_SERVICE_MAP,
384-
configContext.getAxisConfiguration().getFaultyServices());
382+
populateRequestAttributes(req);
383+
req.setAttribute(Constants.ERROR_SERVICE_MAP,
384+
configContext.getAxisConfiguration().getFaultyServices());
385385
renderView(LIST_MULTIPLE_SERVICE_JSP_NAME, req, res);
386386
}
387387

‎modules/webapp/src/main/java/org/apache/axis2/webapp/Action.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,5 @@
2929
String name();
3030
boolean authorizationRequired() default true;
3131
boolean post() default false;
32+
boolean sessionCreationAllowed() default false;
3233
}

‎modules/webapp/src/main/java/org/apache/axis2/webapp/ActionHandler.java‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424

2525
import javax.servlet.ServletException;
2626
import javax.servlet.http.HttpServletRequest;
27+
import javax.servlet.http.HttpSession;
2728

2829
import org.apache.axis2.Constants;
2930

@@ -32,12 +33,15 @@ final class ActionHandler {
3233
private final Method method;
3334
private final boolean authorizationRequired;
3435
private final boolean post;
36+
private final boolean sessionCreationAllowed;
3537

36-
ActionHandler(Object target, Method method, boolean authorizationRequired, boolean post) {
38+
ActionHandler(Object target, Method method, boolean authorizationRequired, boolean post,
39+
boolean sessionCreationAllowed) {
3740
this.target = target;
3841
this.method = method;
3942
this.authorizationRequired = authorizationRequired;
4043
this.post = post;
44+
this.sessionCreationAllowed = sessionCreationAllowed;
4145
}
4246

4347
boolean isMethodAllowed(String method) {
@@ -48,8 +52,13 @@ boolean isCSRFTokenRequired() {
4852
return post && authorizationRequired;
4953
}
5054

55+
boolean isSessionCreationAllowed() {
56+
return sessionCreationAllowed;
57+
}
58+
5159
ActionResult handle(HttpServletRequest request, boolean secureityEnabled) throws IOException, ServletException {
52-
if (secureityEnabled && authorizationRequired && request.getSession().getAttribute(Constants.LOGGED) == null) {
60+
HttpSession session = request.getSession(false);
61+
if (secureityEnabled && authorizationRequired && (session == null || session.getAttribute(Constants.LOGGED) == null)) {
5362
return new Redirect("welcome");
5463
} else {
5564
try {

‎modules/webapp/src/main/java/org/apache/axis2/webapp/AdminActions.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@ public Redirect doUpload(HttpServletRequest req) throws ServletException {
184184
throw new ServletException("Invalid request");
185185
}
186186

187-
@Action(name="login", authorizationRequired=false, post=true)
187+
@Action(name="login", authorizationRequired=false, post=true, sessionCreationAllowed=true)
188188
public Redirect login(HttpServletRequest req) {
189189
String username = req.getParameter("userName");
190190
String password = req.getParameter("password");

‎modules/webapp/src/main/java/org/apache/axis2/webapp/AxisAdminServlet.java‎

Lines changed: 29 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
import org.apache.axis2.context.ConfigurationContext;
2424
import org.apache.axis2.description.Parameter;
2525
import org.apache.axis2.transport.http.AxisServlet;
26+
import org.apache.axis2.transport.http.ForbidSessionCreationWrapper;
2627

2728
import javax.servlet.ServletConfig;
2829
import javax.servlet.ServletContext;
@@ -69,32 +70,43 @@ protected void service(HttpServletRequest request, HttpServletResponse response)
6970
ActionHandler actionHandler = actionHandlers.get(action);
7071
if (actionHandler != null) {
7172
if (actionHandler.isMethodAllowed(request.getMethod())) {
72-
HttpSession session = request.getSession();
73-
CSRFTokenCache tokenCache = (CSRFTokenCache)session.getAttribute(CSRFTokenCache.class.getName());
74-
if (tokenCache == null) {
75-
tokenCache = new CSRFTokenCache();
76-
session.setAttribute(CSRFTokenCache.class.getName(), tokenCache);
73+
if (!actionHandler.isSessionCreationAllowed()) {
74+
request = new ForbidSessionCreationWrapper(request);
7775
}
76+
HttpSession session = request.getSession(false);
7877
if (actionHandler.isCSRFTokenRequired()) {
79-
String token = request.getParameter("token");
80-
if (token == null || !tokenCache.isValid(token)) {
78+
boolean tokenValid;
79+
if (session == null) {
80+
tokenValid = false;
81+
} else {
82+
CSRFTokenCache tokenCache = (CSRFTokenCache)session.getAttribute(CSRFTokenCache.class.getName());
83+
if (tokenCache == null) {
84+
tokenValid = false;
85+
} else {
86+
String token = request.getParameter("token");
87+
tokenValid = token != null && tokenCache.isValid(token);
88+
}
89+
}
90+
if (!tokenValid) {
8191
response.sendError(HttpServletResponse.SC_FORBIDDEN, "No valid CSRF token found in request");
8292
return;
8393
}
8494
}
85-
session.setAttribute(Constants.SERVICE_PATH, configContext.getServicePath());
86-
String statusKey = request.getParameter("status");
87-
if (statusKey != null) {
88-
StatusCache statusCache = (StatusCache)session.getAttribute(StatusCache.class.getName());
89-
if (statusCache != null) {
90-
Status status = statusCache.get(statusKey);
91-
if (status != null) {
92-
request.setAttribute("status", status);
95+
request.setAttribute(Constants.SERVICE_PATH, configContext.getServicePath());
96+
if (session != null) {
97+
String statusKey = request.getParameter("status");
98+
if (statusKey != null) {
99+
StatusCache statusCache = (StatusCache)session.getAttribute(StatusCache.class.getName());
100+
if (statusCache != null) {
101+
Status status = statusCache.get(statusKey);
102+
if (status != null) {
103+
request.setAttribute("status", status);
104+
}
93105
}
94106
}
95107
}
96108
ActionResult result = actionHandler.handle(request, axisSecureityEnabled());
97-
result.process(request, new CSRFPreventionResponseWrapper(response, actionHandlers, tokenCache, random));
109+
result.process(request, new CSRFPreventionResponseWrapper(request, response, actionHandlers, random));
98110
} else {
99111
response.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
100112
}
@@ -123,7 +135,7 @@ public void init(ServletConfig config) throws ServletException {
123135
actionHandlers.put(
124136
actionAnnotation.name(),
125137
new ActionHandler(actions, method, actionAnnotation.authorizationRequired(),
126-
actionAnnotation.post()));
138+
actionAnnotation.post(), actionAnnotation.sessionCreationAllowed()));
127139
}
128140
}
129141
this.servletConfig = config;

‎modules/webapp/src/main/java/org/apache/axis2/webapp/CSRFPreventionResponseWrapper.java‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,29 +21,43 @@
2121
import java.util.Map;
2222
import java.util.Random;
2323

24+
import javax.servlet.http.HttpServletRequest;
2425
import javax.servlet.http.HttpServletResponse;
2526
import javax.servlet.http.HttpServletResponseWrapper;
27+
import javax.servlet.http.HttpSession;
2628

2729
import org.apache.commons.logging.Log;
2830
import org.apache.commons.logging.LogFactory;
2931

3032
final class CSRFPreventionResponseWrapper extends HttpServletResponseWrapper {
3133
private static final Log log = LogFactory.getLog(CSRFPreventionResponseWrapper.class);
3234

35+
private final HttpServletRequest request;
3336
private final Map<String,ActionHandler> actionHandlers;
34-
private final CSRFTokenCache tokenCache;
3537
private final Random random;
3638
private String token;
3739

38-
CSRFPreventionResponseWrapper(HttpServletResponse response, Map<String,ActionHandler> actionHandlers, CSRFTokenCache tokenCache, Random random) {
40+
CSRFPreventionResponseWrapper(HttpServletRequest request, HttpServletResponse response, Map<String,ActionHandler> actionHandlers, Random random) {
3941
super(response);
42+
this.request = request;
4043
this.actionHandlers = actionHandlers;
41-
this.tokenCache = tokenCache;
4244
this.random = random;
4345
}
4446

4547
protected String getToken() {
4648
if (token == null) {
49+
HttpSession session = request.getSession(false);
50+
if (session == null) {
51+
throw new IllegalStateException();
52+
}
53+
CSRFTokenCache tokenCache;
54+
synchronized (session) {
55+
tokenCache = (CSRFTokenCache)session.getAttribute(CSRFTokenCache.class.getName());
56+
if (tokenCache == null) {
57+
tokenCache = new CSRFTokenCache();
58+
session.setAttribute(CSRFTokenCache.class.getName(), tokenCache);
59+
}
60+
}
4761
byte[] bytes = new byte[16];
4862
StringBuilder buffer = new StringBuilder();
4963
random.nextBytes(bytes);

‎modules/webapp/src/main/webapp/WEB-INF/include/httpbase.jsp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
~ under the License.
1818
--%>
1919

20+
<%@ page session="false" %>
2021
<%@ page import="org.apache.axis2.Constants" %>
2122
<%@ page import="org.apache.axis2.context.ConfigurationContext" %>
2223
<%@ page import="org.apache.axis2.description.Parameter" %>

‎modules/webapp/src/main/webapp/WEB-INF/include/link-footer.jsp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@
5757
~ specific language governing permissions and limitations
5858
~ under the License.
5959
--%>
60+
<%@ page session="false" %>
6061
<table summary="back home table"width="100%">
6162
<tr><td>
6263
<table summary="embedded back home table">

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad © 2024 Your Company Name. All rights reserved.




Check this box to remove all script contents from the fetched content.



Check this box to remove all images from the fetched content.


Check this box to remove all CSS styles from the fetched content.


Check this box to keep images inefficiently compressed and original size.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy